DE19946876A1 - Bilateral buyer-led transaction apparatus for sale and purchase of goods and services e.g. via internet has checking mechanism which makes purchase requests globally available to possible vendors - Google Patents

Abstract

The apparatus allows future purchasers of goods and services to make a binding contract with potential vendors based on a purchase request. The apparatus includes a checking mechanism which contains the binding purchase requests of future purchasers. The checking mechanism makes the purchase requests globally available to possible vendors. Possible vendors then have the option to accept the purchase request and to conclude a contract with the corresponding purchaser. Typically, encryption techniques are used.

Description

Field of the invention

The method and apparatus of the present invention relates to electronic Ver trags applications through electronic networks.

background

There are several dozen different buyer-seller led logs today, most of them These systems are seller-led in the sense that their focus is on the methods and Based on the processes available to the seller; they allow him the price, the verpac effectively determine the configuration or configuration of goods and services. Shops, catalogs, Advertising, telemarketing, auction houses, in particular computerized travel reser vierungssysteme such. B. START / AMADEUS, are all seller-led.

Traditionally, it is the seller's job to attract buyers and complete the sale. In a seller-led system, the advertising costs of a transaction and the consequent risk of unsuccessful advertising by the seller.

Most retail goods and services sold are sold by a seller conducted by the seller, the seller sets the price and the buyer decides whether he or not he accepts the price.

Prices for certain services, eg. B. for airline tickets can change frequently, but the buyer must wait for the seller until he offers a price that he finds acceptable.

Obviously, some forms of business are on giving and taking deals and counter-offers, but the vast majority of retail sales will be Ver Buyers run for non-negotiable fixed price.

Auctions are probably the most widely used system in which prices are not priced are from the seller. But again, the system is seller-led. The buyer does not find the Seller, the seller attracts different buyers, which, as a group, the final one Price - which the seller can reject, unless the auctioned item was sold without reservation.  

Also online reservation system are seller-led. Airline reservation systems such as START / AMADEUS are in the business of an ongoing publication of air fares in their price databases. Travel agents and customers are on the bidder side of the process. Anyway, as long as they can not communicate their bids to the airline, they have to wait until their bid price appears in the database that meets their needs.

Other business systems are exchange-led. This system, as the European stock exchanges read bring together buyers and sellers in an efficient, fair and orderly marketplace come. Neither buyers nor sellers are preferred, but simple communication becomes which gives space to the adaptation process. An example of an automated off Exchange-traded business system for the trading of shares in Germany is "XETRA" the German stock exchange.

A buyer-led system is a system where buyers find sellers, such as a "KAU FEN WANTED "Classified Classified Ad. A job advertisement is a buyer-led post ask the employer to look for the performance of a qualified employee and she buys. The demand is made known to a large number of potential "sellers", a number of them will respond by sending their curriculum vitae to their future ones Employer.

Buyer-led systems provide certain benefits and benefits to the other business systems do not bring. Buyers using such a system can have greater control over the loading conditions and conditions of their purchase. In addition, if a large number of potential but that sellers do not have the resources to advertise globally, It makes sense for buyers, if possible, to take the initiative in communicating their needs to the customer To take over the seller.

There are currently some unilateral buyer-managed business systems. A good example Such a system is the typical reward system in which a buyer makes an offer fentlicht for a reward to anyone who solves a subtask. This type of Sy stems is unilateral because the offer is accepted only by performing the described task can be. Therefore, unilateral systems can only be used for limited transac  which allows acceptance by execution.

Bilateral buyer-led systems are based on the conclusion of a contract between buyers and Seller aligned, based on the mutual execution of pledges.

Bilateral buyer-led systems represent, for various reasons, only an extremely small one Crowd of business life. First, and that may be the most important reason, or can Buyers do not want to spend the time, the money or other means to an indefinite Number of potential sellers to communicate their wishes. This concerns in particular the indi individual / private consumer who can not or does not want to pay the transaction costs.

For example, a customer looking for a car repair shop will not work with everyone want to contact individual workshop and this the details of the necessary repair want to communicate. The advantage for the customer to do this (for example, a lower price too experience) is almost completely consumed by the time spent and the cost. Also, buyer-led systems are not predominant because buyers are not flooded want from numerous offers of potential sellers (for example, hundreds of dealers call a brew on). Buyer-led systems also produce very high costs on the part of the seller. If each buyer has different requirements and communication with nonstandard When using the language, sellers have to spend a considerable amount of money on the request to read and understand. In addition, sellers are usually not available for special changes ments of their products for individual buyers.

As a rule, the greater the number and complexity of the buyer's purchasing conditions, the more difficult ger is a buyer-led market because advertising costs grow generally with the number of bedin which must be communicated and the potential number of sellers which ver want to stand and meet the complex conditions.

Buyer-led markets work best when there are well-defined buy requests if a branded goods manufacturer promises a quality guarantee to the buyer z. For example, the name a renowned airline or a renowned automaker. An example of a regularly used bilateral buyer-led process is the system from large organizations such as B. companies or authorities is used, which signifi want to buy quantities of goods or services at the lowest possible price. To  Beginning they formulate a detailed written specification with the quantities and requirements which they are looking for. This document will typically "request for a Offer = Call for Proposals. "Subsequently, the call will be announced to a list distributed among the companies. If the value of the tender is high enough, as is the case with a If there is a large contract with an authority, the buyer will want to pay the additional costs a publication of the tender in newspapers and magazines by a large number of To reach companies.

Potential companies that identify a tender for a fulfillable first check whether they want to invest the necessary time and work to make an offer. typically, A number of companies will make a binding offer by a set deadline. The buyer will then examine the offers submitted. An offer is selected and the corresponding company will be awarded the bid for the price indicated informed.

Big organizations can take advantage of the bidding process because of their purchase volume of the selling company provides a valuable opportunity for the business in the Compete. They also have the resources to satisfy their buying needs to communicate the number of companies. As a result, they can often incur significant costs save, in particular for mass goods or mass services (such as office supplies or telecommunications services) and, for example, on airline tickets and hotel rooms. Individual consumers can not efficiently participate in such bilateral buyer-led Systems because they do not have the purchasing power and resources like a big organization. Some consumers have found ways to group together the purchasing power of one to reach big organization. Many consumers are excluded from such Shopping Communities, because conditions and limits vary too much.

Trade tries to use the Internet's inherent advantages. Many types of Business systems such as department stores, catalogs and auction houses are realized on the Internet. This approach seeks to improve the seller or exchange-management system Sales of goods and services becomes more efficient.

Although there have been several attempts to use the Internet for bilateral buyer-led systems use, these attempts were largely unsuccessful. At the moment there are "black boards"  on the internet, where buyers are "WANTED." Ads too low or none at all Cost can attach. So every customer can publish his own bid on looking for companies to give him the desired plane ticket or a special car specified options. Because internet releases are global, the buyer has the theorized possibility of tendering to a large number of potential sellers submit. In practice, this process is ineffective because potential sellers are not regular Look for the various "black boards" or individual tenders reply.

