Moving toward encryption interoperability

For a long time, advanced secure e-mail users on the Internet have enjoyed Pretty Good Privacy (PGP), a program that enables encryption and digital signatures in files that can be sent as e-mail attachments. Today, after changing hands several times through acquisitions, PGP is offered through the Total Network Security division of Network Associates, Inc., which also provides PGP in a product suite comprising such components as PGP Desktop, PGP Disk and PGP Server.

PGP Desktop contains Version 5.5 of PGP for Email and Files. This provides plug-ins for major e-mail offerings such as Exchange, Outlook, Outlook Express, Eudora and Claris packages. Integration is performed through the tool bar or the clipboard. PGP is also integrated with Microsoft Explorer for Windows or Macintoshes, allowing the user to encrypt a file. Another component, PGP Disk, enables users to virtually encrypt a hard drive.

PGP Server is a PGP certificate server supporting the LDAP and HTTP protocols. The server is integrated with the PGP client and is automatically accessed when a PGP key not in the client's local key ring database appears.

PGP encryption and digital signature public-key block formats are unique to PGP and are different from the industry-standard X.509 V3 certificate format used in S/MIME products, such as WorldTalk's WorldSecure client and Microsoft and Netscape browsers. Therefore, PGP does not interoperate with S/MIME.

As longtime advocates for S/MIME and PGP interoperability, we can draw some encouragement from a joint "interoperable certificate" announcement issued by Network Associates and Verisign, a public X.509 certificate issuer. Network Associates is initially committing to use Verisign's X.509 certificates in its IPSec VPN product (called Gauntlet GVPN), which will interoperate with certificates issued by the Verisign OnSite package. We hope this sets a direction for the PGP products to use X.509 certificates in the future (The press release promised PGP support for X.509 digital signature - but not encryption - certificates in the fourth quarter). Although this doesn't mean interoperability, it is one small step forward.

Rapport Communication has recently merged with The Burton Group. The Burton Group is a leading information technology advisory and consulting firm. It provides in-depth analysis of emerging network computing technologies such as directory services, next generation messaging, secure messaging, NOS migration, public key infrastructure, and networking infrastructure. As part of its Network Strategy Service for network planners, The Burton Group offers the Catalyst Conference once a year in late July.

Security flaw spotted in SSL: Prompts software fix for Web servers. Network World, 6/29/98.

RSA blasts (but also supports) government encryption policy: Security gurus debate key recovery at RSA conference. Network World, 1/26/98.

Network World Fusion's Cryptography resources page

Total Network Security overview from Network Associates, Inc.

Common Data Security Architecture overview: from Intel. Subscribe to this and other free Network World Fusion Focus newsletters