One of the fun parts of being an I.T. trainer is that every time you get cocky and you think you know
everything there is about a particular topic something comes along and teaches you that that's not necessarily
the truth.
This episode is DGP or Pretty Good Privacy and it is an encryption cryptosystem that's been around for
over 25 years and it's actually kind of interesting.
This is something I used to use a long time ago had kind of forgotten about.
And then once I saw that come out here added this back in as an objective I had quite a lesson.
So let's talk about what is first of all PDP was invented by a guy named Phil Zimmerman way back in
1991.
That type of internet back there in the late 80s early 90s didn't have encryption.
I know today we have secure protocols for this that and the other we can use things like bit locker
to lock down a hard drive.
We got all this encryption and all of these crypto systems all over the place.
But back then there really wasn't any.
If you wanted to encrypt a e-mail there were really good options as mine back then was starting to form.
But for the normal rank and file person there wasn't a nice little program you could pull down install
and start doing encryption until TGP came along.
So PGE was originally invented for email encryption.
Mr. Zimmerman wanted to encrypt stuff sent an e-mail so other people couldn't read it.
Now PGE has evolved tremendously over the years.
So it does all kinds of stuff today it is that you can use it to sign files.
You can use it to encrypt e-mail.
You can encrypt individual files you can encrypt partitions.
You can even do full disk encryption with GPS.
So before we start going into where we're using it let's make sure we understand how the encryption
works.
PGE counts on the idea of a random key that's generated by the encryptor the encryptor creates a random
key and then they encrypt their data using that random key and then they encrypt the key using the receiver's
public key.
So you will definitely have a key exchange going on here.
So you've got your encrypted data and your encrypted key and then you send an encrypted message.
Decryption works pretty much the exact same way in reverse.
So we start with our encrypted message and we separate the encrypted key from the data it's very easy
to make that separation.
And then we take the encrypted key and we decrypt it with the private key.
So this works very much like a classic asymmetric key.
We now have the temporary key the random key and we can use that to decrypt the data.
And the end result is we have our plain text.
So if you noticed from that diagram We've got two keys we've got a public private key and then we also
have this random key.
So for those of you who are familiar with T.L. acet if you watch my episodes on T.L. s asymmetric had
scription you'll know that in a lot of situations we use asymmetric encryption only to transfer a session
key and then we switch to symmetric.
So PGE works very similar to this.
This is fascinating because you got to keep in mind Phil Zimmerman invented all of this by himself.
PGE is an open standard but unlike so many other cryptographic systems we use he just came up with this
on his own and it is did the test of time.
Now granted there's been a lot of improvements over the years.
For example originally it would be using something called El-Gamal which is really just Diffie Helman
and also he had to invent his own certificates.
He doesn't use X-Com 5 0 9 certificates like the rest of the Internet does.
There is a special type of certificate called DGP so also one other thing it's actually kind of interesting
is Mr. Zimmerman came up with something very different called web of trust.
So let me show you how this works.
Now if you've watched other episodes you're familiar with the idea of public key infrastructure where
we have a certificate authority intermediate authorities and then individual folks so any time a certificate
has to be checked it's signed by the certificate authority and the intermediates do the day to day checking
of the certificate.
So TKI is the way the entire internet works so let me show you another way instead of the nice pyramid.
Imagine you have one certificate that trust another certificate and then that certificate trust another
certificate and you end up with this mesh.
This web of trust web of trust was I'm not going to say Phil Zimmerman invented the concept but he was
the first person to really push this concept forward a complete alternative TKI.
There's some big benefits of web of trust with with this you don't have any Veras signs or any big companies
charging you money.
It's just a matter of having a buddy who knows a friend who knows a pal.
And back in the TGP days I actually did this you would have people who would call themselves accountants
and they would be.
They were like CPA as they were they were people who were trusted by a lot of people and you could go
to them you call them on the telephone remember those things and you'd call them on the phone then you
would submit a request to these guys and they would sign your certificate.
It's a wacky way to do things.
The only downside to this is that over time people got lazy and a lot of times people would accept certificates
without going through the due diligence of a phone call making sure the person is legit and all of that.
And we started to run into some problems with it.
So the reality is is that DGP recognize that web of trust really wasn't working that well and pretty
much all PGE solutions today use good old piquet.
And it works just fine.
So even the web of trust was a failure.
Didn't need to have web of trust.
They put a lot of time and energy into making that happen.
But BGP works just fine in a TKI solution as well.
There have been tremendous amounts of change with PDP over the years.
Today there are really three big players in the world.
GP first of all the original GP group or what's left of them is currently a part of Symantec Corporation.
This organization only does one thing but boy does it do it well.
It encrypts mass storage so they will do seining and they will also do disk encryption.
What's cool about these tools is they work great with existing alternatives for example bit Locher in
windows or file vault for the Mac folks.
And it's really designed more for a cloud and an enterprise solution.
So instead of having a bunch of systems with bit locker and fire file vault whatever you can just PDP
them all regardless as the operating system and it works great.
This is a proprietary solution and you got to pay some money for it.
For those of you who like free there is the open TGP standard open TGP is not only a standard but it's
a group of people who support this and they support it really well.
The big job of open TGP is encrypted email.
It has complete support for Piquet's.
And it also works well with alternative ways to encrypt email for example good old famous as mine it's
actually a fascinating process.
You can get open TGP and it manifests as a plug in that you put into your existing email if you have
Outlook or thunder bolts or anything like that you can just add extensions to that and you get full
support for digital signing encryption the whole shebang exchanging a public keys.
It works great.
It's kind of a hassle to go through all this though.
If you actually want to generate your own certificates and you know have a third party sign them in
there are places that can do that Comodo in particular is a great source for that.
It's a little bit of a pain.
The nice part is though if you want to encrypt e-mail there are wonderful solutions out there that take
all of this off your hands personally.
My favorite is proton mail proton mail which I personally use on a daily basis is just a web interface
so if you like using Gmail or Yahoo you'd be familiar with the interface but the differences is that
from the proton mail server to whoever else.
And they also have to be on Proton mail.
It's fully encrypted.
So whereas your G-mail could conceivably be intercepted where your Yahoo might be able to be read by
third parties with Proton mail there's no way to do that and it completely uses open TGP.
Nice part is we don't even see it it works that transparently.
The last place that we see open TGP.
Ansari Well it is open BGB but DGP is new privacy guard or better known as GBG.
This is a complete free tool set and it is based on open BGP.
But whereas open TGP only does email GBG does file and disk encryption and if you're going to be encrypting
in the Linux world you're probably going to be using those
on.