Sellers are deterred from using these operations because there is no guarantee for the authenticity of the tender gives the cost of negotiating with individual Kun they are usually too high and it is difficult the rights from the agreement (including payment warranty) between the customer and the seller. In addition, the "Black boards" with tendrils wildly scattered on the Internet making it very difficult makes it, if not impossible, for sellers to find the relevant tenders. Finally, sellers in the analysis of tenders from the Internet with a incalculable number of forms, conditions, conditions and linguistic styles in the off confronts. Sellers need to bring a lot of time and money to only the Customer wishes to understand in each branch in the branches in the individual language Tender is used. In total, tenders include buyers on the Internet too many uncertainties for the seller. Sellers are not willing to spend time and money to find tenders on the Internet. Accordingly reduced for Buyers will place tenders on the Internet as the critical mass of sellers is missing.

It follows that there is a need for a centralized buyer-led system for bilateral There are electronic shops that can be used by individual small customers Purchase requests globally to communicate to potential sellers. The advantage of such a Sy stems are diverse. It is the only way for a buyer to poten a large market efficiently reach the seller. It allows the buyer to set the conditions he wants is to be accepted. As an added benefit, the seller has an indication from the market allowed his product. And finally, the costs are kept to a minimum since these Technology based on electronics.  

A key element for reaching a critical mass of sellers in such a bilateral electronic buyer-led system is the seller's option, one To bind Buyer under his terms and conditions with a legally binding purchase agreement. In contrast to a non-binding tender, a binding offer of a buyer is attrak tiver for potential sellers, because, strictly speaking, under what conditions and Kondi a buyer wants to bind himself. Potential sellers do not need to worry about the costs of annoying purchase negotiations with the individual buyer, because this all conditions in his offer. In addition, the seller's option becomes a buyer to tie up at the beginning of the transaction, his concern about the enforcement of the contract mitigate, because the seller has the opportunity to the buyer to a legal contract tie.

In order to understand the necessary conditions for a valid contract, which in electronic commerce is an overview of the current state of the art Contract law necessary

Fundamentals of contract law

The design of a legally binding contract requires three elements: offer, acceptance and return. In other words, an essential requirement for the formulation of a contract is an agreement: a mutual proof of agreement to the same Conditions. This mutual consent exists through the process of bid and Adoption. Further legal requirements are written down BGB.

An offer is defined as an expression of intent to act or refrain from a specific way. The most important thing in this regard with electronic commerce is a customer advertisement for an offer. For example the advertisement of a bicycle dealer for a bicycle of the brand "XYZ" for DM 500, - "valid only today" does not constitute an offer. The Advertising is merely an invitation to submit an offer. Since the business is neither a Quantity has yet specified the handover, this type of advertising is only a will Rally for sale or a preliminary invitation to tender. So are the Tenders as discussed above merely advertise for offers and less binding offer.  

The following pages contain a description of the cryptography program PGP in the international version. The use of PGP is z. Currently for private use for free. The Copyrights are owned by Network Associates, Inc. Portions of the description are from from various FAQ's from PGP.

In the drawings for patent application is the speech of "encrypt, sign, etc." The Actions are always performed with PGP.

Fields of application of PGP

PGP is an encryption program for messages. Used correctly, it closes the ability to decrypt data sent by e-mail or diskette without authorization, largely off. However, it is hardly suitable for making data on a computer more comfortable and accessible reliable way to protect against unauthorized access. This should be the case when using PGP get noticed.

Translation and technical terms

For translations, it is often difficult to decide to what extent technical terms should be used. Translating too many terms may confuse the reader, who is familiar with the English terms. Conversely, a text which has not been sufficiently Germanized can remain incomprehensible to those who do not know the English terms. We have decided for a fairly extensive Eindeutschung. In order not to cause too much confusion, there follows a list of words in which we were in doubt as to whether a translation makes sense:

English term our translation batch file batch file directory directory environment variable environment variable exit code exit code file name extension Extension / suffix fingerprint fingerprint grassroot organization basic political organization key compromise / revocation cerificate Key recall certificate key ring key ring message digest Textprüfsumme pass phrase Mantra public key ring public keyring private key ring secret keychain swapfile pagefile

definitions

Cryptography, like other disciplines, has its own jargon. As a small reading aid should serve the following glossary:

algorithm

A calculation rule. (Computer scientists may forgive me the strongly abbreviated explanation hen.)

attack

An attempt to obtain encrypted or otherwise unavailable data, d. H. to read or copy them without permission.

plain text

In the context of encryption of computer data, plain text is not just text in the sense of "human readable", but all unencrypted data. PGP encrypts individual files so that "plain text" in this manual and in general when using PGP as an "unencrypted file".

cryptanalysis

Methods and procedures to encrypt data without prior knowledge of the key decrypt.

cryptology

The lesson of encryption.

cryptography

The practical application of cryptology.

message

"Message" in the context of this manual is a single - encrypted or unverified keyed - file meant.

General

PGP stands for "Pretty Good (TM) Privacy", in German for "pretty good privacy", where  "Pretty Good" is also short for "Phil's Pretty Good Software", from where the Program originates. It is a highly secure encryption and decryption program, that exists for a lot of different computers and operating systems, such. On Amiga, Atari, Macintosh, MS-DOS, Unix, VAX / VMS etc. PGP allows the exchange of messages without Renouncement of privacy, authentication and comfort. Here we understand privacy re that a message can only be read by the desired addressee, under Authen tification that a message is verifiably coming from the person from whom they came to stam menu (electronic signature), and in comfort, that the user does not needless to think about where he stores which keys and which ones Key he used to exchange data with whom, as with conventional Encryption software is too often the case.

Also in contrast to conventional encryption technology will not be tap-proof Channels needed to be replaced by the keys because PGP uses a system with public Uses keys. PGP combines the ease-of-use of RSA (an algorithm for public-key systems, that of Rivest, Shamir and Adleman was developed and is considered very safe) with the speed conventional cryptography (i.e., using public-key cryptography) and uses a method of generating text Checksums (PGP uses the "Message Digest 5" method) to generate electronic signatures. It compresses the data before The encryption, is user friendly, has a comfortable key management and is portable. Implementing the RSA algorithm at PGP works faster than most RSA implementations in other programs. You can from your PC, for example running under MS-DOS, sending a text encrypted to a friend who has this on his Amiga can decrypt. Or you send a text to the university, which you consider important and therefore want to sign - no problem if the university has installed PGP, the Recipient also check your signature on a Unix machine. And PGP is fast. PGP is the cryptography system for everyone.

PGP does not send its files itself, but deals exclusively with the and decrypting. To send you need more programs. (Same as for not encrypted texts.) (In many email programs PGP can now be integrated quite comfortably become. For Unix, see the directory contrib of the PGP program package tes. The data exchange format ZCONNECT (r) has meanwhile been extended to include that encryption programs and in particular PGP in upcoming versions of Point programs can be integrated even better.  

Why use PGP?

PGP protects privacy. Whether you are planning a political campaign, about your income or to keep an affair secret, whether you want to talk about something your own Opinion is illegally illegal or whether you store, transport and send data that fall under the Data Protection Act (system administrators who use their user data via a Transport telephone line), whether you want to write sometimes messages, of which others should know that they come from you or if you just that news want to test from others - most people who use email will use PGP sooner or later can use later.

