THE INTERNET CODE RING!
An Interview with Phil Zimmerman, creator of PGP

We were sitting in a circle on the floor at the Computers, Freedom, 
and Privacy conference, March '93 in San Francisco, St. Jude and I 
with Tom Jennings, Fen La Balme, et al, discussing encryption and 
other neophiliac rants when a dapper fellow wandered by with a 
beard on his face and a tie hanging from his neck. He picked up 
Jude's copy of bOING-bOING number 10 and glanced through it, 
clearly interested. I later learned that this was Phil Zimmerman, 
creator of PGP ("Pretty Good Privacy"), so I tracked him down and 
we talked for the record.

Jon: I'm fairly nontechnical, and I'm also new to encryption. I spent 
some time recently on the cypherpunks' list, and I have a pretty 
good sense of what's going on, but maybe you can tell me in your 
own words how you came to write PGP, and what your philosophy 
is, especially with distribution.

Phil: Well, okay. PGP, which means "Pretty Good Privacy" is a 
public key encryption program, it uses a public key encryption 
algorithm, which means that you can encrypt messages and you can 
send them to people that you've never met, that you've never had a 
chance to exchange keys with over a secure channel. With regular 
encryption, the kind that everybody has heard about, you encrypt a 
message, it scrambles it up, renders it unintelligible, and then you 
send it to someone else, and they can descramble it, decrypting it. 
They have to use the same key to decrypt it as you used to encrypt 
it. Well, this is a problem, this is inconvenient, because how are you 
going to tell them what that key is, what're you going to do, tell 
them over the telephone? If someone can intercept the message, they 
can intercept the key. So this has been the central problem in 
cryptography for the past couple of millenia. There's been a lots of 
different ways of encrypting information, but they all have this 
problem.
        If you had a secure channel for exchanging keys, why do you 
need any cryptography at all? So, in the late 1970s, somebody came 
up with an idea for encrypting information with two keys. The two 
keys are mathematically related. You use one of the keys to encrypt 
the message, and use the other key to decrpyt the message. As a 
matter of fact, the keys have a kind of yin-yang relationship, so that 
either one of them can decrypt what the other one can encrypt. So 
everybody randomly generates a pair of these keys, the keys are 
mathematically related, and they can be split apart like cracking a 
coin in half, and the jagged edges stick together just right. They can 
publish one of the keys, and keep the other one secret. Now, unlike 
cracking the coin in half, you can't look at the jagged edge, and 
figure out what the other jagged edge is going to look like. In fact, 
you can't look at the published key and figure out what the secret 
key is without spending centuries of supercomputer time to do it. 
This means that any time anybody wants to send you a message, 
they can encrypt that message with your public key, and then you 
can decrypt the message with your secret key. If you want to send 
them a message, then you can encrypt the message with their public 
key, and then they can decrypt it with their secret key. Everybody 
who wants to participate in this system can generate a pair of these 
keys, publish one of them, and keep the other one secret. 
Everybody's published key can end up in a big public key directory, 
like a phone book, or an electronic bulletin board, or something like 
that. You can look up somebody's public key, encrypt a message to 
them, and send it to them. They're the only ones that can read it, 
because they're the only ones that have the corresponding secret 
key. 

J: Are there any such directories now?

P: Well, actually, there are starting to be directories like that. For 
PGP, there are some public key directories on Internet. You can just 
send an electronic inquiry saying "Give me the key for 
[somebody]," and it'll send you their key back, their public key. 

J: The convention I've seen has been the inclusion of the public key 
in an email message posted to a mailing list.

