Frequently Asked Questions About the International PGP Versions
The following is a list of Frequently Asked Questions about the
international PGP versions. Comments may be sent to
stale@hypnotech.com.
This FAQ is available in HTML format from
http://www.ifi.uio.no/pgp/FAQ.shtml
and in text format by sending an email to pgp@hypnotech.com with GET FAQ as the
subject.
Contents
- International vs US version
1.1. Why create an international PGP version?
1.2. What is the latest international version of PGP?
1.3. How does PGP 2.6.3i differ from MIT PGP 2.6.2?
1.4. How is PGP 2.6.3i compatible with other PGP versions?
1.5. What is RSAREF? MPILIB? What is the difference?
1.6. So, what's the bottom line? Which version should I use?
- Legal issues
2.1. What does "international" mean? Who may use it?
2.2. Why isn't it official? Is it illegal to use?
2.3. Can I use PGP 2.6.3i for commercial purposes?
2.4. Can I use PGP code in my own programs?
- Getting it
3.1. Where can I get a copy of PGP 2.6.3i?
3.2. Is there a Windows version of PGP 2.6.3i?
3.3. Is there a PGP DLL?
3.4. Where can I get updated language modules for PGP 2.6.3i?
- Installing it
4.1. How can I check the integrity of PGP 2.6.3i?
4.2. I have problems installing PGP. What do I do?
4.3. What is the correct TZ setting for my country?
- Miscellaneous
5.1. Can PGP 2.6.3i be cracked?
5.2. Isn't PGP 2.6.3i the version that was weakened for export by the NSA?
5.3. Are there any bugs in PGP 2.6.3i?
5.4. Who is responsible for PGP 2.6.3i?
5.5. Where can I learn more about PGP?
If you have a question about PGP in general, try the alt.security.pgp FAQ.
1.1. Why create an international PGP version?
The official PGP versions from MIT (the latest of which is 2.6.2) were made
inside the USA and intended for use in the USA alone. Due to special patent
and copyright issues in the US, these versions contain a number of
limitations and restrictions that are totally irrelevant for users elsewhere.
When PGP has spread to the rest of the world, it is only natural that these
limitations are removed. That's why we have the international PGP versions.
1.2. What is the latest international version of PGP?
The latest international version of PGP is 2.6.3i.
It was first released on 18 January 1996 and is currently in patchlevel 'a'.
PGP 2.6.3i is based on the source code for
MIT PGP 2.6.2 and has been modified for international use.
PGP 2.6.3i replaced PGP 2.6.2i.
1.3. How does PGP 2.6.3i differ from MIT PGP 2.6.2?
The following are the most important differences:
-
It does not use the RSAREF encryption library
- It is compatible with all other PGP 2.x versions
- It corrects a number of bugs present in PGP 2.6.2(i)
- It compiles "out of the box" for many new platforms
- It adds some new features without breaking compatibility with earlier versions
A complete list of changes can be found at http://www.ifi.uio.no/pgp/diffs.shtml.
1.4. How is PGP 2.6.3i compatible with other PGP versions?
PGP 2.6.3i can read and understand messages, keys and signatures
created with any 2.x version of PGP. (Note, however, that the keys cannot
be larger than 2048 bits. No official PGP version uses larger keys, though.)
Because it uses MPILIB rather than RSAREF, PGP 2.6.3i is
even capable of
understanding the old key signature format in PGP 2.2 and earlier versions
(pkcs_compat=0).
It cannot write such signatures, though.
PGP 2.6.3i can generate messages, keys and signatures that can be read
and understood by any PGP 2.x version of PGP. However, if you want your
messages to be readable by PGP 2.3a and earlier versions, it is necessary
to uncomment the "legal_kludge = off" line in your CONFIG.TXT file.
To sum it all up: PGP 2.6.3i is 100% compatible with MIT's versions of PGP.
If you are exchanging messages with someone who uses an old version of PGP,
remember to turn off the legal_kludge.