And if you are reluctant to encrypt your private mail: Why use actually envelopes? Suppose it is the common view, good citizens would not need to use envelopes. If anyone for some reason would use an envelope (several sheets, a love letter, the mother of the Addressees should not read etc.), then this would be highly suspicious. Fortunately, use Most people use envelopes, but for electronic letters this is still so not the case. The electronic data paths are much easier to monitor (pure technically) as conventional mail, and electronic messages can also be very fast to search certain keywords. And: Actually go to regularly AIDS test? Would you like to be examined for illegal drug use? Demand not a judicial search warrant, if the police make a house scan wants to do it? Do you have something to hide in the end? You are probably one Drug dealer, a parker or a subversive if you use envelopes. What if it were the general opinion that righteous citizens should do all write their mail on postcards? If a brave person came up with the idea, his letter Securing a secret with an envelope would be highly suspicious. security agencies maybe they would open every envelope to control what they are hiding. Fortunately wise, we do not live in such a world - most people use envelopes, so  that an envelope is not suspicious either. It would be nice if all the email was encrypted whether it contains banned messages or not, so that the encryption of E-mail is no more suspicious than using envelopes.

If security authorities want to break the letter or telephone secret, they must agree Exerting effort. You have to open the envelope under steam, read the letter and the Tape the envelope again. Listening to phone calls is very time consuming, as well Transcription takes time. Such labor-intensive surveillance can not be done in a big way operate. Only in important cases is it feasible.

An increasing part of our private communication is via e-mail. E-mail but can be monitor very easily. Finding suspicious keywords is not a problem. The can easily be done routinely and fully automatically on a large scale, without it somehow striking. International communication channels are so from the National Security Agency (NSA) intercepted.

We will soon have the "Information Superhighway" criss-crossing America Covers fiber optic cables and connects the ubiquitous PCs. E-mail becomes more general Become standard. Government agencies will be theirs for encrypting our messages recommend own technology. Many people like to trust this technology. But others will prefer to make their own choice.

Bill 266, which was submitted to the US Senate in 1991, contains a few concerns DE regulations. If the draft had been passed, the manufacturers would be more tap-proof Communication technology has been obliged to incorporate in their products "trapdoors", with whose help the government could crack all encryption. Literally: "The Senate believes that the providers of electronic communications and manufacturers electronic communication devices must ensure that the government has access to the decrypted voice, data and other communications, if one Legal basis. "This bill was released following fierce protests from Civil rights groups and industry associations.

In 1992, the FBI submitted a bill to the Congress on interception of telephones. This Law should oblige all manufacturers of communication devices, devices in the Install devices that allow each FBI service to communicate electronically listen. Although this template in the congress barely met with resonance, it was in 1993 submitted again.

Of particular concern is a new push by the White House, by the National  Security Agency (NSA) prepared for years and published on April 16, 1993. core piece is a state-designed encryption technology called Clipper, which works according to a secret procedure. The government demands the communication industry to install this chip in all devices that enable "secure" communication such as telephones, fax machines, etc. AT already builds this chip in "tap-proof" Phones.

AT had previously developed a probably safer process that called for "gentle" pressure was dropped by the state.

The hook at Clipper: In the production each chip gets its individual key, and the government gets copies of these keys to intercept. But do not worry - the Government promises that these "duplicate keys" only properly according to the law be used. So that Clipper for the authorities the full benefit The next logical step would be a ban on other forms of cryptography. However, this is not planned according to official statements.

When privacy becomes a breach of law, only lawbreakers will enjoy privacy can. Intelligence, military, drug cartels, big business companies, they all have good cryptography systems. Only normal people and grassroots organizations are excepted - were exempted, because now there is PGP.

That's why PGP was written, and that's why you use PGP should use.

The functionality of PGP

The whole thing is of course easier to understand if you already have something of encryption systems in general and asymmetric procedures (public-key systems) in particular understand. Since this can not be assumed, now a little introduction: First, some terms should be clarified. Let's say I want you one Write a message that nobody else should be able to read. For this I can the message "ver "coding" (the word "coding" has a double meaning: on the one hand, it means "in one particular" Represent form "and on the other hand" encrypt. "In this manual it is mostly in the sense used by "encrypt".), that is, I am changing it to a hopeless complication so that no one can do anything with it except you, the one intended te recipient of the message. I use a key, and you need this key also use to decrypt the message. At least with conventional symmetri  with single-key systems.

That conventional systems use a common key for encryption and decryption means that this key is on a secure path between sender and recipient ger must be replaced. This can be awkward, and if there is a sure way to exchange the key, why do you want to encrypt it? You could be the one but also use the channel for communication.

In systems with public keys (asymmetric systems) exist for each participant a key pair consisting of a public and a secret key. What with which a key has been encrypted can only be used with the corresponding other key be decrypted. Knowing the public key is not enough to do with it to read encrypted messages. The secret key can not be ideally calculate from the public key. Modern methods like those used in PGP come, applied correctly, very close to this ideal. That's why the public key be spread without hesitation (therefore it is called public), which means a much lesser There is a need for secure transport routes than with conventional systems.

Furthermore there is the possibility to "sign" a message. For this, the Absen a message's encode them with its private key, and any recipient can do that Check the genuineness of the sender by trying to make the message public Key to decode. If successful, the message is encoded with the private key, so signed. The sender is real.

Of course, these two steps can be combined with each other, to secrets and correspondence Authenticity of the sender to ensure: The message is first with its own coded private key and then this signed message with the public key of the recipient. This first decodes the message with her private key and then the public key of the sender. PGP done this automatically.

Since all previously known asymmetric algorithms work much slower than heretofore conventional encryption algorithms, it offers to use the actual encryption  to make a good and fast conventional system. PGP generates for each Ver To do this, you encrypt a randomly selected key that uses only once and encodes the message. Then this disposable key comes with encoded the public key of the recipient and hineinge into the encrypted message wrote. The recipient can now use his private key to use the disposable key restore and decipher the entire message. This whole process is for the Benut not visible.

Many people have wondered if using an asymmetric procedure rens does not affect the security of PGP. If the fastest way to break IDEA If you want to test all sorts of keys - and that's what it looks like - then you're up in order to break an IDEA encryption, roughly comparable to an RSA Factor of 3100 bits to factor. IDEA should not be regarded as a vulnerability in PGP hen. The big advantage of asymmetric methods like RSA is not in the security that they offer, but in the enormous simplification of the keys. The usage of IDEA for the actual encryption does not weaken PGP. (The method of coupling a symmetric and an asymmetric method (Hybrid procedure), is quite common. A pure RSA encoding would even have security issues to bring oneself. In addition, the encryption of a message to multiple recipients would not be more readily possible.)

The keys are kept in so-called "key certificates", which are other than the key even a short text with the name and web address of the "owner" and the note, when the key was generated. The text with name and network address will appear in following "user ID". "Public key certificates" contain the public keys, while "secret key certificates" include the private keys. Private keys are with a mantra because they could be stolen. PGP uses two files in which the keys are kept, one for the public and one for the private. These You can compare files with a keychain.

