CD Ware Multimedia 1998 February/CD WARE MULTIMEDIA (02-1998) CD++.iso/Encript/PGE10B/PGE.TXT

Text File | 1997-12-18 | 7.6 KB | 163 lines

                  P.G.E. v1.0

                 Pretty Good Envelope
                 ====================
                by Roche'Crypt

        PGE v1.0 (c) Copyright 1994, XCrypt Productions


 WHAT IS PGE?  WHAT IS IT NOT?
 =============================

    PGE is not an encryption program, nor a safe tool to rely on privacy
 by itself. PGE is just a special kind of envelope you use to send/receive
 your messages/data.

    You probably are already using some encryption utilities to handle
 your mail. While you assume that your mail is safe, you are missing one
 small detail: you are not hiding the fact that you have special reasons
 for having your mail encrypted.  While theoretically, this  doesn't imply
 anything wrong, wouldn't be better if you used some special envelope that
 would make others think that you're having regular mail and not hiding
 anything at all? At a glance, they would look at the body of the message
 and not even think that it hides encrypted data. Doesn't this sound nice?

    PGE will "insert" your data into a GIF or JPG file, and yet, being able
 to view the picture after inserting the data. Apparently, all you are doing
 is transferring innocent pictures, while what you are really doing is planning
 the world domination.

    At this time, PGE is a fairly simple program, way far from any average
 (not just decent) encryption package. The security of your data still
 relies on the encryption software you use and nothing more. PGE simply
 helps your mail to keep a regular "looking", adding one more step of
 complexity in tracing your mail.


 WHAT KIND OF PICTURES CAN I USE?
 ================================

    As far as I can tell, PGE will work on *any* GIF (87,89) or JPG (JFIF)
 picture. It is, however, of common sense, to use small size pictures
 (size in bytes, not resolution). Sysadms may not get suspicious if you
 transfer hundreds of kilobytes of graphic material, but they will certainly
 get pissed,  and you will call their attention as much (or even more) as if
 you were just using your favorite encryption software. This totally defeats
 the purpose of PGE in many ways. For this reason, JPG pictures (usually
 smaller than GIFs) are preferred. I'd strongly recommend pictures that don't
 exceed 30k in size, but again, it is your choice. It's also your choice
 whether you want to send the resulting file as an attachment, uuencoded,
 or even double-encrypting the resulting file.



 HOW TO USE IT
 =============
    You'll need a GIF/JPG file and the file containing the data you want to
 send. You should encrypt your data BEFORE using PGE! From the command
 prompt, type:

 PGE valley.jpg mydata.txt      (substitute valley.jpg and mydata.txt
                 for your pic and data filenames)

    The program then will ask you for a key. If you are already using an
 encryption package, you probably want to ignore this, by pressing return.
 What the key does is simply add one more level of complexity to the
 envelope generation process. The receiver *must* know the key, in order to
 unPGE the file. Furthermore, I wrote the algorithm in ten minutes, and it
 is really easy to crack. It is obvious then, that this key is not meant to
 be a secure way to encrypt your data, and you should never rely exclusively
 on it. The only purpose of adding the key at this time is to scramble the
 output of the original data file a little bit more, and nothing else. The
 real encryption should be done by your encryption program (PGP, crypt,
 whatever...).

   Since I assume that people interested in PGE are already using an
 encryption package to protect their data, my suggestion regarding what PGE
 key should be used, would be to based on any of these rules:

    - Don't use any key at all (press return when asked for a key). Your
      data is already protected by your encryption program.
    - Use the original picture name as the key, or the first X characters
      (up to 8)
    - Use the receiver's user name.
    - Write the key in the subject field.
    - Whatever... Again, PGE is NOT an encryption package, and the fact that
      it allows you to use a key is irrelevant for the safety of your data.


 NOTE:    You don't have to convert your [encrypted] data file to a 7-bit
    format before adding it to the pic file, although you may want to
    do so. This is because the resulting pic file has to be converted
    to a 7-bit format (uuencoded) before it is sent, anyway. If sent as
    an attachment, you don't have to worry about a thing either.


 THE PGE'd FILE
 ==============

   After you've run PGE and successfully "inserted" the data file into the
 pic file, you'll have a new file (the file you will send). The filename
 would be the same as the picture file, preceded by an underscore.
 So in our example, the resulting file would be _valley.jpg. You are
 encouraged to rename the file to something else, as the underscore would
 be a clear PGE signature. It's like sending hate-mail with the sender's
 address on the envelope.

    When the other person receives the file, he/she must unPGE the file.This
 is done by typing:

 unPGE valley.jpg

    This will create the file VALLEY.PGE, which is nothing but your original
 [encrypted] data/message. Don't forget that if you used a PGE key to
 include your data into the pic file, the same key must be used in order
 to succesfully extract your message from the pic file. UnPGE will ask for
 the key before attempting to extract your message.


 THE FUTURE
 ==========

    This first version of PGE is experimental, it only run under DOS, and
 does not use any obfuscated algorithms to "hide" your data within the
 GIF/JPG file. This is because, as far as the world is not aware of PGE,
 no one should get suspicious when they see you transferring pictures
 (pictures that really work) with someone else. In other words, the less
 this program is distributed/used, the less people would be aware of it.
 I'm not asking you to keep PGE confidential, I'm just pointing a fact
 as old as cryptography. I would like to emphasize that in this experiental
 version, PGE does not really "hide" the data within the picture file, like
 for example, Stego does.

    Depending on the feedback I receive from other users, I may implement
 PGE to work on other common file formats, such as ZIP, SIT, LHZ, ARJ...
 Also, a much better strategy for hiding the data within the files is one
 of the things I have in mind. The strategy used in PGE 1.0 is simply
 functional.

    If by some odd chance (really odd), PGE becomes common knowledge, any
 amateur cryptographer or programmer could break the enveloping algorithms,
 creating some tools that would allow any "average" sysadms to easily peek
 at the files you created with PGE, and find out whether the files contain
 hidden data or not. Again, if PGE becomes popular, a better, safer
 implementation of PGE shall be on its way. But I must say I'd be surprised
 if this ever happens (the popularity thing).

    At this point, I'd say that PGE is more a concept than a program. I have
 many ideas that I would be implementing in PGE whenever I have the time.
 Maybe in the future PGE becomes an independent encryption package by
 itself, who knows? If, after a while, not even any of my closer friends
 cares about PGE, I could just keep developing it for fun and for myself.
 After all, that's how it started, and it continues that way. At this moment,
 PGE is nothing but a humble program that adds data onto a GIF/JPG file
 without altering the picture data. Somehow, it is a really lame program,
 but it works for me. If it doesn't work for you, don't use it. Otherwise,
 be my guest.


Roche'Crypt                        March 23rd, 1994