1.5. What is RSAREF? MPILIB? What is the difference?
RSAREF is a software library that implements the
RSA
cryptography routines.
(RSA is one of the encryption routines used in PGP, and the very heart of
public key encryption.) RSAREF is freeware, and is released by
RSA Data Security Inc.,
the patent holder of the RSA algorithm in the US. Everyone in
the US who wants to make use of RSA in their programs and give it away for
free (e.g. PGP), must use RSAREF. All official MIT versions of PGP,
starting with version 2.5, have been using RSAREF.
MPILIB is simply another implementation of the same RSA routines as found
in RSAREF. The MPILIB routines were originally written by Phil Zimmermann,
and were used in all PGP versions up to and including version 2.3a.
Functionally, MPILIB is identical to RSAREF, but the routines are generally
faster than the RSAREF routines (although the speed difference varies between machine platforms). In addition, MPILIB is capable of
understanding the old key signature format in PGP 2.2 and earlier versions
(pkcs_compat=0). RSAREF, on the other hand, cannot read such signatures.
Furthermore, MPILIB is published under the terms of the GPL, whereas RSAREF
is not.
Please note that PGP 2.6.3i uses MPILIB, not RSAREF. This is the main
reason why PGP 2.6.3i should not be used within the US. Phil Zimmermann said
this about PGP 2.6.i, the predecessor to 2.6.3i:
"The unofficial variant of PGP named PGP 2.6.i by its developers
replaces RSAREF routines with other code implementing RSA-related
algorithms. I am very familiar with that code, and while I tried to
make PGP use RSAREF in a manner that did not suffer a performance
penalty, I believe that these other subroutines are at least as
efficient, as well as being functionally identical for PGP's purposes.
Since the RSA patent does not exist outside the USA, it seems
reasonable to not encumber European users with the RSAREF subroutine
library and its own additional copyright restrictions..."
1.6. So, what's the bottom line? Which version should I use?
In general, you should use the MIT version if you're in the US and
the international version if you're not. But there are exceptions - take
a look at http://www.ifi.uio.no/pgp/which-version.shtml
for a quick reference chart.
2.1. What does "international" mean? Who may use it?
PGP 2.6.3i was put together to provide an alternative to the American versions
of PGP, which are distributed by MIT and contain a number of restrictions that
are not relevant for users outside the USA. In general, "international" means
"non-US", i.e. it may be used by anyone except those who live in the US. If
you are not sure whether PGP 2.6.3i is the right version for you, you may find
help at http://www.ifi.uio.no/pgp/which-version.shtml.
2.2. Why isn't it official? Is it illegal to use?
PGP 2.6.3i is perfectly legal to use provided that you:
- Don't live in a country where encryption is illegal (such as France,
Russia, Iran, Iraq or China).
- Are not physically inside the USA.
- Make sure that you don't download a copy of PGP that is physically
inside the USA. If you get it from one of the sites listed in question
3.1, you should be on the safe side.
The reason why PGP 2.6.3i is not official, is that is was based on source code
that was once illegaly exported from the USA. However, once the program has
been exported, anyone may use it freely.
Phil Zimmermann, the original author of PGP, has issued a
public statement on PGP 2.6.i (the predecessor to PGP 2.6.3i), which is
as close to an endorsement that he could possibly get without incriminating himself.
For a more detailed discussion on the legal aspects of using PGP,
refer to the page
http://www.mantis.co.uk/pgp/pgp-legal.html.
2.3. Can I use PGP 2.6.3i for commercial purposes?
Yes, you can, but because the IDEA algorithm used in PGP is patented in many
countries, you need to obtain a license if you
live in one of these countries. (The RSA algorithm is not patented outside
the US, so you don't need a license for this algorithm.)
The countries where the IDEA patent applies are:
- Austria
- France
- Germany
- Italy
- Netherlands
- Spain
- Sweden
- Switzerland
- UK
- USA (But you shouldn't use PGP 2.6.3i in USA anyway :-)
- Japan (pending)
I cannot guarantee that this list is complete, so please check with the
patent holders (Ascom AG, see below) if in doubt. Of course, Ascom may
seek coverage in further countries in the
future, but it's clear that commercial use of PGP
right now does not require a license in most of the world.