Furthermore, each key has an identifier consisting of the last 64 bits of the key, of which only the last 32 bits were displayed, eg. Eg 6ce93239. This identifier is used PGP internally to distinguish the keys from each other. Two different keys can have the same user ID, but the identifier is in all likelihood always ver  eliminated.

To sign messages, PGP uses a "message digest", a method to dial out generate a 128-bit number for a message that determines the message clearly enough, thus a change or a rewriting with the result of an equal value prak impossible. This number is used, similar to a CRC checksum, to change diagnoses of the message. Then this 128-bit number is added to the coded private key. The encrypted number will now be together with the key identification and a note of when the signature was made to the message attached. The recipient's software searches for the key in the public keyring sel of the sender, checking the signature. The algorithm used in PGP is called "Message Digest 5" (MD5).

Likewise, the recipient's software decrypts incoming messages automatically. at this is also set to the beginning of the message, the key identifier. PGP is looking in the file with private keys for the appropriate key and decrypts automatically the message.

random numbers

PGP uses a cryptographically reliable pseudo-random number generator to generate wech Create separate keys for conventional encryption of individual files. The File that contains the seed for the random number generator is called randseed.bin. you should be in the same directory as the other files needed by PGP the environment variable PGPPATH is specified. If the file does not exist, it will automatically generated. It receives a starting value from real random numbers, which from the temporal Distance derived from keystrokes.

The file randseed.bin gets new data each time the random number generator is called written, including the current time and other real random data. in the Random number generator uses the conventional encryption algorithm IDEA. The file randseed.bin should be protected at least a little before reading, to minimize the risk that an attacker will generate the next keys that generate PGP or the last keys that PGP has generated. This attacker would have Hard work to do, because PGP randseed.bin the file before and after each user cryptographically "in short supply". Nevertheless, it is no inappropriate caution make sure that the file does not fall into the wrong hands.  

Readers to whom these algorithmically derived random numbers are scary should not ver that they trust the security of the same conventional encryption algorithm, to encrypt a message. If the algorithm for encryption is secure enough is, it should be sufficiently reliable to generate random numbers that are conventional Make a key. It should also be noted that PGP is used to generate a pair of public and secret keys that are supposed to be secure for a long time, using real random numbers, which are essentially derived from the intervals of keystrokes.

The generation of pseudo-random numbers, that is, numbers that look "random", the but being derived from an algorithm is a difficult task. Because of the "good randomness" is also used in applications that have nothing to do with encryption like statistics or numerical math, like to have an encryption algorithm used to generate random numbers. The problems with encryption and the Generating random numbers is similar: in both cases, it's about bit sequences generate as few systematic as possible. In the case of encryption these are bits followed by the encrypted text, in the generation of random numbers, the bit sequences are just the random numbers. Readers facing the use of the file randseed.bin despite this Arguments are scary, they can still just before each launch of PGP delete rule. However, they will then have to roughly each time for the encryption of a plaintext Perform 90 keystrokes to generate a true random number.

The conventional encryption algorithm in PGP

As mentioned earlier, PGP uses one to encrypt plaintext fast conventional encryption algorithm. The public-key worker This algorithm is only used to match the current message used for a message Encrypt the original key so that it is encrypted together with the encrypted message can be sent. In the following we will talk about this algorithm.

The Federal Data Encryption Standard (DES) is a good algorithm for most kom mercial applications. However, the US government does not rely on DES for its own purposes to protect secret data. Perhaps the reason is that the key at DES is only 56 Bit long, short enough for a "brutal force" attack involving a special machine which consists of a variety of DES encryption chips that are simply all 256 possible keys "tried". Also, Biham and Shamir recently had some success  when attacking a full 16-round DES encryption. ("16 rounds" means that the DES algorithm is used sixteen consecutive times for the Ver the same data block is used, so to speak, a 16-fold Ver encryption. These 16 rounds are standard at DES; the following IDEA Encryption uses 8 rounds.) On the 'Crypto '93 conference "Michael Wiener presented a study like DES with a specially developed Machine to crack. He has developed a special chip that has 50 million per second Key tried until he finds the right one. These chips could be for just under eleven dollars The piece could be built, a machine for the price of a million dollars could all Try out the possible DES key within seven hours. That would make a through average search time of 3.5 hours.

PGP does not use DES for conventional encryption. Instead, another, also uses a block-oriented one-key algorithm called IDEA (TM). A future version of PGP could optionally support DES if enough users ask for it But I suppose IDEA is better than DES.

For the cryptographically interested: IDEA uses 64-bit long blocks for plain text and encrypted text with 128 bit long keys. The algorithm is based on the concept the mixture of operations of different algebraic groups. A software implementation IDEA is much faster than a DES software implementation. Similar to DES can IDEA for cipher feedback (CFB, return of encrypted text) and for Cipher Block Chaining (CBC) is used to link blocks of encrypted text the. PGP uses IDEA with 64-bit CFB.

The IPES / IDEA encryption was done at ETH Zurich by James L. Massey and Xuejia Lai developed and published in 1990. IDEA is not a development from the craft cellar. His Developers have an excellent reputation among cryptologists. In her first publication They called the algorithm IPES (Improved Proposed Encryption Standard, Proposal for an improved encryption standard), later they changed the name to IDEA (Interna tional Data Encryption Algorithm, International Standard for Data Encryption). Til today IDEA has withstood cryptanalytic attacks much better than other methods like FEAL, REDOC-II, LOKI, Snefru and Khafre. There is initial evidence that IDEA the highly successful differential cryptanalytic attack of Biham and Shamir we  considerably better than DES. (Since IDEA was changed after the release of differential cryptanalysis This is not so surprising.) Biham and Shamir investigated IDEA unsuccessfully Vulnerabilities. Academic working groups of cryptanalysts from Belgium, England and Germany seeks attack possibilities with IDEA, likewise military secret services meh European countries. The more and the longer this new algorithm attempts to attack The dreaded working groups of the cryptanalytic world are attracting more and more the confidence in him.

The exclusive use of RSA with long keys is because of the long rake time is not really useful for encrypting and decrypting large amounts of data. That makes absolutely nobody in real life. Nevertheless, the question is obvious, if the combination of a Encryption with public keys and a second, conventionally working ver The overall security is minimized, and this is only to make the program faster chen. After all, a chain is only as strong as its weakest link. Many people, the little Have experience with cryptography, believe that RSA is inherently safer than a conventional encryption. That's not true. RSA can be easily cracked, "soft" keys are easily vulnerable, on the other hand, conventional closures be very sure when choosing a good algorithm. In most cases it is difficult to say exactly how good a conventional encryption is, without really cracking it. A good conventional algorithm could be harder to crack than an RSA Key to military standard. The attraction of encryption with public keys It is not that they are inherently safer than conventional encryption is - their charm consists in the much more convenient and versatile handling of the keys. People who are professionally involved in exploration of factoring algorithms say that trying out the 2128 possible keys for IDEA from the computational ago Factoring an RSA key with 3100 bits. That's way more than the 1024 bit, which allow the RSAREF routines used in PGP 2.6. If we assume that IDEA does not contain any special vulnerabilities, is the weak point at which a kryptoanaly attack, RSA and not IDEA.

