IPv4 countdown

Individual thought about assignment 2

On the first time, I thought it was individual assignment and must be difficult, and I almost dropped this subject, but I took it easy and just let it flow. In fact, this second assignment is quite challenging and interesting. It is talk about online game. We have to develop a game that in concept is easy but when we are trying to develop the systems, it is so difficult. To do research about the systems itself, it took more than one month. The problem was how to integrate between mobile phone platforms and central server. Fortunately, the team was cooperative and smart.

Some of the instructions are confusing and weird in the subject outline, but it was not bothered us much. I want to thank for all of you guys and Peter, as a lecturer, has guided us along this assignment so we can finish this assignment on time. Good on ya.

PGP article (For Technical readers - Magazine)

Slegers (2002, the.comp.security.pgp FAQ, chap.1) defines that PGP is a program to protect user’s e-mail (electronic mail) privacy. The method is encrypting (jumble) user’s e-mail so that the e-mail could not be read by someone. After the message encrypted, the words look like a meaningless jumble of random characters. PGP has tested itself and it quite capable even if someone tries to use the most sophisticated programs aimed to read the encrypted text.

PGP can be used to put a digital signature in to a message without using encryption method. In general, the digital signature used in public postings where users does not want to hide anything or what they are saying, but especially to allow others to verify that the message really came from a sender. When a digital signature is created, it could not be modified either the signature without any modification detected by PGP or the message.

The PGP and the other PGP products are using RFC 2440 standard to encrypt and decrypt data. The other similar programs are Authora Inc., Veridis, EasyByte Cryptocx, GNU Privacy Guard and Patrick Townsend & Associates.

Barnard (1997, How it works: A Quick & dirty primer on Public Key cryptography, page.2) tries to determine how PGP works. With traditional cryptography, user encrypts their message with a key. To encrypt and decrypt, user needs this key. Both user and their recipient have the key and only those with the same key can decrypt the message. The problem is how is the user getting that key to their recipient? It was still this problem for a long time in good cryptography.

There are two keys involve in public key cryptography. One key is needed for encrypting (the recipient’s public key) and another key needed for decrypting (the recipient’s private key). Once user has encrypted their message with one of these keys, they can only decrypt the message with another key.

When users use PGP, they have to create a keypair. One of those keys is the public key and it should be publicize as widely as possible. The other one is the private key that should be kept by user. So, anyone who wants to send to a recipient private e-mail will encrypt the message with the public key. Once that message is encrypted, only user or the owner of the corresponding private key who can decrypt the message.

Indeed, public key cryptography is very expensive computation. It needs a massive computing power to encrypt and decrypt a message. As a result, PGP does encrypt the message with a modern algorithm (the IDEA algorithm) and uses the recipient’s public key to encrypt the IDEA key to decrypt the message. This job will take by PGP and user do not have to track of any IDEA keys or something like that but its good to know how PGP works.

PGP is very secure against eavesdroppers because the cryptographic algorithms used for signing and encryption in PGP is very well proved and there are no weaknesses found. The only unknown thing is that any encryption method based on RSA whether or not there is an easy way to factor large numbers or there is another way of algorithm that can break the codes without breaking the factoring problem. Even there is no such algorithm founded but RSA is still the weakest link in the PGP chain (Slegers 2002, chap.3).

In PGP, there is a digital signature. Digital signature is an electronic signature which can be used to authenticate the signer of a document or the sender of a message and to ensure that the original document or message that has been sent is unchanged. A digital signature can be used for all messages, whether it is encrypted or not (TechTarget 2006, p.1).

References

Barnard, CL 1997, Getting started with encryption: An introduction to PGP, last updated 28 May 1997, viewed 16 April 2007, <http://people.cs.uchicago.edu/~cbarnard/pgptalk/pkcintro.html>

Digital Signature 2006, last edited 10 July 2006, TechTarget Corporate, Needham, MA, viewed 15 April 2007, <http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci211953,00.html>

Pretty Good Privacy 2007, last edited 10 January 2007, Wikipedia Foundation Inc., St. Petersburg, viewed 15 April 2007, <http://en.wikipedia.org/wiki/Pretty_Good_Privacy>

Slegers, W 2002, The.comp.security.pgp FAQ, last updated n.a., Your Creative Solutions, the USA, viewed 15 April 2007, <http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-general-questions.html>

PGP article (For Non-technical readers - Newspaper)

Bacard (2005, Non technical – PGP FAQ, p.1) determines that Pretty Good Privacy (PGP) is a computer program to scramble (encrypt) and unscrambles (decrypt) data so that an e-mail (electronic mail) hard to tapped by someone. This program was created by Philip Zimmermann in 1991.

