Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP signatures, and of PGP encryption?
See also:
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
||||
|
|
|
PGP signatures are used to sign software packages in some Linux distributions, including Debian and Ubuntu. This is quite widespread, although most Linux users are never aware of it. PGP encryption, for what is was meant initially (i.e. emails), is commonly used in commercial situations, where some parties wish to exchange work documents. PGP keys are thus exchanged directly, not using the certificates (keys signed by other people) and the "web of trust". I often do it with customers. PGP benefits from very good integration and simple usage in many mailer softwares. PGP signatures are also used there, as an integrity check (but not in their "non-repudiation" role). To sum up, the one feature of PGP which is almost never used is the web of trust. |
|||||||||||
|
|
Retroshare is an acentered P2P/Friend2Friend network software using GPG primarily as a authentication mecanism, and use its own kind of web of trust way to add people to "your ring" which is primarily a contact list. They use the PGP signature if you want to sign some content on the Retroshare forum or you can just post anonymously. I don't know if they use it for actually transferring data, because I think they use more their Turtle transfer protocol which is some kind of anonymous VPN so you don't really know where the data comes from. Personnaly, I don't use it that much because I'm really used to webmails. But that's something I'm looking forward to using more. My other usage of PGP is for signing package for ubuntu, and that's it. I don't have a lot of contacts using it |
|||
|
|
|
For almost all communications between me and many of my global banking clients, PGP is the trust layer which allows us to pass very sensitive data to each other. Most of these clients run a PGP gateway which ensures all comms to me from them is encrypted (thus avoiding accidental cleartext emails) and allows for an escrow in order that the organisation can check for viruses, information leakage etc. The ones without PGP Universal all use pgp or gpg desktop clients - either way, we validate pgp keys out of band and gain a strong assurance that our emails are secured between us, time stamped and signed. Absolutely invaluable for comms about security vulnerabilities. |
|||
|
|
