Flaw Found in PGP Security Software Problem Related to Key Escrow Byron Alley
Some bad news on the privacy and security front: a security problem has been found in the popular program PGP. PGP is commonly used to keep email and files private.
PGP's support for decryption by a third party has a flaw that enables an attacker to tamper with an existing public key.
PGP (Pretty Good Privacy), by Phillip Zimmerman, is a program that encrypts files or email messages so that only the intended recipients can read them. In 1997, Zimmerman added a feature enabling Additional Decryption Keys, a form of what's known as "Key Escrow."
Key Escrow enables a third person, such as your boss, to read anything you encrypt. This is supposed to help ensure that losing your password or secret key won't stop your company from reading important files.
Renowned cryptographer Bruce Schneier said of PGP's Key Escrow problems,
Way back in 1998 a bunch of us cryptographers predicted that adding Key Escrow would make system design harder, and would result in even more security problems. This is an example of that prediction coming true.
Fixed versions of PGP are available now from the PGP home page at www.pgp.com.