Also, using a pure RSA algorithm may require additional constellation give starting points for an attack.  

data compression

Normally, PGP compresses the plaintext before it is encrypted. Encrypted data can not be compressed anymore. (That's because well-encrypted data looks very "random", compression However, algorithms are based on recognizing and determining a specific classification in the data Based on this system, a shorter representation of the data search.) The compression saves transmission time and Hard disk capacity, and, more importantly, it increases the security of the encryption. The Most cryptanalytic techniques assume the redundancy of the plaintext to the Crack encryption. Data compression reduces the redundancy of the plaintext, and thereby significantly increases the security against cryptanalytic attacks. The data Compression costs some computing time, but from a security standpoint, that is justified, at least in my humble opinion.

Files that are too small for compression or that do not compress well, are not compressed by PGP.

If necessary, you can also use PKZIP or another data compression program to compress the plaintext before encryption. PKZIP is a widespread and PKWare Inc.'s efficient compression program for MS-DOS as shareware is sold. Or you can use ZIP, a PKZIP-compatible freeware program for Unix and other operating systems, available from Jean-Loup Gailly. The use of PKZIP or ZIP has advantages in certain circumstances because these programs are unlike PGP are able to combine multiple files into a single compressed file. When decompressing, of course, the individual original files are generated again. PGP does not try to recompress an already compressed plaintext file The recipient of such a compressed file must use it after decryption Decompress PKUNZIP. If the decrypted plaintext is a PKZIP-compressed file PGP automatically detects this and reminds the recipient that it is likely is a PKZIP file. (Other packers such as arc, zoo, and lharc will also be detected automatically.) GIF8 images will not be packed anymore, etc.)  

It should be noted that the current version of PGP includes the freeware compression routines written by Jean-Loup Gailly, Mark Adler and Richard B. Wales. This ZIP Routines use algorithms that are functionally equivalent to those of PKZIP 2.0 PKWare are. They were essentially built into PGP because they ported as well C source code is available, because they compress really well and because they are fast are.

Peter Gutmann has a nice compression and archiving program called HPACK written by many ftp servers on the Internet. HPACK encrypts com primed files using the PGP file format and PGP keyfiles. He asked me to draw your attention to HPACK at this point.

Text checksums and digital signatures

To create a digital signature, PGP uses the secret key, but not for the "coding" of the entire text, that would cost too much computing time. Instead PGP encodes a "text checksum" with the secret key.

This text checksum is a small, 128-bit "distillate" of a message, from the idea similar to a checksum or a CRC sum. You can get the text checksum as well as a kind of fingerprint imagine the message. The text checksum "represents" the Message in the sense that every time the message is changed, another text check sum for the message. At the text checksum can thus be seen, whether a Counterfeiters at the message to create. The text checksum is encrypted by a crypto graphically reliable one-way hash function calculated. (A one-way function is a function in which there is no possibility or impossible It is known from the function value on the function argument. A Hash function is a function that allows a large set of function arguments as possible evenly on a comparatively small amount of functional values.) A counterfeiter can because of im mensen computational effort required to produce no second message, the same text Check sum as the original message has. In this regard, the method used in PGP to calculate the text checksum much better than the usual checksums or CRC sums, where it is easy to have a second message for a given message find that has the same cross or CRC sum. On the other hand, from the text check sum as well as calculated from a cross or CRC sum the original message become.  

The text checksum alone is not enough to control the authenticity of a message. The algorithm for their computation is well known and does not use a secret Key. If you just added the text checksum to the message, a Fäl scher change the message and recalculate the checksum for the changed message. For a reliable control of the authenticity of a message must be the sender with the checksum encode their secret key. Only then does an authentic signature emerge. The text checksum is calculated by the sender's PGP program in a message. The digital signature is created by the sender having the text checksum and the Timestamp coded with her secret key. The sender sends message and digital signature to the recipient. Its PGP program determines the text checksum, by decoding the digital signature with the sender's public key. to Control the text checksum is calculated from the received message. If the from the Message calculated checksum and the checksum contained in the signature It is guaranteed that the message has not been changed and that it has been changed by the one Person whose public key was used to verify the signature. A counterfeiter would have to change the message either so that the text checksum remains the same, which is virtually impossible, or he would have to use the modified text checksum a new digital Generate signature, which is not possible without the sender's secret key. A digital signature proves who sent a message and whether the message was changed, whether due to a technical error or deliberate. Likewise prevented that a sender can deny the signature under a message.

The use of the text checksum for the digital signature has in addition to the speed even more advantages compared to coding the entire message with the secret Key. The signatures are all the same short length, regardless of size the message. They allow the software to automatically control the cor rectality of a message, similar to cross or CRC sums. The signature can be separated stored by the message, even in a public ar, if necessary chiv without disclosing confidential information from the message because it is impossible from the knowledge of the text checksum, something about the content of the message determine.

The algorithm used for the calculation of the text checksum in PGP is MD5 (Message  Digest 5), released by RSA Data Security Inc. for public domain use. Ronald Rivest, the developer of MD5, writes about this in RFC 1321 in April 1992: "It can be assumed that the computational effort, two messages with the same text checksum is on the order of 264 arithmetic operations, and that the arithmetic wand to generate a message with a given checksum, on the order of magnitude of 2128 operations lies. The MD5 algorithm is carefully focused on vulnerabilities been searched. On the other hand, he is relatively new, so that a further analysis of his Si of course, just as with any new project of this kind. The degree of Security offered by MD5 should be sufficient to work with RSA to provide a high level of security Implement systems for digital signatures. "

No data security system is unassailable. The security of PGP can be in many ways be leveraged. In any data security system, users must assess whether the Data that should be protected, for which the attacker has so much value that for him the Worth the effort of an attack. This may well lead to the decision just before to protect simple attacks without worrying about elaborate attacks. The following discussion may seem paranoid at times, but such an attitude is quite appropriate for a sound discussion of possible attacks.

Known mantra and known secret key

Probably the easiest way to attack arises, if one the mantra for the writing down secret keys somewhere. If anyone can read this mantra and then him even if the file with the secret key falls into the hands, he can encrypt all Read messages and use the secret key to generate fake digital signatures. Obvious passwords that are easy to guess - such as the names of Kin or the partner - are unsuitable. A single word as a mantra can also be easy when a computer spells out the words of a lexicon as passwords brew until the right one is found. That is why a combination of several words, from us Mantra, much better than a simple password. A refined attack could to have a computer work through a lexicon with famous quotes in order to to find the mantra. An easy-to-remember but difficult to guess mantra is comfortable from a few creatively meaningless sayings or widely unknown literary quotes mens tellen.  

Forgery of the public key

One of the most dangerous ways of attacking is the public key can be faked. This is the really significant and serious starting point for this Cracking of encryption with public keys, partly because the Most newcomers do not recognize the danger immediately.

In summary: If you have a public key for the encryption of an After or to use for the verification of a signature, it must be ensured that he does not is fake. The authenticity of a newly obtained public key should only then Trust if you have received it directly, safely, from its owner, or if its authenticity is confirmed by someone you trust. You also have to make sure that no stranger can make changes to their own public keyring. One needs physical control over both the federal government with public keys like also about the covenant with secret keys. These two files are best kept on your own PC, a lot worse on one end even spatially far away ten multi-user computers. In any case, you should backup copies of the two key files to have.

