PGP

• PGP stands for Pretty Good Privacy (PGP) which is invented by Phil Zimmermann.
• PGP was designed to provide all four aspects of security, i.e., privacy, integrity, authentication, and non-repudiation in the sending of email.
• PGP uses a digital signature (a combination of hashing and public key encryption) to provide integrity, authentication, and non-repudiation. PGP uses a combination of secret key encryption and public key encryption to provide privacy. Therefore, we can say that the digital signature uses one hash function, one secret key, and two private-public key pairs.
• PGP is an open source and freely available software package for email security.
• PGP provides authentication through the use of Digital Signature.
• It provides confidentiality through the use of symmetric block encryption.
• It provides compression by using the ZIP algorithm, and EMAIL compatibility using the radix-64 encoding scheme.

Following are the steps taken by PGP to create secure e-mail at the sender site:

• The e-mail message is hashed by using a hashing function to create a digest.
• The digest is then encrypted to form a signed digest by using the sender's private key, and then signed digest is added to the original email message.
• The original message and signed digest are encrypted by using a one-time secret key created by the sender.
• The secret key is encrypted by using a receiver's public key.
• Both the encrypted secret key and the encrypted combination of message and digest are sent together.

PGP at the Sender site (A)

Following are the steps taken to show how PGP uses hashing and a combination of three keys to generate the original message:

• The receiver receives the combination of encrypted secret key and message digest is received.
• The encrypted secret key is decrypted by using the receiver's private key to get the one-time secret key.
• The secret key is then used to decrypt the combination of message and digest.
• The digest is decrypted by using the sender's public key, and the original message is hashed by using a hash function to create a digest.
• Both the digests are compared if both of them are equal means that all the aspects of security are preserved.

PGP at the Receiver site (B)

Disadvantages of PGP Encryption

• The Administration is difficult: The different versions of PGP complicate the administration.
• Compatibility issues: Both the sender and the receiver must have compatible versions of PGP. For example, if you encrypt an email by using PGP with one of the encryption technique, the receiver has a different version of PGP which cannot read the data.
• Complexity: PGP is a complex technique. Other security schemes use symmetric encryption that uses one key or asymmetric encryption that uses two different keys. PGP uses a hybrid approach that implements symmetric encryption with two keys. PGP is more complex, and it is less familiar than the traditional symmetric or asymmetric methods.
• No Recovery: Computer administrators face the problems of losing their passwords. In such situations, an administrator should use a special program to retrieve passwords. For example, a technician has physical access to a PC which can be used to retrieve a password. However, PGP does not offer such a special program for recovery; encryption methods are very strong so, it does not retrieve the forgotten passwords results in lost messages or lost files.