219 lines
9.1 KiB
Plaintext
219 lines
9.1 KiB
Plaintext
Here's a draft PGP FAQ for alt.security.pgp. I'd better post this soon as I'm
|
|
getting buried in FAQ's via email...
|
|
|
|
PGP Frequently Asked Questions
|
|
==============================
|
|
(Draft version)
|
|
|
|
- What is PGP?
|
|
- Where can I get PGP?
|
|
- Where can I get/publish PGP keys?
|
|
|
|
What is PGP?
|
|
============
|
|
|
|
In brief:
|
|
|
|
PGP (Pretty Good Privacy) is a freeware RSA public-key encryption package for
|
|
Unix, MSDOS, OS/2, the Amiga, the Atari ST, and VMS. It protects E-mail and
|
|
files, letting you communicate securely with people you've never met, with no
|
|
secure channels needed for prior exchange of keys.
|
|
|
|
PGP has sophisticated key management, an RSA/conventional-key hybrid
|
|
encryption scheme, data authentication via digital signatures, and data
|
|
compression before encryption. The C source for PGP code is available for
|
|
free use by anyone.
|
|
|
|
In more detail:
|
|
|
|
This note assumes you are familiar with PGP (Pretty Good Privacy), the
|
|
freeware public key cryptographic software package.
|
|
|
|
Philip Zimmermann is under threat of lawsuit from the RSA patent holders,
|
|
Public Key Partners, if he distributes or updates PGP again. Zimmermann has
|
|
abided by that condition and has not distributed PGP since the threat was
|
|
made. So any enhancements for PGP have to be developed by other people,
|
|
preferably outside the reach of US patent law. The RSA patent does not apply
|
|
outside the USA. Accordingly, PGP Version 2.0 was developed by a team of
|
|
software engineers in Europe and New Zealand, with design guidance from
|
|
Philip Zimmermann. It was released September 3 by Branko Lankester in
|
|
Amsterdam and Peter Gutmann in New Zealand.
|
|
|
|
The new version has many ergonomic improvements, much better key management,
|
|
faster and better conventional cryptography, faster public key cryptography,
|
|
and faster and better data compression. It also has been ported to SPARC
|
|
Unix, Ultrix, VAX/VMS, Commodore Amiga, Atari ST, OS/2, and of course it
|
|
still runs on MSDOS.
|
|
|
|
The RSA math functions are about 2.28 times as fast (as measured on an MSDOS
|
|
system). The new signature hashing algorithm is MD5. The new compression
|
|
routines are similar in functionality to those used in PKZIP, and were
|
|
developed in C by a French team. The new faster conventional cipher, called
|
|
IDEA (International Data Encryption Algorithm), was developed at ETH in
|
|
Zurich by James L. Massey and Xuejia Lai. Preliminary evidence suggests that
|
|
IDEA may be more resistant than the DES to Biham & Shamir's highly successful
|
|
differential cryptanalysis attack. Biham and Shamir have tried
|
|
unsuccessfully to find any weaknesses in the IDEA cipher.
|
|
|
|
The keys on the public keyring retain their certifying signatures while on
|
|
the keyring, and can be automatically checked for tampering by PGP before
|
|
using the keys. They can be individually copied off the keyring along with
|
|
their attached signature certificates, in ASCII form suitable for emailing.
|
|
Each key may have several attached certifying signatures. User ID's and
|
|
passwords can be revised by the key owner. When a user ID is modified for a
|
|
key, new certifying signatures must be created for that key.
|
|
|
|
The ASCII transport armor changed from uuencoded form to another ASCII
|
|
radix-64 representation similar to that used by the Internet PEM standard.
|
|
This makes PGP messages more resistant to mutilation by strange email
|
|
gateways.
|
|
|
|
The new PGP is more usable in batch mode, returning error result codes to the
|
|
DOS shell. It can also be used to some extent in a pipeline filter mode for
|
|
Unix.
|
|
|
|
There are too many ergonomic improvements to list here. One example is a
|
|
built-in Unix-style "more" function, to optionally display deciphered
|
|
plaintext directly on your screen without writing any plaintext to disk.
|
|
Also, all the PGP user messages and prompts can be displayed in German,
|
|
Dutch, Spanish, French, Italian, and Russian.
|
|
|
|
There are other improvements in the area of key management. Zimmermann's new
|
|
key management is even more uniquely suited to socially decentralized
|
|
environments, rather than to monolithic corporate or government institutions.
|
|
|
|
Where can I get PGP?
|
|
====================
|
|
|
|
PGP is slowly becoming available on more and more sites worldwide. If you
|
|
can't find a copy locally, you could try the following:
|
|
|
|
PGP via FidoNet
|
|
---------------
|
|
|
|
Due to FidoNet's distributed nature, there isn't really one location where
|
|
everyone can get a copy. However it is being distributed extensively over
|
|
the net - if you can't get a copy locally, bug your sysop to bring one in!