Protection against counterfeit time

A not easily understandable vulnerability of PGP affects dishonest users who fake dates for the confirmation of their public keys and their signatures use. Readers who use PGP only occasionally and with the snares of public keys are not very familiar, you can skip this section.

Nothing prevents a dishonest user from setting the date and time on her Change their key confirmations and at this wrong date setting To generate signatures. So this dishonest user can make it appear as she did a signature much earlier or later than she actually did, or as she has her pair of public and secret keys at another time riert. This can be of legal or financial benefit. For example, it can create a loophole so that you do not have to recognize a signature.

Generally, trusted institutions or notaries could offer remedies that are notarized can make certified signatures with a trustworthy time stamp. This sets not necessarily a central institution. In some circumstances, everyone can trust worthy mediators or an uninvolved third person perform this task similarly  publicly appointed notaries. The confirmation of a public key could be from the Notary can be signed, and the timestamp at the notary's signature could juristi gain importance. The notary could lead to such confirmations protocol. The Protocol would be publicly available.

The notary could also confirm the signature of others by his own signature. This could be considered a documentary, evidential signature, as "real existing notaries" with signatures on paper documents for a long time. Also in this case would be the Notary about the signatures record protocol by separating those from the textual document ten signatures archived. The notary's signature would have a trusted Zeitanga be, with greater credibility than the time stamp of the original signature. A signature would by the addition of notarial signature and the minutes of the notary "proof force "received.

The problem of notarised signatures and credible timestamps requires a lot discussion. A good essay on this is the essay by Dorothy Denning in IEEE Computer 1983. The possible procedures for confirmation and authentication still need much be worked out in more detail. This will come from the increasing use of PGP and by the fact that, in other programs, the principle of public key ver Other validation methods are to be developed.

Gaps in physical security

Most safety issues discussed so far arise, even without causing anxiety He has immediate access to the computer on which the data to be kept are stored are chert. Direct access to the computer or printed texts is also conceivable by burglary, searching the garbage, an unexpected or unfounded house sweep chastity, bribery, blackmail or spying. Some of these attacks are likely be affected by basic grassroots organizations largely based on voluntary participation are reliant. The press has reported quite a bit about the fact that the FBI is part of his COINTELPRO program with burglary, infiltration and illegal bugs against anti-war and civil rights groups. Not to mention: the Watergate affair. (The same applies to the Federal Republic - it has spies of the protection of the Constitution and the police already given often. Meanwhile, the discussion of their legal use goes up to the question whether in the future secretly working police officers with offenses also commit crimes allowed.)  

The use of an encryption program can be a deceptive, lulling Feeling of security. Cryptographic techniques only protect data as long as they are encrypted. Holes in the immediate physical security can still disclose plain text data and written or spoken information. This type of attack is simpler and cheaper than a cryptanalytic attack on PGP.

"Tempest attacks"

Another option for a well equipped opponent is the evaluation of the electromagnetic radiation that a computer sends out. Such an attack is expensive and labor intensive, but probably still cheaper than a proper cryptanalysis. On appropriately equipped minibus could be parked near the computer to be monitored and record every keystroke and every screen content. That would be all passwords, Disclose messages, etc. This attack can be warded off by a suitable Abschir the computer, accessories (printer, etc.) and, if necessary, network cabling development. Such a shield is known by the term "storm proof", and is used by used by some government agencies and defense companies. There are companies that have this Abschir However, the purchase may require approval. Where did that come from? well, come?

However, anyone who thinks he should be exposed to such sophisticated attacks should anyway contact a security adviser.

Problems with multi-user computers

PGP was originally designed for (single-user) MS-DOS computers, which can be used immediately has baren access. I use PGP at home on my personal computer, and as long as nobody breaks down or evaluates the electromagnetic signals of the PC, are the plain text files and the secret keys probably safe.

But now PGP is also available for Unix and VAX / VMS, ie multi-user operating systems. With these operating systems, there is a much greater risk that plain text files, Keys or passwords are disclosed. The system administrator or an experienced one dringling can read the plaintext files and possibly also using special software secretly read the keystrokes and the screen outputs. Anyone can do it under Unix User with the command ps get some information about the other users  such as all environment variables. (If someone then pgppass on a Unix multi-seat machine still out of laziness - not to be confused with pgppath! - sets, he exposes his mantra to all other users.) Similar problems exist for MS-DOS-Rech who work in a network. The current security risk depends on the particular one Situation. A multi-user computer can be safe, if you trust all users or when the security mechanisms are sufficient to withstand the attacks of intruders or even if it is simply not enough interested intruders gives. Some Unix systems are safe in that they are used by just one person There are already laptops that work with Unix. PGP completely out of use to exclude under Unix, would be nonsensical.

PGP is not intended to protect data that is plain text on a badly protected or "flown" computers are present. Nor can it be an intruder of it prevent a secret key from being read during its use. These risks must Just to make clear for multi-user computers and the expectations of PGP and the to coordinate their own behavior. But maybe the user has the option to PGP on an "isolated", so not connected to a network single-use PC, the under his immediate physical control.

Statistics of message connections

Even if an attacker is unable to access the contents of the encrypted messages he still has the opportunity to get useful information from where from News comes, to whom they go, how long they are or when they were written. This corresponds to the evaluation of telephone connections without the individual calls to be intercepted. This is meant by "statistics of message links". PGP protects not here. To solve this problem would be specially designed for transmission protocols that may contain cryptographic elements.  (This type of monitoring, which actually also prevents the PGP-prevented Durchsu of the whole. Including post by keyword is probably the most used information source of information available to intelligence services. Basically, PGP can be but also use to disguise this information, but that would go too far here.)  

cryptanalysis

An expensive and difficult cryptanalytic attack could be carried out by an intelligence service which has a sufficient arsenal of supercomputer technology. This Intelligence could use an RSA key using a groundbreaking new, crack secret algorithm for prime factorization cracking. That is conceivable, but one should not forget that the US government to the RSA algorithm so far trusts that with to be assured of nuclear weapons, according to Ron Rivest. And in the civilian area there are since 1978 intensive but unsuccessful attempts to crack RSA.

It is also possible that a government has secret methods of communicating with IDEA (TM), the PGP used conventional encryption algorithm that can be cracked. The would be the worst nightmare of any cryptographer. In practical cryptography there it does not guarantee absolute safety.

But some optimism is still justified. The developers of IDEA belong to the best cryptographers in Europe. The best cryptanalysts of the non-secret world have IDEA undergo extensive analysis and in-depth review. A differentiel If cryptanalysis, in which DES was almost cracked, seems to be better for IDEA. But even if IDEA should have one or the other subtle vulnerability compressed PGP the plaintext before the encryption, what the emanating from such a vulnerability Danger to reduce a lot. The amount of computation required to crack should in most cases be a lot higher than the value of the decrypted message. When you are in a situation where the fear of such an attack is of the highest caliber It is time to call on the services of a security adviser who can offer solutions tailored to the respective situation. Boulder Software Engine ring offers these services. Address and phone number are attached.

