Computer Security Pretty Good Privacy



  Computer Security.pdf (Size: 563.65 KB / Downloads: 0)

Pretty Good Privacy

The success of our information economy depends, in large part, on
the ability to protect information as it flows. This relies on the
power of cryptography. RSA provides extremely strong encryption,
but is not particularly easy to use.
Phil Zimmermann had the goal of providing strong encryption for
the masses, in the form of an encryption system for email that is:
extremely strong, using state of the art cryptographic
algorithms;
easy to use and accessible to all.



Did Zimmermann Succeed?

From Wikipedia page on PGP:
In 2003, an incident involving seized Psion PDAs
belonging to members of the Red Brigade indicated that
neither the Italian police nor the FBI were able to decode
PGP-encrypted files stored on them.
A more recent incident in December 2006 (see United
States v. Boucher) involving US customs agents and a
seized laptop PC which allegedly contained child
pornography indicates that US Government agencies find
it “nearly impossible” to access PGP-encrypted files.
Additionally, a judge ruling on the same case in
November 2007 has stated that forcing the suspect to
reveal his PGP pass-phrase would violate his Fifth
Amendment rights i.e. a suspect’s constitutional right
not to incriminate himself.


Growth of PGP

PGP has grown explosively and is widely used.
1 Available free worldwide for Windows, UNIX, Macintosh, and
others. The commercial version satisfies businesses needing
vendor support.
2 Based on algorithms with extensive public review.
Public key encryption: RSA, DSS, Diffie-Hellman.
Symmetric encryption: CAST-128, IDEA, and 3DES.
Hash coding: SHA-1.
3 Wide applicability: standardized scheme for encryption,
supports secure communication over Internet and other
networks.
4 Not developed by or controlled by any government.
5 Now on track to become an Internet standard (RFC 3156).



PGP Authentication
This is a digital signature function.
1 Sender creates a message.
2 SHA-1 (or DSS/SHA-1) is used to generate a 160-bit hash
code of the message.
3 The hash code is encrypted with RSA using the sender’s
private key and the result is prepended to the message.
4 The receiver uses RSA with the sender’s public key to decrypt
and recover the hash code.
5 The receiver generates a new hash code for the message and
compares it with the decrypted hash code.