How PGP works?

PGP is a public key cryptography method. When user starts using PGP, the program will generate two keys which belong uniquely to user. The easy way to remember is that these keys are computer counterparts of the keys in user pocket. One PGP key is secret and stores in user computer and the other key is public. User will give this second key to their partners (Barcard 2005, p.2).

Here is a sample of public key:
-----BEGIN PGP PUBLIC KEY BLOCK-----Version: 5.0 mQCNAi44C30AAAEEAL1r6ByIvuSAvOKIk9ze9yCK+ZPPbRZrpXIRFBbe+U8dGPM9XdJS4L/cy1fXr9R9j4EfFsK/rgHV6i2rE83LjOrmsDPRPSaizz+EQTIZi4AN99jiBomfLLZyUzmHMoUoE4shrYgOnkc0u101ikhieAFje77j/F3596pT6nCx/9/AAURtCRBbmRyZSBCYWNhcmQgPGFiYWNhcmRAd2VsbC5zZi5jYS51cz6JAFUCBRAuOA6O7zYZz1mqos8BAXr9AgCxCu8CwGZRdpfSs65r6mb4MccXvvfxO4TmPi1DKQj2FYHYjwYONk8vzA7XnE5aJmk5J/dChdvfIU7NvVifV6AF=GQv9-----END PGP PUBLIC KEY BLOCK-----

Suppose that the public key above belongs to A and A e-mail it to his friend (called B). B can store A’s public key in B PGP program and use A public key to encrypt a message that only A can read it. One benefit of PGP is that A can spread his public key as same as telephone number. An example is if A has B’s phone number, A can call B phone, but A cannot answer B phone. This example has the same way with public key. If B has A’s public key, B can send A mail; on the other hand, B cannot read A letter.

What is a PGP digital signature?

Suppose that this report signed by A’s PGP “digital signature”. This authorization would allow persons who have A’s Public key and PGP to verify that A wrote this document and nobody can change this text since A signed it. PGP signatures will be helpful for transferring money, verifying a person’s detail and signing contracts (Youd 1996, p.1).

References

Bacard, A 2005, (Non-Technical) PGP FAQ, last updated n.a., Computer Privacy Handbook, France, viewed 13 April 2007, <http://www.andrebacard.com/pgp.html>

Digital Signature 2006, last edited 10 July 2006, TechTarget Corporate, Needham, MA, viewed 13 April 2007, <http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci211953,00.html>

Feisthammel, P 2002, Explanation to the wordings used with PGP, last updated 19 June 2002, Germany, viewed 13 April 2007, <http://www.rubin.ch/pgp/glossar.en.html>

Slegers, W 2002, The.comp.security.pgp FAQ, last updated n.a., your Creative Solutions, the USA, viewed 13 April 2007, <http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-general-questions.html>

Youd, D 1996, What is a Digital Signature?, last updated n.a., The Youd Zone, the USA, viewed 13 April 2007, <http://www.youdzone.com/signature.html>

Note 57

In this website, it guides you how to installing PGP and how to using PGP. Overall, it is nice because the texts along with many figures, so you will not confuse how to use it. Remember, it is only describe for Windows only, no explanation on Apple Macs.

Reference

A basic introduction to installing and using PGP 2007, last edited n.a., place of publishing n.a., viewed 30 April 2007, <http://www.shac.net/pgp/>

Note 56

This article determines changing PGP 2.x with GnuPG. It described in both technical and theory. In sum, it is cool and nice.

Reference

Hasselbacher, K 1999, Replacing PGP 2.x with GnuPG, last updated n.a., palce of publishing n.a., viewed 20 April 2007, <http://www.gnupg.org/gph/en/pgp2x.html>

Note 55

Here are the complete syntaxes. It started from encryption to configuration tables described in tables so readers will easy to look into it.

Reference

Helmberger, F 1997, A pretty good PGP reference card, last edited 16 April 1997, O'reilly and Associates Inc., USA, viewed 29 April 2007, <http://www.geocities.com/Athens/1802/pgpcard.html>

Note 54

This link is a good website. User can find many PGP products and references in this site.

