3. • Developed almost entirely by Phil
Zimmerman
• Free, worldwide, works across a variety of
platforms.
• Based on known algorithms such as RSA
4. 1. sender creates message
2. Generates a digital signature for the message
3. use SHA-1 to generate 160-bit hash of
message
4. signed hash with RSA using sender's private
key, and is attached to message
5. receiver uses RSA with sender's public key to
decrypt and recover hash code
6. receiver verifies received message using hash
of it and compares with decrypted hash code
5. 1. sender generates a message and encrypts it.
2. Generates a128-bit random number as session
key
3. Encrypts the message using CAST-128 /
IDEA / 3DES in CBC mode with session key
4. session key encrypted using RSA with
recipient's public key and attached to the msg
5. receiver uses RSA with private key to decrypt
and recover session key
6. session key is used to decrypt message
6. • can use both services on the same message
• create signature & attach it to the message
• encrypt both message & signature
• attach RSA/ElGamal encrypted session key
This sequence is preferred because
--one can store the plaintext message/file and its
signature
--no need to decrypt the message/file again and
again
7. • PGP compresses messages to save space for e-
mail transmission and storage
• by default PGP compresses message after
signing but before encrypting
• so can store uncompressed message & signature for later
verification
• Encryption after compression strengthens security (because
compression has less redundancy)
• uses ZIP compression algorithm
8. • when using PGP will have binary data (8-bit
octets) to send (encrypted message, etc)
• however email was designed only for text
• hence PGP must encode raw binary data into
printable ASCII characters
• uses radix-64 algorithm
• maps 3 bytes to 4 printable chars
• also appends a CRC
9. •Some mail providers impose a
maximum length of 50,000 octets
• PGP will automatically subdivide
any message too large into small
enough segments to send via e-mail
•This is done after all other
processing
10. •PGP uses four types of keys
•Session keys
•Public keys
•Private Keys
•Passphrase keys
11. • Random 128-bit numbers are generated
using CAST-128
• Input to the number generator takes in is a
128-bit key and two 64-bit blocks of
plaintext.
• Input is effected by previous key outputs
12. PGP Public & Private Keys
• since many public/private keys may be in
use, need to identify which is actually used
to encrypt session key in a message
• could send full public-key with every message
• but this is inefficient
• rather use a key identifier based on key
• is least significant 64-bits of the key
• will very likely be unique
• also use key ID in signatures
13. • With multiple private/public key pairs, there
needs to be a way for the receiver to know
which to use
• How this is done is through the combination of a 64
bit key ID, which is unique to a user ID.
• With this key ID, the receiver can retrieve the
correct public key of the sender to decrypt the
message.
• A list of these key ID’s are placed in what is
called a key ring.
14. • There are both public and private key rings
• A user needs a passphrase key in order to retrieve a private
key, or to encrypt with a private key
• public-key ring contains all the public-keys of other PGP users known to
this user, indexed by key ID
• private-key ring contains the public/private key pair(s) for this user,
indexed by key ID & encrypted keyed from a hashed passphrase
15. Key Rings- continue
• security of private keys thus depends on the pass-phrase
security
• When creating a private key
• The user selects the passphrase to be used
• The system generates a new public/private key pair
using RSA, and using SHA-1 a 160-bit hash code is
generated from the passphrase
• The system encrypts the private key using CAST-
128 with the 128 bits of the hash code of the key
and then the hash code is discarded
16. •PGP retrieves sender’s private key
using user-id as an index.
•PGP prompts the user for the
passphrase to recover unencrypted
private key
•Constructs signature component of the
message
17. • PGP generates session key and uses it to encrypt the message
• PGP retrieves the recipient’s public key from it’s public-key
ring using their user ID as an index
• The session key of the message is constructed
18. • PGP retrieves the receiver’s private key from
the private-key ring using the key ID in the
session key component of the message as an
index
• PGP prompts the user for the passphrase to
recover the unencrypted private key
• PGP recovers the session key and decrypts the
message.
19. • PGP retrieves the sender’s public key from the public-key ring
using the key ID from the signature portion of the message as
an index.
• PGP recovers the transmitted message digest
• PGP computers the message digest for the received message
