Public Key

PGP
Phil Zimmermann's Pretty Good Privacy (PGP) is important to journalists and other people working with sensitive information in untrusted environments because it utilises a bottom-up key authentication process that denies authorities the ability to enforce a key escrow system upon the user population. Thus, people are able to send messages on this global network in the knowledge that no matter how corrupt the authorities are in a particular country, their information is safe.

To add my public keys to your key-ring, highlight the blue text including the "begin" and "end" lines. Copy each onto your clipboard and use PGPTray to add them to your key-ring. Try it one key at a time.

This key is a 2048 bit key - the second is a 4096 bit key (not twice as secure but 2 to the power of 2048 times more secure).

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGPfreeware 5.0i for non-commercial use

mQGiBDTnWHkRBAD2NbQPuEGAMLs6Q0TwTeCD1bs4vydy/WMI5kDWqolp+dbIAVYU
zQusggiek5fZouUSjf4vmCe8mSxjH/x8E65MkWQ8WvZDkvb045Xt13piWCwy2iOo
OzMp8ipaDWBdOp59Mh1Qs6q0gjemZkXqrTv2j6gIIonDLTmu6kn2CTpXLwCg/xKI
vY5Zw91lV1o2YJlN87itfwsD/3Vo607ntDO7fmx+kR+QQVyt9XbN1Gvf9np4cswL
UcxW3p7Yfza/lIQQOT43DaPkyof18c4IzQ/XP4peK5Tucx9OxOtsebs9j89IFy4F
dcU84UnxX+jy8FHDgwKG5GWczQi6MK+COBdubDUoA7Pn1H9Mb0iSmMYAY4Omk6qR
cJx2BADqRu3MmVoL1rD5N4RZx9AUh7Qvt/rn2IuqBir9qhb9oPbvCPP8ddAIvoTq
MC/E3HSnkepY5TWGTZCshQSpV0zvSO0is625ilkpg9rhoSy6PxDfgEydxf5o3Ry0
nRCGaPDbWXDH2wc9Hb9jwa3BtLL60ZQg4KDROoomjxClZUE/BLQqUGF1bCBBbGFu
IEdyb3NzZSA8cGFncm9zc2VAY29tcHVzZXJ2ZS5jb20+iQBLBBARAgALBQI051h5
BAsDAQIACgkQwP8FDBN2/trl7ACcCHDzhRIviKCLjSwzMyPvNf+XURYAnRt/tUeM
QK5kqVYBuogSKA/tmj45uQINBDTnWHkQCAD2Qle3CH8IF3KiutapQvMF6PlTETlP
tvFuuUs4INoBp1ajFOmPQFXz0AfGy0OplK33TGSGSfgMg71l6RfUodNQ+PVZX9x2
Uk89PY3bzpnhV5JZzf24rnRPxfx2vIPFRzBhznzJZv8V+bv9kV7HAarTW56NoKVy
OtQa8L9GAFgr5fSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPw
pVsYjY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnI
Byl6ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpMgs7AAICCADF
j0Dtme5F1FpGD8WkgxQ7EEwhaPRWsTd1NU5VW/zcZmCBytmsF9v+FlisOJF58DrY
jEAwN2CqOFEe8OH+0LcYGEZ6Ia4jwXHf7jP+BKGhKABR5Rn/4s2rOKubBEUGgCkp
6jEAr35SUtOnq3F3a0p6gmn40lsceTnU9Wb4TA8eVDVGJlRhMUJ4qcTomUKRpCRE
QG3Io8tojNe+WQ3pgbC1lEfeO9zOdZy3D3dqJtpUqmPS43DXF1nfIY1PJ6gDjaYZ
vvQP3bz+q31fBUQKLgJTbTE1iip/W1UYoQgXDdJnQBAWcTkzudtm+IgxdwJxJUgm
FENjYZvcjpylEG3xpeXOiQA/AwUYNOdYecD/BQwTdv7aEQI7dQCg7fBvcfVp/5DZ
vdpRwC3ms4o7PwMAn1QNf0OkY14/Uhx3xM8dBNH/m151
=bUs/
-----END PGP PUBLIC KEY BLOCK-----

 

and . . .

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGPfreeware 5.0i for non-commercial use

