By William Paul Fiefer (home)

[main menu]

PGP Public Keys

"Don't let your mouth write no check that your tail can't cash." – Bo Diddley

Note: As of September 16, 1999, the U.S. restrictions governing strong encryption have been relaxed. The information in this piece, which I've had on the Web in one form or another since 1993, is of historical interest only. If you are here out of an interest in PGP, the University of Illinois at Urbana-Champaign hosts an excellent PGP resource page. For instant gratification, grab a copy of PGP at The International PGP Home Page and start protecting your privacy now. Browse a few of my links for additional privacy tips and tools. You only need to read further if you want to see how foolish politicians and bureaucrats can be. (As an example, until U.S. cryptographic restrictions were relaxed, it was a Federal crime to transfer this MIDI audio representation of the RSA cryptographic algorithm outside the United States. If you decide to audition this peculiar, ragtime-like tune, press your ESC key or close the player applet to silence it.) My public encryption keys directly follow this essay.

Bang!

I became an arms trafficker in 1993. In 1996 I appeared on a list of known arms traffickers. If you don't want someone reading your email without your permission, you might be an arms trafficker, too.

I support the right of U.S. citizens to use strong encryption, a technology the U.S. Department of State regards as a munition. Any U.S. citizen distributing strong encryption software is defined as an arms trafficker if the encryption method is sufficiently powerful and if they transport that encryption tool outside the United States and Canada. Shipping a well-made Commander Billy software secret code ring to my pal in Tokyo for private email can land me in the same prison as someone shipping W-88 warheads to China or F-16s to Libya.

The law is rooted in the wartime perception that letting cryptographic techniques get free of U.S. control allows our enemies to talk bad about us behind our backs without us knowing about it. If that argument makes sense to you, you should know that our enemies can get hold of extremely secure cryptographic tools from nations other than America. Plenty of rock-solid encryption algorithms are developed abroad and openly analyzed by academics who pronounce them fit to use. What the U.S. law does is prevent U.S. citizens from using encryption technologies in their daily emails.

American business doesn't like this restriction one bit. And this isn't an instance of good capitalism overriding a better patriotic sense. When businesses transfer money electronically or hide corporate data from competitors, they need real security tools, not cutdown versions of solid code used openly by European or Asian corporations.

If you're a U.S. citizen, you should object to this restriction, too. Using encrypted email doesn't make you a sleazy person any more than putting your letters in an envelope means you have something to hide. Or do you mail every piece of your correspondence using post cards?

The Department of State is slowly coming to its senses regarding openly available security technologies in a time when the wires carrying everything about our lives can be reached from anywhere in the world. The FBI is still asleep on this point, as are many police agencies, who feel drug dealers will be free to hide their discussions if cryptography is deregulated. Drug dealers already talk to each other with impunity, using European and Asian technology available on the Internet or in any good library. What the FBI and the police really want is to make it easy to snoop on Joe and Jane American. U.S. citizens are not obligated to make that easy for anyone.

The best freely available, powerful encryption technology is PGP. It was developed with the help of faculty members from MIT. You can find it using any search engine (or at The International PGP Home Page). PGP includes other security technologies, including one that thoroughly deletes your computer files. (Deleting files otherwise doesn't get rid of them; it instructs your computer not to display them.) PGP is not a toy. It is a commercial product used by large businesses and governments. The licensing restrictions governing PGP stipulate that it must be available at no charge for non-commercial use. The people who developed PGP wrote this clause because they wanted to make sure people always had good tools to protect their privacy.

PGP is public key encryption. When you use public key encryption, you make a public and secret key and distribute your public key anywhere and everywhere possible. The only thing a public key can do is turn a document into encrypted gibberish. It can't decipher anything. That job is for your secret key, which you keep to yourself and never give away. Your secret key can decode only the gibberish made by your public key. In this way, public key encryption solves the problem of getting your encryption tools to your pen pals without much chance of compromising yourself.

My public keys are below and PGP will read them straight off this file. PGP integrates with your mailer and your computer desktop. PGP will garble messages, wipe the originals completely, and hide data on your computer so no one but you can get to it. If you think these features are for children, wait until one of your executives has their laptop stolen at the airport. PGP is a solid piece of code, powerful enough to already have been the target of a protracted suit by the Federal government. PGP won.

Now you see what it takes to be an arms trafficker. Becoming one this way won't fly you as fast as having an F-16 or make as big a bang as having a W-88, but it will keep you just as safe.