PGP (Pretty Good Privacy) is encryption software designed to provide privacy, security and authentication to online communication systems. Phil Zimmerman created the first PGP program and, according to him, it became publicly available due to the growing demand for privacy.
Since its introduction in 1991, many versions of PGP software have been created. In 1997, Phil Zimmerman made a proposal to create the Internet Engineering Task Force (IETF), a widely accepted open source standard for PGP. The proposal was accepted and led to the creation of the OpenPGP protocol, which defines standard encryption formats for keys and messages.
Although PGP was originally used only to protect email and its attachments, it is now used more widely, including digital signatures, full disk encryption, and network security.
PGP was originally owned by PGP Inc, which was later acquired by Network Associates Inc. In 2010, Symantec Corp. bought PGP for $300 million and the term is now a trademark used for their OpenPGP compatible products.
How it works?
PGP is one of the first widely available programs to implement public key cryptography. It is a hybrid cryptosystem that uses both symmetric and asymmetric encryption to achieve a high level of security.
In the basic process, encrypting text data (which can be easily understood) converts it into ciphertext (unreadable data). But before the encryption process begins, most PGP systems perform compression. By compressing text files, PGP saves disk space and transfer time, and also improves security.
After the file is compressed, the encryption process begins. At this stage, the compressed text file is encrypted with a one-time key called the session key. This key is randomly generated using symmetric cryptography and each PGP session has its own unique session key.
The session key (1) is then encrypted using asymmetric encryption: the intended recipient (Bob) provides his public key (2) to the sender of the message (Alice) so that she can encrypt the session key. This step allows Alice to securely share the key with Bob over the Internet, regardless of the security level.
Asymmetric session key encryption is typically performed using the RSA algorithm. Many other encryption systems use it, including the Transport Layer Security (TLS) protocol, which secures much of the Internet.
Once the message ciphertext and the encrypted session key have been obtained, Bob can use his private key (3) to decrypt the session key, which is then used to decrypt the ciphertext.
In addition to the basic encryption and decryption process, PGP also supports digital signatures, which perform at least three functions:
Authentication: Bob can verify that the sender of the message was Alice;
Integrity: Bob can be confident that the message is intact;
Non-repudiation: Once a message is digitally signed, Alice will not be able to claim that she did not send it.
Application options
One of the most common uses of PGP is to secure email. A message protected with PGP turns into a string of characters that cannot be read (ciphertext) and can only be decrypted using the appropriate key. To ensure message security, the security mechanism is essentially the same, and there are also software applications that allow you to implement PGP on top of others, effectively integrating encryption into insecure messaging services.
While PGP is primarily designed to secure Internet communications, it can also be used to encrypt individual devices. In this case, the program can be applied to disk partitions on a PC or mobile device. When encrypting a hard drive, the user will have to provide a password every time the system boots.
Advantages and disadvantages
Through the combined use of symmetric and asymmetric encryption, PGP allows users to securely exchange information and cryptographic keys over the Internet. As a hybrid system, PGP has the advantages of both the security of asymmetric cryptography and the speed of symmetric encryption. In addition to these benefits, PGP implements digital signatures to ensure data integrity and sender authenticity.
The OpenPGP protocol has created a standardized competitive environment and PGP solutions are now offered by several companies and organizations. However, all PGP programs that comply with the OpenPGP standards are compatible with each other. This means that files and keys created in one program can be used in another without any problems.
In terms of disadvantages, PGP systems are not that easy to use and understand, especially for users with weak technical skills. In addition, the large length of public keys is considered inconvenient by many.
In 2018, the Electronic Frontier Foundation (EFF) published a major vulnerability called EFAIL. This issue allows hackers to use active HTML content in encrypted emails to gain access to the decrypted version of the messages.
However, some of the problems described in EFAIL had already been known to the PGP user community since the late 1990s, and in fact, the vulnerability lay in different implementations on the part of email clients, and not in PGP itself. So, despite the alarming and misleading headlines, PGP is still highly secure.
Conclusion
Since its inception in 1991, PGP has been an essential tool for data security and is now used in most applications, providing privacy, security and authentication for communications systems and digital service providers.
Although the 2018 revelation of EFAIL raised serious concerns about the protocol's viability, the underlying technology is still considered secure and cryptographically sound. It's worth noting that different PGP implementations may have different levels of security.