PGP authentication and confidentiality

What is PGP?

PGP (Pretty Good Privacy) is a public-key based security program, written by Phil Zimmermann, that provides confidentiality, authentication, integrity and compression for e-mail and files. It combines symmetric encryption (fast), public-key encryption (key exchange and signatures) and hashing. Its open standard form is OpenPGP (RFC 4880).

Algorithms commonly used:

• Hash: SHA-1 / SHA-256 (older: MD5)
• Signature: RSA or DSS
• Symmetric cipher: CAST-128, 3DES, IDEA or AES
• Key exchange: RSA or Diffie-Hellman/ElGamal

Notation: KS = one-time session key, KRa / KUa = private / public key of A, H = hash, EP / DP = public-key encrypt / decrypt, EC / DC = symmetric encrypt / decrypt, Z = ZIP compression, || = concatenation.

PGP authentication (digital signature)

Goal: the receiver is sure who sent the message and that it was not altered.

Sender A

1. Compute the hash (message digest) of message M: H(M).
2. Encrypt the digest with A's private key KRa. This is the signature.
3. Attach the signature to M, compress the whole with ZIP and send.

Receiver B

1. Decompress.
2. Decrypt the signature using A's public key KUa to get the digest.
3. Compute H(M) of the received message and compare. If equal, the message is authentic (only A has KRa) and unaltered.

SENDER A
 M --+--> [Hash H] --> [Encrypt KRa] --+
     |                                 v
     +-------------------------> [ M || Sig ]
                                       |
                                  [ZIP  Z]
                                       |
                                       v  to B
RECEIVER B
 [Unzip] --> M, Sig
   Sig --> [Decrypt KUa] --> digest1
   M   --> [Hash H]      --> digest2
   digest1 == digest2 ?  yes: authentic

PGP confidentiality (encryption)

Goal: only the intended receiver can read the message.

Sender A

1. Compress M (Z) to reduce size and remove patterns.
2. Generate a random one-time session key KS (128-bit).
3. Encrypt the compressed message with KS using a symmetric cipher.
4. Encrypt KS with B's public key KUb.
5. Send the encrypted message plus encrypted KS.

Receiver B

1. Decrypt KS using B's private key KRb.
2. Decrypt the message with KS.
3. Decompress to get M.

SENDER A
 M --> [ZIP] --> [Sym Encrypt, KS] --+
                        ^            |
 random KS -------------+            v
    |                           [ EKS(M) || EKUb(KS) ]
    +--> [Encrypt KUb] -------------^      |
                                           v  to B
RECEIVER B
 EKUb(KS) --> [Decrypt KRb] --> KS
 EKS(M)   --> [Sym Decrypt KS] --> [Unzip] --> M

The session key is used because public-key encryption of long data is very slow, and a fresh key per message limits damage if one key leaks.

Both together

Normally the sender first signs (hash + KRa), then compresses, then encrypts with KS, and finally encrypts KS with KUb. The receiver reverses the order. Finally the result is converted to ASCII using Radix-64 so it can pass through SMTP.