IDEA licenses can be purchased from
Ascom Systec AG in Switzerland.
The licensing of the IDEA algorithm was formerly administrated by
Ascom Tech, but this responsibility has been transferred to their sister
company Ascom Systec. Please, do not contact Ascom Tech about this matter!
The license fee is charged on a per-user basis as follows:
| 1..50 users | 15 US$ per copy
|
| 51..100 users | 10 US$ per copy
|
| 101..250 users | 8 US$ per copy
|
| 251..500 users | 7 US$ per copy
|
| 501..1000 users | 6 US$ per copy
|
| >1000 users | on request
|
The end-user license can be ordered online at
http://www.ascom.ch/Web/systec/security/enduser.htm.
For more information, take a look at
http://www.ascom.ch/Web/systec/security/license.htm, or
contact Licensing Manager Roland Weinhart:
Ascom Systec AG
IDEA Licensing
Gewerbepark
CH-5506 Maegenwil
Switzerland
Phone : +41 62 889 59 54
Fax : +41 62 889 59 54
Email : idea@ascom.ch
2.4. Can I use PGP code in my own programs?
The source code for PGP itself is distributed under GPL - the General Public License.
(But the RSAREF library used in PGP 2.6.2 and 2.6.3 are not!)
This means that you are free to modify the program for your own use. But don't use
it for commercial
purposes, and if you intend to release any code that is derived from the PGP
sources, don't call it by the name "PGP", as this is a registered trademark.
So, how can you integrate PGP functions into your own programs? See question 3.3!
3.1. Where can I get a copy of PGP 2.6.3i?
PGP 2.6.3i is available both as source code and as precompiled binaries for
some of the most popular platforms, such as MS-DOS, OS/2, Atari and Amiga. You
can get PGP from one of the following sources:
WWW:
- http://www.ifi.uio.no/pgp/download.shtml
FTP:
- ftp.ifi.uio.no/pub/pgp/
- ftp.encomix.es/pub/pgp/
- ftp.ox.ac.uk/pub/crypto/pgp/
Email:
- Send an email to pgp@hypnotech.com with GET PGP as the subject.
3.2. Is there a Windows version of PGP 2.6.3i?
No. There is no "true" Windows 3.1/NT/95 version of PGP, but there exists
a number of front-end shells that wrap around the
DOS versions. Precompiled binaries exist for MS-DOS (16-bit & 32-bit), OS/2,
Amiga, Atari and Macintosh. There is also a Win32 (Windows 95/NT)
compilation, but it's only a text-mode application without any fancy GUI. It
does, however, support long filenames (NTFS & VFAT). For more information,
see http://www.ifi.uio.no/pgp/windows.shtml.
3.3. Is there a PGP DLL?
PGP, Inc. (www.pgp.com)sells a
simple PGP DLL, but this is only available in the US and Canada.
Apart from that, there is no real PGP DLL. (There exists a few experimental libraries, but they only implement a subset of the PGP
functions, and they are not in general use.) Thus, integrating
PGP into your own programs is a little difficult. There are at least three
ways to do this:
- Call an external PGP binary with the correct command line parameters
- Get a copy of a PGP library (http://www.ifi.uio.no/pgp/libs.shtml) and see if you can make any sense of it
- Modify the PGP source code and link it into your own programs (see legal issues in question 2.4)
Note: PGP is written in C, so if you choose alternative 2. or 3., you should be proficient in this
programming language.
3.4. Where can I get updated language modules for PGP 2.6.3i?
An updated collection of translation files for both PGP 2.6.3 and 2.6.3i can be
found at:
WWW:
- http://www.ifi.uio.no/pgp/modules.shtml
FTP:
- ftp://ftp.ifi.uio.no/pub/pgp/lang/
4.1. How can I check the integrity of PGP 2.6.3i?
All the PGP 2.6.3i distribution archives contain a signature file so that
you can verify that the files have not been tampered with.
