Public Key

PGP
Phil Zimmermann's Pretty Good Privacy (PGP) is important to journalists and other people working with sensitive information in untrusted environments because it utilises a bottom-up key authentication process that denies authorities the ability to enforce a key escrow system upon the user population. Thus, people are able to send messages on this global network in the knowledge that no matter how corrupt the authorities are in a particular country, their information is safe.

To add my public keys to your key-ring, highlight the blue text including the "begin" and "end" lines. Copy each onto your clipboard and use PGPTray to add them to your key-ring. Try it one key at a time.

This key is a 2048 bit key - the second is a 4096 bit key (not twice as secure but 2 to the power of 2048 times more secure).

and . . .

Key Length
A few years ago, Blaze, Diffie, Rivest, Schneier, Shimomora, Thompson and Wiener suggested that a minimal length to guarantee safety (to prevent back-engineering time dependent documents such as wills and so on) for 20 years was 90 bits - with the processing capabilities of 1995, it was suggested that an organisation with $300,000,000 to spend on computing would take just 200µs (the amount of time it takes the electron beam on a TV to draw three horizontal lines on the screen) to decrypt 40 bit DES.

Brute Force Attack
Trying every key until you find one that fits is called a brute-force attack. To crack a 40 bit key, you need a school network and a few hours (this is the strongest no-strings-attached encryption that the US will allow to be exported in electronic form). To crack a 56 bit key, you need a few days on a specially designed computer - effectively 2 to the power of 16 (65,536) times more power. Each time you add one bit to the key length, you double either the computing power or the time to break a key with brute force.

Cryptography
Public key cryptography is different from conventional cryptography in that you do not (cannot) use the same key to decrypt a message that you used to encrypt it. This has the advantage that by having a pair of keys, you can keep one to yourself and let everybody else have a copy of the other one. In this way: you can sign a message with your private key and everyone will know that only you could have done so; and, you can encrypt a message to someone else using their public key and only they will be able to read it - if you also encrypt it with your private key, they will know that only you could have sent it (PGP does this).

Signing
Files may be signed by using a message digest (a hash function such as MD5 or SHA-1) with the result from the hash function being encrypted by the signer's private key. The public key is in everyone's possession so that everyone can see that it is signed by that person. If the message is changed in any way, the hash function will give a different result and fraud or accidental damage to the file will be detected. Hash functions are not simple compression algorithms and are designed so that it is not computationally feasible to work out another message that will give the same hash function result.

Encryption
Public key encryption is very processor hungry and it is used (with the long keys) to encrypt shorter once-only, session keys (that are used with Triple DES and so on) that change with each message encrypted so that even in the event of one of the session keys being decrypted, no other message can be decrypted and the longer keys cannot be calculated from the broken session key. The use of faster encryption methods allows longer messages and files to be encrypted swiftly without compromising the public key/private key pair.

To get a copy of PGP go to the PGP sites:

• for users Inside the US; and,
• Outside the US.

Back to the Index

Copyright 1998 - 2003 P.A.Grosse. All Rights Reserved