{"id":3031,"date":"2013-10-29T10:00:32","date_gmt":"2013-10-29T14:00:32","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=3031"},"modified":"2020-02-26T10:44:51","modified_gmt":"2020-02-26T15:44:51","slug":"pgp-reliable-privacy-security-and-authentication-for-everyone","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/3031\/","title":{"rendered":"PGP \u2013 Reliable Privacy, Security And Authentication For Everyone"},"content":{"rendered":"

If you have been following the latest in news, you\u2019ve probably heard a lot of stories talking about privacy, information leakage<\/a>, espionage<\/a> and such. Given that most of our communications nowadays take place online, or at the very least, via an electronic device, we should all be aware of how to protect our valuable information. This is not only applicable to large organizations, but for everyone that uses a computer on a regular basis. We all have information we want to keep private and protected and we all need to communicate online. With PGP, you can add a very strong yet easy to use layer of security to your online communications.<\/p>\n

Pretty Good Privacy (PGP), created by Phil Zimmermann, is a computer program that can be used to protect your privacy, add security to your communications and ensure authenticity in electronic messages. You can encrypt any personal or private information (whether it\u2019s an email, a file or your entire hard disk drive) making it very difficult for third parties to eavesdrop or intercept the original contents of your sources. It can also offer something called \u201cdigital signing,\u201d which allows you to send messages that can be verified by the recipient, providing the peace of mind of knowing the message wasn\u2019t modified in transit and that it came from you and only you. Imagine a world where everyone signs their messages (it\u2019s easy if you try), it would make phishing attempts a lot harder to perform and the many hoaxes and forged emails we receive everyday would simple disappear because it wouldn\u2019t be cost effective for cyber criminals to invest that much effort into them.<\/p>\n

\u201cPGP empowers people to take their privacy into their own hands. There\u2019s a growing social need for it. That\u2019s why I wrote it.\u201d \u2013 Phil Zimmermann<\/div>\n

More than 20 years have passed since the creation of PGP and substantial progress has been made since those days. In the beginning, Zimmermann was investigated by the US government for \u201cmunitions export without a license\u201d since encryption products stronger than 40bits (PGP was a 128bit product) were considered a munition. Even though the case was closed without criminal charges being filed against him, it shows how much of a powerful tool encryption can be and why some key stakeholders have such a large interest in keeping it under strict supervision.<\/p>\n

Eventually, the full-featured version of PGP with strong encryption became available to the general audience worldwide. The Free Software Foundation developed its own OpenPGP-compliant program called GNU Privacy Guard<\/a> (abbreviated GnuPG or GPG), which is freely available and provides a library used for encryption, decryption and signing functions. It can be used along many graphical user interfaces (GUI) available for a wide range of operating systems ensuring that PGP is available to everyone and is easy to use.<\/p>\n

Given that the source code for PGP is available for download, you can review it, look for bugs, check for backdoors or just learn from it. Even if you are not personally able to do these checks, you can trust there\u2019s a security conscious community that is not related to any government or particular company that does this continually in order to make sure that PGP is free from third party intervention. This is increasingly important after recent revelations about three-letter agencies trying to circumvent encryption<\/a> in modern communications\u2019 protocols.<\/p>\n

By this moment you probably want to at least try PGP\/GPG and see what it can do for you. In asymmetric cryptography we need two separate keys, one of which is private (used for decryption or digital signing) and one that is public (used to encrypt plaintext or verify a digital signature). It\u2019s not necessary to understand everything right away, just remember that you\u2019ll understand it better as you get more experience with your everyday usage. However, we\u2019ll review some basic concepts of public key cryptography so you can feel more comfortable when starting to use all the tools available for your OS of choice.<\/p>\n

There\u2019s no excuse for not trying PGP\/GPG since tools are available for every major operating system.<\/div>\n

When we talk about a key we are referring to a block or string of alphanumeric text. This key can be exported to a file or uploaded to a key server so you can share it with the rest of the world (your public key that is). This particular key is generated by PGP using a wide range of encryption algorithms. You need to remember that both of your keys (private and public) are mathematically linked by this algorithm and this is what makes it possible for you to share the public portion of it without compromising the security of the system.<\/p>\n

