PGP on shaky ground

Bad things do happen to good code. So learned Phil Zimmermann, author of Pretty Good Privacy (PGP), which in the early 1990s became the de facto standard for cryptology development on the Internet, according to analysts and user groups.

While working with human rights advocates in 1991, Zimmermann released his powerful encryption, signing and authentication freeware, which did away with the need for third-party key authorities to issue and manage the keys that lock and unlock data.

In fact, the mathematical encryption algorithm was so good that Zimmermann nearly went to jail after one of his associates posted the algorithm's source code on the Web and it caught the attention of the U.S. Customs Service. The federal government wasn't happy that such a powerful secrecy tool had become available to anyone who wanted it and had the technical skills to use the complex program. It took a three-year legal battle before Zimmermann was eventually cleared of violating the International Traffic in Arms Regulations for exporting munitions.

Two years ago, after an unsuccessful attempt to make money on PGP on his own, Zimmermann sold PGP to Network Associates Inc. (NAI) in Santa Clara, Calif. NAI tried to integrate and market PGP as part of an all-in-one firewall, virtual private network and peer-to-peer encryption appliance but was unable to sell the product, says Ryan McGee, group product manager at McAfee Security, a division of NAI. Nor could the company find another vendor to buy PGP. So in February, it pulled support for the product (see story).

"As Network Associates drops PGP, it drops the ease of use and high level of integration PGP achieved in the desktop computing environment," says Julian Koh, a network engineer at Northwestern University in Evanston, Ill., who uses PGP for file and mail encryption inside Northwestern's network. "They've also dropped support for that product. So if someone's using the latest version of PGP on XP and they install a Microsoft service pack for XP, it could break their PGP. And there's not going to be any update from Network Associates to patch PGP."

Because of PGP's history as free software, the number of companies that have installed it is unknown. But large organizations such as Lockheed Martin Corp. use PGP on a limited basis for critical communications and file encryption, according to a spokesperson at the Bethesda, Md.-based company. And PGP is also being used in a lot of Web site scripting, says Adam Back, a security consultant in Montreal who has used PGP for eight years.

German businesses are big users of PGP, according to Werner Koch, lead developer of GNU Privacy Guard (GNUPG) in Dusseldorf, Germany. Many of those PGP installations in Germany are being replaced with GNUPG, for which Koch's small business will make its money from support fees. The code and concept of GNUPG is closely related to that of PGP.

"In the past year, a lot of companies have installed PGP for their e-mail encryption because of demands from their suppliers to encrypt business-to-business communications," Koch says. "Now those companies have real problems, because there are no more patches and updates for the product. So some of these companies are removing their PGP software and asking if we can support GNUPG for them."

GNUPG is the first and strongest new form of PGP to step into the void left by NAI. GNUPG is working on a less complex interface, and installing its program is no more difficult than downloading any software, says Gary Kessler, a cryptography instructor at the SANS Institute in Bethesda, Md., and assistant professor of computer networking at Champlain College in Burlington, Vt., which houses a PGP key server.

PGP proponents also say that more variants will emerge from the open PGP standard. PGP remains attractive because prominent alternatives such as Secure Multipurpose Mail Extensions require third-party authorities to issue encryption keys, they say.

More PGP development "would make a profit motive for a company to step in and offer commercial support contracts for PGP," Kessler says. "For example, Eudora, which already has plug-ins for PGP, and HushMail, which supports PGP in its latest version, could start to offer support."

Kessler uses PGP by pushing a button on his Eudora e-mail program. But he can't send PGP-encrypted e-mail to many of his associates, because they don't have plug-ins for their e-mail programs. More PGP plug-ins to popular e-mail applications and services would introduce millions of users to PGP, which would also promote commercial support, Kessler says.

Will new open-source developments move fast enough to encourage commercial support for end users of PGP? "I'm sworn to secrecy, but I personally know people working on this problem, and I'm sure the void will be filled in six months," says Jon Callas, senior systems architect at a technology company in the San Francisco Bay area and a former PGP developer.