• PC World
• »Software
• »Antivirus and Security

Bad things do happen to good code. So learned Phil Zimmermann, author of Pretty Good Privacy, which in the early 1990s became the de facto standard for cryptology development on the Internet, according to analysts and user groups.

While working with human rights advocates in 1991, Zimmermann released his powerful encryption, signing, and authentication freeware, which did away with the need for third-party key authorities to issue and manage the keys that lock and unlock data.

In fact, the mathematical encryption algorithm was so good that Zimmermann nearly went to jail after one of his associates posted the algorithm's source code on the Web and it caught the attention of the U.S. Customs Service.

The federal government wasn't happy that such a powerful secrecy tool had become available to anyone who wanted it and had the technical skills to use the complex program. It took a three-year legal battle before Zimmermann was cleared of violating the International Traffic in Arms Regulations for exporting munitions.

Selling Out

Two years ago, after an unsuccessful attempt to make money on PGP on his own, Zimmermann sold PGP to Network Associates in Santa Clara, California.

Network Associates tried to integrate and market PGP as part of an all-in-one firewall, virtual private network, and peer-to-peer encryption appliance but was unable to sell the product, says Ryan McGee, group product manager at McAfee Security, a division of Network Associates.

Nor could the company find another vendor to buy PGP. So in February, it pulled support for the product.

"As Network Associates drops PGP, it drops the ease of use and high level of integration PGP achieved in the desktop computing environment," says Julian Koh, a network engineer at Northwestern University in Evanston, Illinois, who uses PGP for file and mail encryption inside Northwestern's network.

"They've also dropped support for that product. So if someone's using the latest version of PGP on XP and they install a Microsoft service pack for XP, it could break their PGP. And there's not going to be any update from Network Associates to patch PGP."

Because of PGP's history as free software, the number of companies that have installed it is unknown. But large organizations such as Lockheed Martin use PGP on a limited basis for critical communications and file encryption, according to a spokesperson at the Bethesda, Maryland-based company.

And PGP is also being used in a lot of Web site scripting, says Adam Back, a security consultant in Montreal who has used PGP for eight years.

Replacement Products

German businesses are big users of PGP, according to Werner Koch, lead developer of GNU Privacy Guard in Dusseldorf, Germany. Many of those PGP installations in Germany are being replaced with GNUPG, for which Koch's small business will make its money from support fees. The code and concept of GNUPG are closely related to those of PGP.

"In the past year, a lot of companies have installed PGP for their e-mail encryption because of demands from their suppliers to encrypt business-to-business communications," Koch says. "Now those companies have real problems, because there are no more patches and updates for the product. So some of these companies are removing their PGP software and asking if we can support GNUPG for them."

GNUPG is the first new form of PGP to step into the void left by Network Associates. GNUPG is working on a less complex interface for the application, and installing the program is no more difficult than downloading any software, says Gary Kessler, a cryptography instructor at the SANS Institute in Bethesda, Maryland, and assistant professor of computer networking at Champlain College in Burlington, Vermont, which houses a PGP key server.

An Attractive Alternative

PGP proponents believe that more variants will emerge from the open PGP standard. PGP remains attractive because prominent alternatives such as Secure Multipurpose Mail Extensions require third-party authorities to issue encryption keys, they say.

More PGP development "would make a profit motive for a company to step in and offer commercial support contracts for PGP," Kessler says. "For example, Eudora, which already has plug-ins for PGP, and HushMail, which supports PGP in its latest version, could start to offer support."

Kessler uses PGP by pushing a button on his Eudora e-mail program. But he can't send PGP-encrypted e-mail to many of his associates, because they don't have plug-ins for their e-mail programs. More PGP plug-ins to popular e-mail applications and services would introduce millions of users to PGP, which would also promote commercial support, Kessler says.

Will new open-source developments move fast enough to encourage commercial support for end users of PGP? "I'm sworn to secrecy, but I personally know people working on this problem, and I'm sure the void will be filled in six months," says Jon Callas, senior systems architect at a technology company in the San Francisco Bay area and a former PGP developer.

What Is PGP?

PGP is based on the public-key encryption method, which uses two keys: One is a public key that the user disseminates to anyone from whom he wants to receive a message; the other is a private key used to decrypt received messages. It's almost impossible to deduce the private key, even if you know the public key. But a difficulty with public-key systems is that you need to know the recipient's public key to encrypt a message.

Public-key cryptography is also called asymmetric encryption because it uses two keys instead of one (symmetric encryption).

Encrypting a message using PGP requires the PGP encryption package, which is available for free. The official repository is at the Massachusetts Institute of Technology.

• See more like this:
• PGP,
• pretty good privacy,
• encryption,
• e-mail,
• Phil Zimmerman,
• Network Associates