|
|
|
|
PGP by ftp
|
|
----------
|
|
|
|
PGP is available for ftp from the following sites:
|
|
|
|
garbo.uwasa.fi (128.214.87.1) /pub/pc/encryption (DOS and OS/2)
|
|
/pub/unix/encryption
|
|
|
|
kauri.vuw.ac.nz (130.195.11.3) /pub/ms-dos/Encryption (all versions)
|
|
Note: NZ users only.
|
|
|
|
ghost.dsi.unimi.it (???) /pub/crypt
|
|
|
|
ftp.uni-kl.de /pub/atari/incoming
|
|
|
|
Remember to chose *binary* mode when retrieving the files!
|
|
|
|
PGP via Compuserve
|
|
------------------
|
|
|
|
PGP is available in the the Compuserve IBMSYS forum, just type "go ibmsys" t
|
|
get there. Then when you get the following:
|
|
|
|
IBM Sys/Utilities Forum Menu
|
|
|
|
1 INSTRUCTIONS
|
|
|
|
2 MESSAGES
|
|
3 LIBRARIES (Files)
|
|
4 CONFERENCING (0 participating)
|
|
|
|
5 ANNOUNCEMENTS from sysop
|
|
6 MEMBER directory
|
|
7 OPTIONS for this forum
|
|
|
|
Choose 3, the files area. This will give the following menu:
|
|
|
|
IBM Sys/Utilities ForumLibraries Menu
|
|
|
|
0 General [S]
|
|
1 DOS Utilities [S]
|
|
2 OS/2 Utilities [S]
|
|
3 General Utils [S]
|
|
4 Multitasking [S]
|
|
5 DOS Shells/Mgrs [S]
|
|
6 File Utilities [S] <- PGP is in here
|
|
7 Desktop Utils [S]
|
|
8 Demos [S]
|
|
9 Disk Library [S]
|
|
|
|
Choose 6, the file utlities area. This will bring up the following menu:
|
|
|
|
IBM Sys/Utilities Forum Library 6
|
|
|
|
File Utilities [S]
|
|
|
|
1 BROWSE Files
|
|
2 DIRECTORY of Files
|
|
|
|
3 UPLOAD a File (FREE)
|
|
4 DOWNLOAD a file to your Computer
|
|
|
|
5 LIBRARIES
|
|
|
|
>From here you can either browse the files (use the keyword 'PGP'), or
|
|
download them. The source code is PGP20S.ZIP, the MSDOS executable is
|
|
PGP20.ZIP.
|
|
|
|
PGP via BIX
|
|
-----------
|
|
|
|
PGP is available in the Security/listings area. If someone could provide
|
|
more details on this I'd be grateful.
|
|
|
|
Where can I get/publish PGP keys?
|
|
=================================
|
|
|
|
The following is the README file from a PGP keyserver run by Felipe
|
|
Rodriquez at utopia.hacktic.nl:
|
|
|
|
-----------------------------------------------------------------------------
|
|
Beware of unsigned keys, these could be forgeries from an attacker wanting
|
|
access to your information. Always be sure your keys are certified by several
|
|
people.
|
|
-----------------------------------------------------------------------------
|
|
|
|
PGP-SERVER POLICIES
|
|
|
|
You can send your PGP public-keys to pgp-keys@utopia.hacktic.nl
|
|
|
|
Your key will be added to our public keyring. In order to certify your key,
|
|
so that other people know that the key is actually yours, make sure it is
|
|
signed by other people before sending it in. It is advisable to have your
|
|
key signed by as many people as possible, before sending your key to our
|
|
key-server. Make sure that the people that sign your key are 100% sure of
|
|
the fact that the key is yours.
|
|
|
|
Keys will only be signed by me if I'm 100% sure about the sender of the key.
|
|
This requires a voice validation of your key's ASCII-armor. I will NOT sign
|
|
ANY keys that I don't trust 100%. E-Mail is subject to many types of forgery
|
|
and is not a secure channel for verification. Verification can only be done
|
|
by you reading to me some indicated characters in your keys ASCII armor,
|
|
either over the phone, or by visiting me personally.
|
|
|
|
For a pgp-server to work, it is absolutely crucial to keep the above stated
|
|
points in mind. Security is your responsability, if you want other persons
|
|
to trust your key, see to it that it is signed by a lot of people that are
|
|
competent in key-managment.
|
|
|
|
If you don't want your key to be signed then that's your responsibility.
|
|
You'd make it easy for any attacker to forge a key that is supposed to be
|
|
yours. All users of the hacktic-PGP server are advised _not_ to use any
|
|
unsigned keys.
|
|
|
|
Felipe Rodriquez, key-manager@utopia.hacktic.nl
|
|
nonsenso@utopia.hacktic.nl
|
|
--
|
|
pgut1@cs.aukuni.ac.nz || peterg@kcbbs.gen.nz || peter@nacjack.gen.nz
|
|
(In order of preference)
|
|
------------------------------------------------------------------------------
|
|
|