---
title: "Short note: PGP"
subject: "Internet and Intranet"
chapter: 3
key: "semester_8/internet_and_intranet:note-pgp"
source: https://www.bctengineer.com/q/semester_8/internet_and_intranet/note-pgp
site: BCT Engineering
---

# Short note: PGP

Internet and Intranet · Chapter 3: Protocols and Client/Server Applications

- Asked in: 2074 Magh, 4 marks
- Video: [How PGP Works](https://www.youtube.com/watch?v=g4lHBrMJTr0) — Human Augmented
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/internet_and_intranet/note-pgp
- Whole chapter: https://www.bctengineer.com/md/semester_8/internet_and_intranet/chapter-3

## Question

Write a short note on PGP.

## Short answer

PGP combines hashing, public-key signing, and symmetric encryption to provide confidentiality, authentication, integrity, and compression. It uses a web of trust for key management and Radix-64 encoding to ensure email compatibility.

## Answer

**Pretty Good Privacy (PGP)** is an e-mail and file security program designed by Phil Zimmermann in 1991. It provides **confidentiality, authentication, integrity and compression** using a mix of public-key and symmetric cryptography. Its standard form is OpenPGP (RFC 4880); GnuPG is a free implementation.

**Services and how they work**

- **Authentication / integrity:** the sender hashes the message (SHA) and encrypts the digest with his private key (RSA/DSS). The receiver decrypts with the sender's public key and compares digests.
- **Confidentiality:** the message is encrypted with a random one-time session key using a symmetric cipher (AES, 3DES, CAST-128); the session key is encrypted with the receiver's public key (RSA).
- **Compression:** ZIP is applied after signing and before encryption.
- **E-mail compatibility:** binary output is converted to ASCII with Radix-64.
- **Segmentation:** long messages are split to match mail size limits.

**Key management:** each user has a public key ring and a private key ring. Trust is built by a **web of trust**: users sign others' public keys, instead of relying on a central certificate authority.

```text
M -> Hash -> Sign(KR_A) -> ZIP -> Enc(KS) -> Radix64 -> SMTP
                 KS -> Enc(KU_B) ----^
```

**Use:** secure e-mail, file encryption, software signing.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Which set lists the services PGP provides?
   A. Routing, switching, addressing, QoS
   B. Confidentiality, authentication, integrity and compression
   C. Name resolution, load balancing, caching, mail access
   D. Only compression and encryption
   Answer: B. PGP offers confidentiality, authentication, integrity and compression using public-key and symmetric cryptography. (Key point: Services of PGP)

2. Where is ZIP compression applied in PGP?
   A. Before signing
   B. After encryption
   C. After signing and before encryption
   D. Only on the session key
   Answer: C. Compression comes after signing and before encryption, since encrypted data does not compress well. (Key point: Compression placement)

3. Which pair is correct for PGP?
   A. Trust comes from a central CA; Radix-64 compresses data
   B. Trust comes from users signing each other's public keys; Radix-64 converts binary output to ASCII for e-mail
   C. Trust comes from DNS; Radix-64 encrypts the session key
   D. Trust comes from SMTP; Radix-64 hashes the message
   Answer: B. PGP uses a web of trust, and Radix-64 turns binary output into ASCII so it passes through mail systems. (Key point: Web of trust and Radix-64)