1. PKI2001(TIFR,Mumbai) PGP Pretty Good Privacy Designed for secure transfer of e-mails with off-line or out of band key distribution.

2. PKI2001(TIFR,Mumbai) Introduction n PGP users maintain their own list of public keys, called keyring. n PGP allows users to exchange keyrings. n Each user fully trusts the others they meet outside of the Internet.

3. PKI2001(TIFR,Mumbai) One Simple Example

4. PKI2001(TIFR,Mumbai) Alice Bob Chris Elvis Alice Bob Chris Elvis Bob Chris Bob Elvis Bob  Chris Elvis Alice  Bob Chris Elvis

5. PKI2001(TIFR,Mumbai) Web Of Trust n By Bob  Chris, Bob and Chris exchanged their keyrings, and they fully trust each other. n But what about Chris  Elvis, when “Elvis” is an impersonator of real Elvis ? n This means Chris has been fooled and ultimately Bob and Alice too. Since Alice  Bob

6. PKI2001(TIFR,Mumbai) Individual Trust Policy n PGP allows the user to assign one of four following attributes while adding a new key to the keyring a Completely trusted a Marginally trusted a Untrusted a Unknown.

7. PKI2001(TIFR,Mumbai) n The attributes attached with each key helps the keyring owner to decide how much trust he should put in the key. n The keyring owner can tune PGP’s criteria for accepting key. n For example, one can tell PGP to accept a key if it has been signed by F 2 completely trusted keys or F at least 3 marginally trusted keys, F 1 completely and 2 marginally trusted keys etc.

8. PKI2001(TIFR,Mumbai)

11. Conclusion “In God we trust, all others pay cash” n A cliché “In God we trust, all others pay cash” n PGP does have very strong security if the keyring owners have checked the trust relation between the users contained in the keyring very strictly but it is a matter of trust at last. n If a single user cheats to other who puts full faith in him; the whole web faces the serious security threat. n So it is useful for a small domain of trusted users.