PGP -- Pretty Good Encryption

What is all of this PGP stuff?
Otherwise known as:
Why do you have all that crud on your emails?

This document is NOT technical in nature.
If you want technical information on encryption or PGP Freeware from Network Associates you should view the following Adobe Acrobat documents that are packaged with the PGP Freeware Clients:

Introduction to Encryption
PGP Command Line Guide
PGP Windows User Guide

If you want the generalities from a non-cryptographer, you should read my document.

If you get email from me, the odds are that you have at some point been annoyed by all the junk that seems to be around all of my emails. If you don't get emails from me (or you just ignore the stuff you don't know), the messages look something like this:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

- -----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.3 for non-commercial use <http://www.pgp.com>
iQA/AwUBOT1mCD37zva3hQYNEQKpFACg62EWU2nmTkC7z2RfxiuSLRjlF2AAoP9W bw/TYGu1+jfpnSwL3xBtSdeF =zUWs
-----END PGP SIGNATURE-----

Generally you think it is all annoying and that is enough of an explanation for something that topher would do, or you think it is some geeky computer thing that no one but a true computer dork would understand. (Both of these have some basis in truth, but I will try to fix the last part of that statement so that you can all understand the PGP idea.)

To begin with, what you actually see on my messages is my PGP signature. If you were using the PGP software (available for free at www.pgp.com) you would be able to verify that:
1) topher had sent the message
2) the message text was the same as when topher sent it

This does not mean that it didn't make a stop on a server between my computer and your computer to have someone read the email, it just means that you know that I wrote what you are reading. Unfortunately, you can't be sure that someone else (your boss) isn't reading exactly the same thing at his desk, so there is no real security in the messages that I send out to the world at large, and for the most part I know that very few of you are using PGP, so there is very little reason for me to take the time to sign my emails, except to get you to ask "Why do you have all that crud on your emails?" (Nice guy, huh)

Those of you who are still with me are wondering "Well, what practical application can this possibly have?", and the answer lies in getting more people using PGP keys.

If you are using PGP then we can take things a step further and we can "encrypt" the messages that we are sending to each other. PGP from Network Associates can be integrated with most Windows email clients, and the best part is that it will also encrypt data on the clipboard, so even if it doesn't integrate with your email client you can copy your text, encrypt it, and then paste it back to your email client to send it. (whoopie!)

If you want to see what an encrypted email looks like, go here.

So, if we are both using PGP in one form or another we can create documents (and files) that are encrypted AND signed. This means that I can verify that you sent me the message, that the message has not been edited since you sent it, AND if your boss opens up the email all she sees is a bunch of gibberish. Without your "Private Key" (generated by the PGP software of your choice) your boss would have to put considerable time and effort into decrypting your messages.

I am just using "your boss" as an example, obviously. The same holds true for anyone who would happen to grab your email, whether that be out on the internet, or on your local computer. We can't make sure that no one else has intercepted your email, but we can make it reasonably difficult to figure out what was in it in the first place.

Well, that pretty much sums it up for PGP encryption over email. I haven't even covered it's uses for encrypting files on your Hard Drive, or using it to wipe the free space on your drive, but it has all of these uses and more! Keep in mind that the more people who use PGP encryption for their day to day correspondance make it more difficult for external groups to keep track of all of the emails that are sent using encryption. If someone only has to decrypt 3 user's email, it is less difficult than decrypting 300 user's emails.

Encryption.... It's not just for geeks any more!