[ISN] Whatever happened to PGP?

[InfoSec News]

http://www.theregister.co.uk/2006/05/21/pgp_update/

By Mary Branscombe
21st May 2006 

PGP is often thought of as an encryption system, but your private key 
is a digital signature that can prove who your message comes from, as 
well as showing that it hasn't been tampered with.

The reason a Public Key Infrastructure doesn't look like a widespread
identity system is that it needs a web of trust; if somebody you know
has signed my PGP key, then you take their word that I am who I say I
am. That works well for close groups of friends - or for the
corporations and government departments around the world who rely on
PKIs based on the commercial PGP offerings or the OpenPGP SDK [1]
that's now available.

That's where PGP has really made its mark, says Jon Callas (now the 
CTO of PGP Corporation [2]; and part of the team that shepherded the 
commercial side of PGP out of the wilderness where Network Associates 
left it). "We thought it would be a grass roots system.

But now it's really corporations setting up PKIs for their own 
business reasons. The entities are organisations like BMW or Siemens 
rather than individuals." Some of the companies who failed to sell 
PKIs in the past had bad business models that were too expensive: "it 
was like buying a camera and having to buy 1,000 rolls of film at the 
same time"

The OpenPGP [3] standard is one of the things that's helped PGP become 
more widespread; the other is the rise of systems that need to 
identify people on many different platforms. But PGP doesn't solve all 
of the problems for that. The Friend of a Friend project (FOAF) uses 
digital signatures to attach PGP key IDs that verify the email of the 
address of the author to documents; you still have to decide for 
yourself if you trust the author which the PGP key identifies. There's 
a PKI at the heart of Skype, for example, to make sure you're talking 
to the person you want to call. But that tells you nothing about 
anything else to do with their identity.

PGP software is mature and the technology is both tested and flexible; 
you can use an LDAP server as a PGP keyserver or use the PGPticket 
protocol to issue secure authorisations instead of vulnerable 
passwords for access to a network service.

What many people want to do with identity now means making those 
identities work more widely. That comes down to the architecture of 
the systems that will accept identities, and the ways those identities 
are secured will include PGP (read more about PGP Identity Management 
here) [4].

Identity management is changing into claims management and different 
claims will come from different systems, bringing together claims like 
your Skype ID, your age and your eBay ranking only when someone needs 
to know you're old enough to buy what they're selling before they call 
you. Some of those claims will be secured and verified by PGP.

Instead of building up as much information about your users as 
possible - something marketing departments are happier about than the 
users themselves - you can think about the smallest pieces of 
information you need for a specific authorisation or transaction.

Whether it's issues of liability or commercial advantage, businesses 
don't want to share more of their customer database than they have to, 
Callas points out. Ironically, their commercial interests are turning 
out to enable our desire for privacy. ®

[1] http://openpgp.nominet.org.uk/cgi-bin/trac.cgi
[2] http://www.pgp.com/
[3] http://www.openpgp.org/
[4] http://www.pgp.com/library/ctocorner/identitymgmt.html