Browse Books

Reviewer: Jonathan K. Millen

This volume is a political treatise, a cry for help, a short course in computer and network security, and a manual for a software package that is available for free on the Internet. PGP stands for “Pretty Good Privacy,” and it provides privacy and authentication for files and electronic mail. The author has been in trouble both with the US Government for making good cryptographic software easily available on the Internet, and with Public Key Partners, the holders of the RSA patent, because the first version of PGP included Zimmermann's independently coded implementation of the RSA public-key system. The federal case has recently been dropped, and the latter problem was resolved by employing the properly licensed RSAREF implementation in newer versions of PGP. Within the US, copies of the program for private noncommercial use can be ftp'd from net-dist.mit.edu, and a commercial version can be bought from ViaCrypt. The text of this user's guide is also downloadable. The tone of the book is set by John Barlow's foreword. With revolutionary fervor, the significance and potential worldwide impact of electronic privacy are made clear, for better or for worse, but with an evident conviction that it is for the better. Chapter 1 brings up the Clipper debate and the FBI Digital Telephony Wiretap bill. Chapter 12 covers the legal issues, including licensing restrictions and export controls. The presentation there is the ambivalent result of a tug of war between the need to present the letter of the law and the fact of unrestricted foreign availability of PGP from several sources. As a manual, the book is reasonably well organized. It begins with an introduction to public-key principles and quickly presents the command-line interface for basic functions, as used in MS-DOS and UNIX versions. The Macintosh version, mentioned briefly but not described, has menu choices that correspond in a self-evident way to command lines. No Windows version is mentioned. A legion of options and auxiliary files are catalogued in later sections. Zimmermann emphasizes the assurance aspects of privacy—why should a user trust the algorithms, the program code, the computer on which it runs, and the authenticity of other users' public keys__?__ There is a chapter on potential vulnerabilities. The key management chapter discusses the program's heuristics relating to propagation of trust in key signatures, the principle behind what has come to be known as the “web of trust.” Copies of the program are digitally signed with the author's key, and the “fingerprint” (hashed digest) of his public key is printed in the book. The essential information about the workings of the program is covered at a narrative level, enough to encourage confidence in it, but with only a user's guide level of detail. The algorithms used are named, and their pedigrees given: RSA for signatures and key management, MD5 for forming digests, and IDEA for conventional encryption and random number generation. The program was intended for use on a single-user machine, but there are some protections that seem to be addressed to serial multiuser environments, such as pass phrases to protect secret keys. It is<__?__Pub Caret> not stated whether users' pass phrases, or the secret keys themselves, are encrypted for storage by the program. The book is educational and eye-opening. If one skips over the command-line reference material, it furnishes a quick, sophisticated introduction to the thorny issues of public communication security.