Sunday, 7 April 2013

PGP is already 22 years old, and now it might be revitalized




It was 1991 when Phil Zimmerman, Jon Callas and the rest of their security team brought about encryption technology to the masses, and for free. Now the same people, with some backing from a few former Navy SEALs will make the technology even more secure in the coming weeks.
Know as PGP (pretty good privacy), the technology has proven itself as reliable and with a level of security that is satisfactory for most applications.
Users download the software and all traffic is handled by the company's web hosting company. Encryption keys are set up on each device using the application and are then discarded once the message has been completed, so that they cannot be compromised.
The encryption system is based on decades of encryption experience and the desire for private communications. Based on the team's background, there's good reason to believe it will be successful.
PGP was investigated by the U.S. government for "munitions export without a license" after use of the code spread, although no charges were ever brought against Zimmerman, Callas and the rest of the team.

Back in the late 70s and early 80s, security wasn't really an issue when email was designed, and PGP addressed a key need for internet users when it came out as PGP.
Thankfully, governments around the world recognized that the benefits of encryption have far outweighed the threat, and now similar systems are built into almost every online transaction, but it's still not enough some observers say.
"Email is fundamentally broken," said Jon Callas, pointing out that security was not a serious factor in the original protocols. Wrapping messages in the best possible encryption will give a measure of security, and the team have spent nearly two years improving their technology.
"We believe we've got it as good as we can get it," he said. "Nothing is perfect, and anything we find there's a problem with, we'll fix it."
To further test the system, Callas and his team put its source code up on Github for analysis by the security community. So far, Callas said, three possible issues have been found. None of them were serious, and all have since been fixed.
Two of PGP's original backers, including CEO Mike Janke, are former U.S. Navy SEALs who saw a need for this kind of secure communication. Janke was operating a security detail in Baghdad and became increasingly frustrated with the inability to run a simple, secure communications setup.
It was an issue he'd seen around the world, where the presumption of monitoring by outsiders is the norm. You might think that technology like this would have the U.S. government worried, but according to Callas the response so far has been very positive.
"We've checked with a bunch of people on it and talked to people inside the government. We hired on contract a private attorney who used to be a terrorism prosecutor. She advises us and has been our envoy to Congress and other places. We know they need to hear about us first," Callas said.
Such issues are much on the mind of legislators of late. Intelligence agencies are pushing for an extension of the Communications Assistance for Law Enforcement Act (CALEA) to require an automatic backdoor into communications software of this type. A legislative push in the area is expected later this year.
There's increasing concern about doing business abroad, now that some states seem to have built industrial espionage into their economic policy.

No comments:

Post a Comment

PLS WRITE YOUR IDEAS ABOUT THIS BLOG IN SHORT