.. ses out of my business. If there is a legitimate need to know the information, the neighbor can force the issue in any number of ways: complain about me to the police, sue me and go through discovery, subpoena my employer, and so forth.
But if it is just purient curiosity, they are out of luck. And I really feel no need to satisfy someone else’s purient curiosity. Wink, wink, nudge, nudge — what’s it like?, as the Monty Python sketch put it. I am just a normal person.
I am not even particularly privacy conscious: I never go around in sunglasses, a trenchcoat with the collar turned up, and a hat pulled down. I do not have a second identity and a bank account in Euros. When someone asks me who I am, I tell them: I do not invent a name for “privacy.” I am just a person — a person who uses envelopes for my mail, who takes my charge card receipts, and who encrypts my data. This is not criminal.
This is not even abnormal. It is just sensible. What PGP DoesPGP, Network Associates’ encryption program, does four types of encryption. These types of encryption are useful in different ways.
Each is discussed below. Conventional EncryptionThe first type of encryption is what most people think of when they think of “encryption.” It is called conventional encryption, or “symmetric” encryption, or “shared secret” encryption. In this type of encryption, information is encrypted with a “key,” or secret phrase, and is decrypted (recovered) with the same key. This means that if I want to end you a message, and we agree on using conventional encryption, we have to meet and agree on the key. If one of us remembers the key incorrectly, we cannot communicate.
If I encrypt the message with the key “RED SAIL” and you try to decrypt the message with “READ SALE,” you will not be able to recover the message. “Key distribution” — getting you the key along with the encrypted message — is a real problem with convention encryption. There are several possible ciphers, or encryption algorithms, that PGP can use. These are CAST, IDEA, and triple DES.
(These names are acronyms for the actual cipher names.) Although cryptographers may prefer one over the other, they are all sufficient to keep nosy neighbors out of your hair. And none of them are sufficient to keep governments out of your hair, if you are the type that attracts the attention of governments. Unless you tell it otherwise, PGP will use CAST. (Previous version of PGP used IDEA, which is an older cipher than CAST. However, in cryptography, “new” does not mean “better.” Many cryptographers think “new” means “untried.” You can have PGP use IDEA if you are conservative.
Like me.) Public Key EncryptionThe second type of encryption PGP can do is called public key encryption, or “asymmetric” encryption. This type of encryption is based on a type of mathematics where the encryption key and decryption key are different but related. Information is encrypted with the “public” key but cannot be decrypted without the related “private” key. This means that if I want to send you a message, I get your public key somewhere, encrypt my message, and send it. The only knowledge the public key gives me is how to encrypt a message so you can read it. It does not let me recover messages encrypted to that key.
Only you — with your private key — can read the message. Now, since the only thing the public key lets you do is send a message to the owner of the corresponding private key, there is no need to restrict distribution of the public key. You can give your public key to everyone you know. You can publish your public key in the newspaper. You can publish your public key on your web page. Like this: my public keys.
PGP’s public key encryption actually uses a symmetric cipher for the actual data. PGP generates a random session key for each encryption, and encrypts with that. It solves the key distribution problem by encrypting the session key with the recipient’s public key. So only someone who has the recipient’s private key can recover the session key, and, using that, recover the message. As public key encryption uses conventional encryption, PGP lets you specify which convention cipher to use. There are also two types of public keys that PGP can used.
These are RSA and DH. (These names, also, are acronyms for the actual public key scheme names.) Although cryptographers may prefer one over the other, they are both sufficient to keep nosy neighbors out of your hair. And neither of them are sufficient to keep governments out of your hair, if you are the type that attracts the attention of governments. The freeware version of PGP will use DH, and in fact cannot use RSA. (This has to do with patent licensing, not cryptographic security.) Unless, you get the “international” freeware version of PGP: that version of PGP can do RSA. (The patent that needs to be licensed is a US-only patent.) Or unless you have the 128-bit security add-on for Internet Explorer, either version 4 or version 5: then PGP can do RSA.
(Microsoft licensed the patent, and PGP can use the Internet Explorer libraries.) Note that current freeware versions of PGP can use RSA keys, as described above. They cannot, however, create RSA keys. You need an old version of freeware PGP for that. (For which RSA gave a free license.) Or you need the RSA-capable commercial version of PGP: that PGP can use RSA keys and generate them. (If you have that version, you licensed the patent, or rather paid the license fee.) Digital SignaturesThe third type of encryption PGP can do is a digital signature.
This is a variation on public key encryption that lets others know a message came from you. Remember that keys in public key encryption came in two related halves: a public key and a private key. The private key can decrypt messages encrypted with the public key. But the mathematics work out so that the public key can also decrypt messages encrypted with the private key.
Now, the private key is private — only the owner has access to it. This means that if you can decrypt a message with someone’s public key, then the message was encrypted with that person’s private key. This means the message came from the person. What is actually encrypted is a message digest or a “message fingerprint,” not the actual message.
The message digest is a long binary value derived from the message contents with what is called a cryptographic hash. What makes a hash “cryptographic” is that it is impossible to reverse. That in turn means that you cannot come up with a message to match a specified hash value. So it is impossible to remove the signature from one message and put it on another. In this way, digital signatures are actually more secure than physical signatures: no matter how creative I am with photocopiers or binary editors, I can never get someone’s signature onto a message that they have not, in fact, signed. Encrypted DisksThe fourth, and last, type of encryption PGP can do is a “PGP disk.” This is a file on your computer that acts like another disk drive when it is “mounted.” But the disk contents — all of them, files and free space alike — are encrypted.
When you “mount” the disk, you give the pass phrase which decrypts the encryption key which lets PGP access the “PGP disk” on behalf of other programs. The other programs do not need to know they are using an encrypted disk. Without the pass phrase, however, no dice — the data is locked up tight. You can access the file containing the encrypted “disk,” but that will not give you any information (other than, “this is a PGP disk,” but you could tell that anyway).
Other TopicsAfter you get used to using PGP, you can enter the world of anonymous remailers and nyms. These let you be anonymous or pseudonymous. And some day, I will write about them.