In order to verify the signature, you need the signatory's public key:
- Stσle Schumacher (0xCCEF447D): source code, MS-DOS and OS/2 versions
- Peter Simons (0x34D74DC1): Amiga version
- Guy Geens (0x5AE50475): Atari version
- Naoki Sukiyama (0x05DE8AF1): Macintosh version
4.2. I have problems installing PGP. What do I do?
First of all, make sure that you have read and understood the setup instructions
(usually in the file SETUP.DOC) for your particular platform. Re-read it carefully
and try again. :-)
DOS/Windows users: Make sure that the PGPPATH variable is correctly set and does not contain any white space. You did remember to reboot after modifying AUTOEXEC.BAT, didn't you? ;-)
Unix users: If you don't know which make target is the right one for your
flavour of Unix, the following commands might give you a clue:
uname -a
hosttype
arch
echo $OSTYPE
echo $HOSTTYPE
echo $MACHTYPE
gcc -v
If you get unresolved references to strdup() while compiling, you should
download the latest patches from http://www.ifi.uio.no/pgp/patch.shtml.
When you have successfully compiled PGP,
make sure that the directory ~/.pgp/ exists and is writeable before
generating your keys.
If you are still having problems, try posting to the newsgroup
alt.security.pgp and ask for help.
If you think you've found a genuine bug in PGP, take a look at
http://www.ifi.uio.no/pgp/bugs.shtml.
4.3. What is the correct TZ setting for my country?
In SETUP.DOC there are a few examples on how to set the TZ environment variable. (Note: even if you're using Windows 95, you can still set TZ in AUTOEXEC.BAT.) The syntax is simply:
SET TZ=XXX[+|-]n
where XXX may be any three letters, and [+|-]n is the time difference from UTC (GMT)
in whole hours (positive numbers westwards from London, negative numbers eastwards.) If you're using Daylight Savings Time, add DST at the end of the string.
So how do you know the time difference from your country to UTC? Look in a world
atlas or ask someone for advice. If you're using Windows 95, you can open
Regional Settings in Control Panel and click on your country to see which time zone you're in (but make sure to replace '+' with '-' and vice versa, as
Windows 95 uses positive numbers eastwards). If all else fails,
use an approximate or pick the setting from a neighbouring country. If you
don't get it completely right, it's no big deal. The TZ setting is only used
for adjusting the timestamps on your PGP signatures. Unless you are signing a
legal contract or some other important document, nobody will bother if your
timestamp is a few hours off.
5.1. Can PGP 2.6.3i be cracked?
Yes. Any PGP version can be cracked, provided that the attacker has enough
time and resources (= money) for the job. However, a typical 1024-bit PGP
message would
take about 300,000,000,000 MIPS year to crack, so the ordinary citizen is
relatively safe off, at least for the next few decades. See the PGP Attack FAQ (http://axion.physics.ubc.ca/pgp-attack.html) for details. If someone really wants to read your PGP
encrypted messages, he/she would probably rather steal a copy of your
secret key and try to guess your pass phrase or force you to reveal it.
5.2. Isn't PGP 2.6.3i the version that was weakened for export by the NSA?
No. PGP 2.6.3i is just as secure as any other version of PGP. Neither
Phil Zimmermann, MIT, NSA, myself nor anybody else have put any backdoor
into PGP 2.6.3i, lobotomized the random number generator, limited the effecive
key size or otherwise done anything to
compromise the security of the program. If you don't believe it, download the
source code and see for yourself. The PGP source is free for anyone to
scrutinize, and has been so for many years now. Still, nobody has been able
to find any backdoors. The conclusion is clear: if anyone can crack PGP 2.6.3i
then he/she can also crack any other PGP version around. If you read magazines
like Internet World, don't believe a word of what they say. :-/
5.3. Are there any bugs in PGP 2.6.3i?
No program is 100% error free. Yet PGP 2.6.3i is probably the most bug-free
PGP version available today. To see a list of known bugs and how to fix them,
or to report new bugs, refer to the PGP bug page at http://www.ifi.uio.no/pgp/bugs.shtml.