Reference

PGP 2005, last edited n.a., Google Directory, viewed 29 April 2007, <http://www.google.com/Top/Computers/Security/Products_and_Tools/Cryptography/PGP/>

Note 53

There is a complete description to protect e-mail client with different platforms. Overall, it is good in explanations on each platform.

Reference

Bretschneider, M 2006, Secure e-mail client with PGP/ MIME, last updated 2 May 2006, Germany, viewed 28 April 2007, <http://www.bretschneidernet.de/tips/secmua.html>

Note 52

If you are a newbie and you do not now how to upload key servers, remove key servers and search for keys. This website may help you a lot.

Reference

Ross, DE 2007, PGP: Public Key Servers, last updated 14 January 2007, W3C, USA, viewed 28 April 2007, <http://www.rossde.com/PGP/pgp_keyserv.html>

Note 51

This is only a short note about PGP message exchange formats. There were many formats explained in this site. It is good information for many different PGP formats.

Reference

Stallings, W, Atkins D & Zimmermann, P 1996, PGP message exchange formats, last updated August 1996, Network Working Group, USA, viewed 27 April 2007, <http://www.ietf.org/rfc/rfc1991.txt>

Note 50

This is a short article in OpenPGP. Even PGP is strong enough, but there were still vulnerabilities in PGP that cannot hide. This article is not bad and it discussed the commercial and business ways.

Reference

Branscombe, M 2006, Whatever happened to PGP?, last updated 21 May 2006, The Register, London, viewed 27 April 2007, <http://www.theregister.co.uk/2006/05/21/pgp_update/>

Note 49

Still confuse with PGP? Try this alternative site. The introduction and tutorials described on this website. In sum, it is great.

Reference

Henry, K 2007, Getting started with PGP, last updated n.a, Crossroads, USA, viewed 27 April 2007, <http://www.acm.org/crossroads/xrds6-5/pgptutorial.html>

Note 48

A bug in PGP was found by Senderek. It is nice, because it revealed the vulnerabilities and the solutions to solve these problems.

Reference

Kelm, S 2000, Serious bug in PGP v.5 and v.6, last updated 11 October 2000, PKI symposium, Netherlands, viewed 27 April 2007, <http://cryptome.org/pgp-badbug.htm>

Note 47

This is a forum for PGP and GnuPG. It is updated forum. You can join and ask everything of those.

Reference

PGP Basics – Promotes the use of PGP and GnuPG 2007, last edited n.a., viewed 26 April 2007, <http://tech.groups.yahoo.com/group/PGP-Basics/>

Note 46

Actually, I do not have enough knowledge on XML and this website tries to combine the XML Key Management Specification (XKMS) with PGP. The details are good and in depth analysis.

Reference

Linberg, T & kahan, J 2005, Using XKMS with PGP, last edited 19 December 2005, W3C, Cambridge, MA, viewed 26 April 2007, <http://www.w3.org/TR/xkms-pgp/>

Note 45

Pgpdump, this is a new term for me. What is it and how it works? Check this cool website.

Reference

Yamamoto, K 2007, pgpdump, last edited n.a., IIJ Research Laboratory, Japan, viewed 26 April 2007, <http://pgp.iijlab.net/pgpdump.html>

Note 44

It introduces PGP’s feature, Additional Decryption Keys (ADKs). It discussed in details and totally, it is good and complete.

Reference

CERT Advisory CA-2000-18 PGP may encrypt data with unauthorized ADKs 2000, last edited 28 September 2000, Software Engineering Institute, Pittsburg, PA, viewed 26 April 2007, <http://www.cert.org/advisories/CA-2000-18.html>

Note 43

Here are good tips for PGP cryptography. Indeed, there are seven tips, but on the title there are five tips of PGP.

Reference

PGP 5 Tips 2006, last edited n.a., place of publishing n.a., viewed 25 April 2007, <http://www.shub-internet.org/pgp_5_tips.html>

Note 42

If you are confusing to find keyserver, there is keyserver FAQ on this website especially Apache.

Reference

JoGuNET PGP Public Key Server 2006, last edited n.a., Gutenberg Universitat, Germany, viewed 25 April 2007, <http://pgp.uni-mainz.de/>