In short, an adversary can effortlessly, even routinely, listen to data communications especially if a modem or e-mail is used, unless the data is good kryp tographically protected. When using PGP and the necessary precautions Attention, an attacker has to spend considerably more work and costs in order to protect the privacy to break in.

If you can protect yourself from simple attacks and assume that you are not one faced with determined and well-equipped attackers, then the Verwen be sure of PGP. PGP ensures a well-protected privacy.  

Web of Trust or "How Does the Web of Trust?"

If someone wants to use public keys to do encrypted communication, he needs to be able to do two things:

• 1. The public keys of his communication partners are real.
• 2. his public key can not be forged.

That's why the Web of Trust starts with key generation.

forgery

When generating a key, your own public key is signed with your own secret key.

If you look under PGPkeys, there are two more entries under the key symbol, the first entry is preceded by a symbolized envelope and stands for the user ID, the second entry is preceded by a pen or pen tip and stands for the Signa door.

If you look at the "Key Properties" of your own public key, you notice one thing:
Both the "Key-ID" and the "Key-Fingerprint" are the same for the keypair, the user ID and the signature.

Let's control the public key of a communication partner (whatever the case may be must), the result must look the same, otherwise the public key is forged.

So PGP itself signs our own public key to prove that the Public Key with this special Key-ID and User-ID with the right Secret Key unterschrie ben, the propagator of the public key with user ID wx and key ID yz owned by the fit the secret keys and the matching passphrase.

In addition, the own signature includes further features of the key such. B. the valid duration, which are not contained in the fingerprint of the key and confirms its affiliation of the keyholder name in the user ID wx to the key with the key FD "yz".

The IDs of the signature are not editable, as is possible with the public key, so that the Key by the self-signature also before changes (with the exception of further signatures ande rer user, which I can not prevent or sign again) is protected.  

forgery way

• A) The counterfeiter provides the original public key with his user ID / e-mail address and to avoid attracting attention he removes all signatures.
  Since the keyservers can store only once a key with a specific Key-ID, the counterfeiter can try to put the key on the keyserver before the originator's original key, so that the creator is no longer able to match the original, generated key deposit.
  The fake is striking, because the key has no signature.
  It is conceivable that the counterfeiter creates a signature and falsifies their fingerprint, but then the fake key differs from the original, signed key in length.
• B) The counterfeiter creates a new public key that carries the user ID and the key ID of the original key of the attacked party and provides the key with his signature and possibly with his e-mail address.
  From the point of view of the counterfeiter this hopes that people will assume that this key belong to the original user and use this key to encrypt e-mails to the actual recipient.
  The counterfeiter can now switch between the bona fide sender and the actual receiver, intercept the correspondence and decrypt it.
  If the e-mail address of the key has been replaced by the address of the counterfeiter, he can even save himself this step and receive the e-mails directly.
  Otherwise, the original recipient receives the e-mails but can not decrypt them.
  If the fingerprint was not forged, the forgery can be recognized by the different fingerprints of key and signature.

Further information on the dangers of counterfeiting can be found in the sections:

PGP Attacks Self-signature (Selfsign)

What becomes clear is that one can only assume the authenticity of a key with certainty can if the combination of keylength, the ID's, the fingerprints and the signature  true and this combination was personally checked by the key owner.

Thus, while it can not be ruled out that someone fakes a public key, but that he can do this undetected.

Validity

The authenticity ("validity") of a public key is "witnessed" by the signature of other users. We can provide another public key with our own signature.

In PGP 5/6, this key is immediately "valid", i. H. "valid" or "authentic".

As long as he is not signed by us, the key remains basically "invalid" or "not As a result, the owner of the key also remains as "untrusted" or "not trusted With the signing we testify that we have convinced ourselves that this Public key really belongs to the specified user or otherwise:

We know with 100% certainty that the public key is genuine, whether under This key already signatures of people we trust or who we know are.

For this purpose, we already check, as stated above, the already existing Public key on discrepancies.

Then we check personally or by phone the information provided by the key (user ID, Key-ID, Fingerprint, Keylength, Keytyp) based on the information provided by the contact on An question returns.

Additionally, one or more of the keys located below the key may be in the same manner Signatures be checked.

Ideally, it would be assumed that every PGP user does so ideally all public keys are real.

Since we know the reality, every PGP user can figure out which controls he has and how responsible he has to act.

In addition to the signatures of other users, the certificates of CA's play a much more important role. Reputable CAs must comply with the Signature Act and the Signature Ordinance, d. H. on work in accordance with the law and issue certificates.

Therefore, CA certificates have a more binding and trustworthy character than Signatures of other users and one should endeavor, at least one certificate of a recognized CA for your own key.  

Trust

In addition to the "validity", PGP 5/6 also has another internal "trust" scale to offer our assessment of the key owner relates. The "trust" or "degree of trust" exists in three Levels ranging from "untrusted-untrusted" to "marginal-limited trustworthy" to to "complete-fully trustworthy" to what extent the trust in the responsible Han and the ability of a key owner exists, in turn, for the "validity" of a to beget other public keys.

At some point you get a public key, which is provided with the signature of a person who even if you sign a PGP user that you have classified as "Trust", it becomes this one Public Key accordingly classified as valid, even if you do not have this new key itself signed.

Note: The trust level of a PGP user can only be rated higher than "untrusted", if you signed the key of this user yourself. Thus, the trust in a user depends from the validity of his key.

In other words: a key can be "valid", but the user can not be "trusted" his.

The configuration of the "Web of Trust" in PGP 2.6.3: is achieved by assigning its own Signa and / or the awarding of one of four trust levels.

PGP 2.6.3 recognizes the following levels of self-identification of trust in the person's sincerity and competence in dealing responsibly with both their own and other PGP keys:

• - 1 = I do not know
• - 2 = no
• - 3 = usually
• - 4 = Yes, always

via which one can regulate the file config.txt in two entries the own area of the Web of Trust:
Completes_Needed = X
PGP then considers a public key as genuine if it carries X signatures,
whose users have the trust level 4
Marginals_Needed = Y
PGP then considers a public key as genuine if it carries Y signatures,
whose users have the trust level 3.

For direct setting of the trust parameter in PGP 2.6.3 for a user:

Certification Authorities

Another, new approach is provided by the so-called certification bodies ("Certification Authorities "/ CA), ie recognized institutions, organizations, companies or associations that the affiliation between the identity of a person and a public key according to specific Certify testing and inspection procedures with a certificate.

This eliminates the somewhat complex and burdened with uncertainties way of collection signatures under their own public key and the need for personal contact Recording with the key owner if you want to certify another public key.

But even with the CA's it is usually necessary to personally with the identity card or even a notarial confirmation to certify their own public key or the keypair must be in a secure procedure directly in the CA by the key owner be generated.

But there are also certificates that are issued when the keyholder has an encrypted rarely test sentence, which the CA sends him after request, can decrypt and then again by E-mail sent back to the CA (e-mail certificate) or the CA additionally requests the Auswei to a known public office such as a post office (Post-Ident Certificate). So there are different "quality levels" for certificates, but also from the name certificate.