5.4. Who is responsible for PGP 2.6.3i?
PGP 2.6.3i was put together and published by Stσle
Schumacher
in Norway. However, this work would not have been possible without the
help of many individuals around the world. The international PGP versions
are now maintained and supported by an international development team,
who coordinate their work through an Internet mailing list. If you would
like to join this list, please contact
stale@hypnotech.com.
All questions regarding PGP 2.6.3i should be addressed directly to
Stσle Schumacher or to
pgp-bugs@ifi.uio.no.
Please note that Phil Zimmermann, MIT and
the University of Oslo
have nothing to do with PGP 2.6.3i. Comments, bug reports and
suggestions for future releases are welcome.
5.5. Where can I learn more about PGP?
The README file for PGP 2.6.3i covers most of the
details that are special to the international PGP versions. If you have
access to WWW, the International PGP Home Page is an excellent starting
point for further PGP exploration:
http://www.ifi.uio.no/pgp/
For information on PGP and encryption in general, check out the following
resources:
Other FAQs:
FAQ from comp.security.pgp by Arnoud Engelfriet
http://www.pgp.net/pgpnet/pgp-faq/
Where to get PGP FAQ by Michael Johnson
ftp://ftp.uu.net/usenet/news.answers/pgp-faq/where-is-PGP.Z
PGP passphrase FAQ by Grady Ward
http://world.std.com/~franl/pgp/pgp-passphrase-faq.html
PGP attack FAQ by infiNity
http://axion.physics.ubc.ca/pgp-attack.html
PGP 2.6 FAQ - only of historical interest
ftp://net-dist.mit.edu/pub/PGP/PGP_FAQ
WWW:
Fran Litterio's PGP Page (from the Virtual Library)
http://world.std.com/~franl/pgp/pgp.html
The Official Bug List for MIT PGP 2.6.2
http://www.mit.edu:8001/people/warlord/pgp-faq.html
FTP:
ftp://ftp.ifi.uio.no/pub/pgp/
ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/
ftp://ftp.ox.ac.uk/pub/crypto/pgp/
Newsgroups:
alt.anonymous discussion of anonymity and anon remailers
alt.anonymous.messages for anonymous encrypted message transfer
alt.privacy.clipper Clipper, Capstone, Skipjack, Key Escrow
alt.security general security discussions
alt.security.pgp discussion of PGP
alt.security.ripem discussion of RIPEM
alt.security.keydist key distribution via Usenet
alt.society.civil-liberty general civil liberties, including privacy
comp.compression discussion of compression algorithms
comp.org.eff.news news reports from EFF
comp.org.eff.talk discussion of EFF related issues
comp.patents discussion of S/W patents, including RSA
comp.risks some mention of crypto and wiretapping
comp.society.privacy general privacy issues
comp.security.announce announcements of security holes
misc.legal.computing software patents, copyrights, computer laws
sci.crypt methods of data encryption/decryption
sci.math general math discussion
talk.politics.crypto general talk on crypto politics
Books:
The Official PGP User's Guide
by Philip R. Zimmermann
MIT Press 1995
ISBN 0-262-74017-6
216 pp. $14.95
PGP: Pretty Good Privacy
by Simson Garfinkel
O'Reilly & Associates 1994
ISBN 1-56592-098-8
430 pp. $24.95
Protect Your Privacy: The PGP User's Guide
by William Stallings
Prentice Hall PTR 1995
ISBN 0-13-185596-4
302 pp. $19.95
Applied Cryptography: Protocols, Algorithms, and Source Code in C
2nd Edition, by Bruce Schneier
Wiley Publishing 1996
ISBN 0-471-11709-9
E-Mail Security: How to Keep Your Electronic Mail Private
by Bruce Schneier
Wiley Publishing
ISBN 0-471-05318-X
Last updated
March 5, 1997
by Stσle Schumacher
<stale@hypnotech.com>