mQGiBDTtu0gRBADPTsEknQaV1K3VU7W79sdKOUlraGy5PGcM5JxT2YXxkhomx8xH
7L2pEsfeeEWElXM/R7q87nCF4eJ5O9IMzVoUrC/n5sTDM8fVFl/KWHJ9p46eUxmh
o3aBO5MtzAM1yDqQVDd+gA6Rb6m24KspHYI4ee2laqmOZKGepcmkng56VQCg/0Fv
R6Z1pBes3zrP+QPob1HCiqED/0rX3AJ8I7op1MDA9MtE3QiIPBTf1lq0P4UheVig
239PhIYij+SgyONhhadhvNLbeI/ihAOOwi/QFIH/izwHIWsAcm+Y+WHMh0dHD2aq
O11TQJOPJOoLAKqcvFpqVOaO6ayTB7p+9BXprWTN17Z1JsqWLJs1KLh+GXycfkwf
mCY+A/4mMyCL3NhST4J/mROsEEZiS72wKgB+cWYVDLlMZJwvFwf3pp7oJXoYR/4m
fZXfNYL4K9bNSiXwk2pwinCAkNKKhbM2kyn2Z3mVajpcMNqkiQAJ+uzOYMzBgf9v
nSZd04//Ook2Awor4ppd/7rIVL5hBKYpdw7tswAyxtTES8GyfbQnUGF1bCBBIEdy
b3NzZSA8cGFncm9zc2VAY29tcHVzZXJ2ZS5jb20+iQBLBBARAgALBQI07btIBAsD
AQIACgkQs68K2T44DW+3JgCgy0VUaBbFp8n02oGdEXR73n7K0IEAoOSawlkGZbSC
W+DdmGJDUNcHDNHfuQQNBDTtu0kQEAD5GKB+WgZhekOQldwFbIeG7GHszUUfDtjg
o3nGydx6C6zkP+NGlLYwSlPXfAIWSIC1FeUpmamfB3TT/+OhxZYgTphluNgN7hBd
q7YXHFHYUMoiV0MpvpXoVis4eFwL2/hMTdXjqkbM+84X6CqdFGHjhKlP0YOEqHm2
74+nQ0YIxswdd1ckOErixPDojhNnl06SE2H22+slDhf99pj3yHx5sHIdOHX79sFz
xIMRJitDYMPj6NYK/aEoJguuqa6zZQ+iAFMBoHzWq6MSHvoPKs4fdIRPyvMX86RA
6dfSd7ZCLQI2wSbLaF6dfJgJCo1+Le3kXXn11JJPmxiO/CqnS3wy9kJXtwh/CBdy
orrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9
ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7
/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yI
sxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAY
EY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuqui
XsNV6z3WFwACAg/+KkywP6cij3CNWv2q6JTYjCdAy0GpLPO+67byfBXd7cE40qD8
EPEcGHP+eYys1uVPBW2Bf7Ex/804HAepq9suugeZQKsL5yCzwGlo5Ig6xdgut6gI
4jqwcm7HzIIdTQ/P0lr2OiTbtaIizd91D1ETlZqHxNbVTZCB9evghGGeoN+kXuRd
d3+wz064vpkF+R6gjcBdOXnegBkAVlCD6z5npgn7DA5ZsJSBhCGTKpXUNc+ORd9Y
Ed2Nb9TZvHeRjl9zHvqTSGGlVzh19ze2jHF4JGQGDq57iZuzVIeCUGb5gJTWfX2e
Vaa34/vfpHxa5xBNh0Mz9ddB15JI78+afjXo9CwNn7ykjKkI0f0dmRxVvj0zISSp
IXawyyjCuRa0O8+tgn967O8HNNTl8Zb+eEriIM5TsJSiPVh4Uv1/LrDlJ5c8toGo
YZGvMItOJmBWfSIVu8QVMT6socRi5bUzPVqeTv2PyyFIidUKiuUtCMmFPljGEIvj
3Czjwlw4Ct9tmAFNIEa0GF5V8ahyKT8zXaE/0piSrYnM5A9CjYEY/XdG9yZT/rUa
+IuCF+kse5f3JiRsq5h/38uMs2f0TQYSEi/BU53OSyU+OrtPvI4XQ73AMEeBK626
rU/v2IBMEjg1Bm5A1HljqZiZvsThi1iRq0pf8WQu9jPEN1iBxCguc/Z55QSJAD8D
BRg07btJs68K2T44DW8RAuNyAKD6fvG5C9Qi6SoMZcksavrwd3N8pQCeKIMIbEpi
j5wxSWOwb9PwIEmuto0=
=d1Vu
-----END PGP PUBLIC KEY BLOCK-----

Key Length
A few years ago, Blaze, Diffie, Rivest, Schneier, Shimomora, Thompson and Wiener suggested that a minimal length to guarantee safety (to prevent back-engineering time dependent documents such as wills and so on) for 20 years was 90 bits - with the processing capabilities of 1995, it was suggested that an organisation with $300,000,000 to spend on computing would take just 200µs (the amount of time it takes the electron beam on a TV to draw three horizontal lines on the screen) to decrypt 40 bit DES.

Brute Force Attack
Trying every key until you find one that fits is called a brute-force attack. To crack a 40 bit key, you need a school network and a few hours (this is the strongest no-strings-attached encryption that the US will allow to be exported in electronic form). To crack a 56 bit key, you need a few days on a specially designed computer - effectively 2 to the power of 16 (65,536) times more power. Each time you add one bit to the key length, you double either the computing power or the time to break a key with brute force.

Cryptography
Public key cryptography is different from conventional cryptography in that you do not (cannot) use the same key to decrypt a message that you used to encrypt it. This has the advantage that by having a pair of keys, you can keep one to yourself and let everybody else have a copy of the other one. In this way: you can sign a message with your private key and everyone will know that only you could have done so; and, you can encrypt a message to someone else using their public key and only they will be able to read it - if you also encrypt it with your private key, they will know that only you could have sent it (PGP does this).

Signing
Files may be signed by using a message digest (a hash function such as MD5 or SHA-1) with the result from the hash function being encrypted by the signer's private key. The public key is in everyone's possession so that everyone can see that it is signed by that person. If the message is changed in any way, the hash function will give a different result and fraud or accidental damage to the file will be detected. Hash functions are not simple compression algorithms and are designed so that it is not computationally feasible to work out another message that will give the same hash function result.

Encryption
Public key encryption is very processor hungry and it is used (with the long keys) to encrypt shorter once-only, session keys (that are used with Triple DES and so on) that change with each message encrypted so that even in the event of one of the session keys being decrypted, no other message can be decrypted and the longer keys cannot be calculated from the broken session key. The use of faster encryption methods allows longer messages and files to be encrypted swiftly without compromising the public key/private key pair.

To get a copy of PGP go to the PGP sites:

Back to the Index Copyright 1998 - 2003 P.A.Grosse.
All Rights Reserved
Computer Security Site Map
 
Site Map