There\u2019s no excuse for not trying PGP since tools are available for every major operating system. As mentioned previously, we have GNU PGP available, but there are also specific tools that work best for the OS they were built for. For Mac OS X, we have GPG Suite<\/a>, which includes a plugin for Apple Mail, a keychain to manage all your keys, GPG services to encrypt\/decrypt\/sign\/verify text, files and more, and MacGPG which is the command line version equivalent of GnuPG. If you are using Windows, a similar tool is available named GPG4Win<\/a>, which includes a port of GnuPG, a keychain, plugins for major mail clients and everything you need to get started.<\/p>\n

It\u2019s very important to remember that the security of your key depends not only on the passphrase you use when creating it, but also on the confidentiality of the private key itself. Should someone have access to your key file and passphrase (for example if your computer was compromised with a keylogger<\/a>) the whole security scheme would be severely affected. Never distribute your private key and choose a passphrase that only you can remember, but is not easily guessable.<\/p>\n

When you create a new key pair with PGP, you will have to choose a key length and a passphrase which will protect your private key. The longer the length of your key the more time consuming the key generation process will be, but since this is going to be done only once I recommend that you choose a key length of no less than 4,096 bits. For maximal security long-term, 8192 bits would be great if you are patient enough for the process to finish \u2013 we have a separate walk-through on PGP\/GPG key generation<\/a>.<\/p>\n

PGP uses two keys: public and private. Keep the latter in secret, feel free to distribute the former to everyone.<\/div>\n

Why is choosing the optimal key length and passphrase so important? Well, let\u2019s suppose someone has access to your keychain and gets a copy of your private key file. If that person doesn\u2019t know your passphrase one possible way to crack the key<\/a> would be to attack the cryptographic system directly, which given the recommended key length used (4096 or 8192 bits), would be too time consuming and improbable to solve given the current state of computing technology. The other option is to use a dictionary or brute force attack and find a match for the passphrase you have chosen to protect your key. This last option is the most common one and is a more direct way to gain access to your encrypted data. By making your private key long enough, you can discourage this type of attack.<\/p>\n

When you have your very own pair of PGP keys, you can start using it like this: distribute your public key to everyone, include it in your mail signature, give it to your friends who write you most. They have to use similar install of PGP\/GPG to encrypt their messages using your public key. Any third party would not be able to decrypt this message, because it\u2019s impossible to do this using a public key. Only you, having your private key ready, are able to decrypt this message. If you want to send your reply in encrypted form, you have to use your friends\u2019 public key. Digital signatures work exactly the opposite way: when you send your message, you \u201csign\u201d it with your private key. Any person can use your public key to verify the letter and make sure it was signed by you and came unmodified. It may sound a little bit complicated, but properly configured e-mails could include the signing\/encryptions components in just two mouse clicks:<\/p>\n

\"pgp-scr-basic\"<\/a><\/p>\n

In conclusion, we have seen the difficult beginnings of PGP, a brief historical view on the reason why it was invented, basic security concepts and some noteworthy recommendations. I hope this serves as the motivation you need to try PGP and use it for encrypting\/signing your files and information. Privacy is something each one of us needs to take care when being a part of this always connected world, with the tools available it\u2019s easy and you\u2019ll thank yourself sooner rather than later for having taken that first step in this direction.<\/p>\n

Governments and intelligence agencies have based their programs on privacy, and even outlaws have done so too. What about the common everyday user? Previously, only those with money could afford military grade encryption, but that was until PGP appeared on the scene. The common user didn\u2019t have a way to keep his communications and information private nor was this something that other parties wanted to happen. There was a need that for this hole to be filled and fortunately, after 20 years PGP has shown that it is more than capable of protecting that inherent right for freedom and privacy.<\/p>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

If you have been following the latest in news, you\u2019ve probably heard a lot of stories talking about privacy, information leakage, espionage and such. Given that most of our communications<\/p>\n","protected":false},"author":313,"featured_media":3033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,9],"tags":[189,487,43,131],"class_list":{"0":"post-3031","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-tips","9":"tag-data-security","10":"tag-pgp","11":"tag-privacy","12":"tag-tips"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/3031\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/2621\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/2512\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/2780\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/2613\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/pgp-reliable-privacy-security-and-authentication-for-everyone\/1920\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/3031\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/pgp-reliable-privacy-security-and-authentication-for-everyone\/3031\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/data-security\/","name":"data security"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/313"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=3031"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3031\/revisions"}],"predecessor-version":[{"id":32948,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3031\/revisions\/32948"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/3033"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=3031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=3031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=3031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}