The advantage of the CA signature lies nevertheless in the general degree of familiarity and degree of confidence, which makes it easier to trust a public key that has a CA signature than a public key that was signed by a person whose name I did not know is. The importance of CA's is therefore with an increasing number of PGP users increase.

Examples of CA's

• - the PGP-CA of the magazine c't
• - the PGP 2.6.3in CA of the Individual Network
• - the DFN-CA of the German Research Network
• - the company TC TrustCenter for Security
  TrustCenter offers certification free of charge to individuals by e-mail ("e-mail certificate") or in combination with a certified letter ("certified e-certificate").
  At the end of the year, keys with the pseudonym User-ID's can also be certified.
• - the CA of GeFoekoM e. V./AK data protection

For more information on PGP certification and brief information on the CAs you can find About Skylla: PGP Key Certification by Alexander Svensson The state also thinks about the establishment of these certification bodies, on their own and in their own right through licensing, but this idea is often with the deposit of a "master key" at government agencies or "Trusted Third Parties" (TTP) or "TrustCenters", the soge called "Key Escrow" (in the case of PGP, one could also say: deposit of Secret Key and passphrase), with the help of which state organs, such as the secret services, encrypted files or e-mails after a legal approval process at Ver can decipher again or with the authorization of encryption programs, which allow the encryption key used in the encryption to be restored to be able to provide so-called "key recovery".

An intermediate form represents CA's which at the same time have the characteristics of the TTP's, i. H. the Key pair is generated in the certification authority and the applicant on one SmartCard, the public key is set to a public directory, but the private key also remains (at least for the key generation period) in the certification authority and makes it so to the TTP - this includes z. B. the D-Trust GmbH and the Telesec.

TTP's and their mixed forms are fundamentally to be rejected, since the private key in the Einrich remains.

With this form from CA and TTP / TrustCenter I personally have a completely different one Suspicion. , , and Carl Ellison from the company CyberCash calls these ideas by name: "Govermental Access to Keys (GAK)".

In addition, the security of the public key, the secret key and the passphrase must be taken care of the.

Safekeeping of pubring, secring and passphrase is one of them.

An additional gain in security may be the weekly or monthly change of the passphrase, which further complicates the guessing / guessing of the passphrase, assuming that this process takes some time and some computing resources. It is also useful, immediately after the creation of public and secret key, to generate the key withdrawal certificate ("key revocation") for the public key and save it secured. This has the advantage of being able to immediately send the key revocation to a keyserver and inform the communication partners if the secret key and / or the passphrase has gotten into the hands of others (whichever happens if this happens). What is even more important:
If, for whatever reason, the key owner is no longer in possession of the secret key and passphrase, he can withdraw his public key.

Key certificates or "How do I sign the public keys of other people?"

Prerequisite for signing other public keys is reading the chapter "Web of Trust".

method Calling PGPkeys

• a) Menu "Keys-Sign" or
• b) Select 1 × MKrT on the relevant key and in the context menu "Sign" Click on the button "More Choices"

Signing options (Signature Type)

• - Non-exportable
  in the case of a non-exportable signature, the signature remains only in its own pub ring; it is not transferred when the key is stored, inserted in an e-mail message or sent to a keyserver.
  You should choose this signature, if you want z. B. already maintains a long-term e-mail traffic with a person and is then quite sure that the key belongs to the key owner and therefore wants to see the key in the PGPkeys Window and the confirmation windows as real.
• - Exportable
  The exportable signature is the actual signature in the traditional sense, as we know it from PGP 2.6.3.
  It is transmitted when a key is stored, when the key is sent by e-mail or to a keyserver, and thus confirms to the public that the key really belongs to the key owner and is not fake. For this reason, the principles of the "Web of Trust" must be observed and applied when selecting the exportable signature!
• - Meta-Introducer Non-Exportable and Trusted Introducer Exportable through our signature becomes the key of a meta-introducer (supreme, trusted guarantor) and the keys that the meta-introducer signs to Trusted-Introducers (trusted guarantor). Ie. the Meta-Introducer receives our full trust (Trust) and its key full validity (Validity).
  The signature of the meta-introducer is not exportable because it has a prominent position and its function must remain within a closed framework (such as the network of a company or our pubring). His signature (and thus his characteristics) through our signature, the meta-introducer can virtually "inherit" to other people, or keys (the Trusted Introducer) by signing, so that all the keys that the meta-introducer signs fully valid (valid) and the key owners enjoy our full trust, the Meta-Introducer "acts" so to speak "substitute" for ourselves.
  Trusted Introducers can not pass on this property, but vouch for the validity of Public Keys (Validity) on behalf of the Meta-Introducer.
  In the PGPkeys window, under the key of the meta-introducer, our signature with the description: "RSA, DH / DSS meta-introducer signature" can be found at the Trusted-Introducer "RSA, DH / DSS trusted-introducer signature".
  The signature of a Trusted-Introducers is exportable, ie it can also guarantee the validity of other public keys outside of our closed framework, however, one can limit the Domainbereich, in which he can vouch for Keys, in which one under "Domain restriction" the E -mail Enter the domains of the keys.
  But if we now get a public key that has been triaged by a trusted introducer, the new key is immediately valid (valid) without us having checked or signed the key ourselves.

Expiration (expiration date)

Here you can specify whether our signature is always valid (never) or too a particular date should be invalid.

Enter the passphrase

It is possible with PGP 5/6 to provide an RSA public key with a DSS signature. For reasons of compatibility, however, one should also use an RSA public key with an RSA Sign the key.

After signing, the signed key can be sent to the owner and / or the keyserver depending on the type as in the explanations of the previous chapters.

The concept of hierarchy of meta-introducer and trusted-introducer targets areas in the large amounts of public keys and various domains, from which these Keys come, need to be managed.

So it would be conceivable that the personnel manager or authorized officer of a company by the management appointed the Meta-Introducer and the HR Manager then his immediate subordinates, z. B. makes the department heads to trusted-Introducern.

Or, as a meta-introducer, the chief sales manager appoints the area sales managers to trusted Introducers.

For a local pubring on a single-user PC, this concept is oversized, since one is actually the meta-introducer.

However, it may be useful to use the certification keys of recognized or known Certification Authorities whose validity is based on the principles of Web of Trust and their certification technique is trusted, with a trusted To equip the Introducer Signature, which eliminates all current and future public keys issued by have been certified, are immediately valid and will no longer be reviewed by us have to.

Claims (1)

The present invention is a method and apparatus for effective bilateral buyer led business. The present invention allows future buyers of goods and service the global distribution of binding buy requests to potential sellers, for Ver Buyers the convenient search for relevant purchase requests, and for sellers possibly a brew on the basis of the purchase request from the buyer to bind a contract. In a structure beinhal tet the device of the present invention, a control mechanism which bindli purchases from prospective buyers. The control mechanism makes the purchase requests available globally for potential sellers. Possible sellers then have the option of buying request to accept and conclude a contract with the appropriate buyer. The method and apparatus of the present invention is both on the Internet and above conventional communication system such. B. Telefax applicable.