P: You can do that, you can include your own public key when you 
send a message to someone, so that when they send you a reply, 
they'll know what public key to use to send the reply. But the 
problem...there is an achilles heel with public key cryptography, and 
I'll get to that in a minute. But first, let me explain authentication. If 
I want to send you a message, and prove that it came from me, I can 
do that by encrypting it with my own secret key, and then I can 
send you the message, and you can decrypt it with my public key. 
Remember I said that the keys are in this yin-yang relationship, so 
that either one can decrypt what the other one encrypts. If I don't 
care about secrecy, if I only cared about authentication, if I only 
wanted to prove to you that the message came from me, I could 
encrypt the message with my own secret key and send it to you, and 
you could decrypt it with your public key. Well, anyone else could 
decrypt it to, because everyone has my public key. If I want to 
combine the features of secrecy and authentication, I can do both 
steps: I can encrypt the message first with my own secret key, 
thereby creating a signature, and then encrypt it again with your 
public key. I then send you the message. You reverse those steps: 
first you decrypt it with your own secret key, and then you decrypt 
that with my public key. That's a message that only you can read 
and only I could have sent. We have secrecy and authentication. So 
you get authentication by using your own secret key to decrypt a 
message, thereby signing the message. You can also convince third 
parties like a judge that the message came from me. That means that 
I could send you a financial instrument, a legal contract or some 
kind of binding agreement. The judge will believe that the message 
did come from me, because I am the only person with the secret key, 
that could have created that message.
        Now, public key cryptography has an achilles heel, and that 
achilles heel is that, suppose you want to send a message to someone, 
and you look up their public key, on a bulletin board, for example. 
You take their public key and you encrypt the message and then 
send it to them, and presumably only they can read it. Well, what if 
Ollie North broke into that BBS system? And he subsituted his own 
public key for the public key of your friend. And left your friend's 
name on it, so that it would look like it belonged to your friend. But 
it really wasn't your friend's public key, it was Ollie's public key that 
he had created just for this purpose. You send a message, you get the 
bulletin board to tell you your friend's public key, but it isn't your 
friend's public key, it's Ollie's public key. You encrypt a message 
with that. You send it, possibly through the same bulletin board, to 
your friend. Ollie intercepts it, and he can read it because he knows 
the secret key that goes with it. If you were particularly clever, 
which Ollie North isn't because we all know that he forgot to get 
those White House backup tapes deleted...but suppose he were 
clever, he would then re-encrypt the decrypted message, using the 
stolen key of your friend, and send it to your friend so that he 
wouldn't suspect that anything was amiss. This is the achilles' heel of 
public key cryptography, and all public key encryption packages 
that are worth anything invest a tremendous amount of effort in 
solving this one problem. Probably half the lines of code in the 
program are dedicated to solving this one problem. PGP solves this 
problem by allowing third parties, mutually trusted friends, to sign 
keys. That proves that they came from who they said they came 
from. Suppose you wanted to send me a message, and you didn't 
know my public key, but you know George's public key over here, 
because George have you his public key on a floppy disk. I publish 
my public key on a bulletin board, but before I do, I have George 
sign it, just like he signs any other message. I have him sign my 
public key, and I put that on a bulletin board. If you download my 
key, and it has George's signature on it, that constitutes a promise 
by George that that key really belongs to me. He says that my name 
and my key got together. He signs the whole shootin' match. If you 
get that, you can check his signature, because you have his public 
key to check. If you trust him not to lie, you can believe that really is 
my public key, and if Ollie North breaks into the bulletin board, he 
can't make it look like his key is my key, because he doesn't know 
how to forge a signature from George. This is how public key 
encryption solves the problem, and in particular, PGP solves it by 
allowing you to designate anyone as a trusted introducer. In this 
case, this third party is a trusted introducer, you trust him to 
introduce my key to you. 
        There are public key encryption packages currently being 
promoted by the U.S. Government based on a standard called 
Privacy Enhanced Mail, or PEM. PEM's architecture has a central 
certification authority that signs everybody's public key. If everyone 
trusts the central authority to sign everyone's key, and not to lie, 
then everyone can trust that they key they have is a good key. The 
key actually belongs to the name that's attached to it. But a lot of 
people, especially people who are libertarian-minded, would not feel 
comfortable with an approach that requires them to trust a central 
authority. PGP allows grassroots distributed trust, where you get to 
choose who you trust. It more closely follows the social structures 
that people are used to. You tend to believe your friends. 

J: Did you make a conscious decision up front, before you started 
programming PGP, that you were going to create something that 
would be distributed in this grassroots way, free through the 
Internet.

P: Well, there were some software parts of PGP that I developed 
some years ago, as far back as 1986, that I developed with the 
intention of developing commercial products with it someday. Over 
the years that followed, I developed a few more pieces that I hoped 
someday to turn into a commercial product. But, when it finally 
came down to it, I realized that it would be more politically effective 
to distribute PGP this way. Besides that, there is a patent on the 
RSA public key encryption algorithm that PGP is based on. I wrote 
all of the software from scratch. I didn't steal any software from the 
RSA patent holders. But patent law is different from copyright law. 
While I didn't steal any software from them, I did use the algorithm, 
the mathematical formulas that were published in academic journals, 
describing how to do public key cryptography. I turned those 
mathematical formulas into lines of computer code, and developed it 
independently.

J: Did you originally intend to license that?

P: When I first wrote the parts of it back in 1986, I did. But I began 
in earnest on PGP in December of 1990. At that time, I had decided 
that I was going to go ahead and publish it for free. I thought that it 
was politically a useful thing to do, considering the war on drugs 
and the government's attitude toward privacy. Shortly after I stared 
on the development, I learned of Senate Bill 266, which was the 
Omnibus Anticrime Bill. It had a provision tucked away in it, a sense 
of Congress provision, that would, if it had become real hard law, 
have required manufacturers of secure communications gear, and 
presumably cryptographic software, to put back doors in their 
products to allow the government to obtain the plain text contents 
of the traffic. I felt that it would be a good idea to try to get PGP out 
before this became law. As it turned out, it never did pass. It was 
defeated after a lot of protest from civil liberties groups and industry 
groups.

J: But if they could get away with passing it, they would still take the 
initiative and try.

P: Well, yeah, actually...it started out as a sense of Congress bill, 
which means that it wasn't binding law. But those things are usually 
set to deploy the political groundwork to make it possible later to 
make it into hard law. Within a week or so after publishing PGP, 
Senate Bill 266 went down in defeat, at least that provision was 
taken out, and that was entirely due to the efforts of others, I had 
nothing to do with that. PGP didn't have any impact, it turned out, 
at all. So that's why I published PGP.

J: Several of my friends are involved in cypherpunks, and I've been 
on their mailing list...are you affiliated in any way with 
cypherpunks? Are you getting their mailing list?

P: I was on their mailing list for a couple of days, but I found that 
the density of traffic was high enough that I couldn't get any work 
done, so I had them take me off the list.

J: The reason I bring cypherpunks up is that they seem to have 
almost a religious fervor about encryption <laughs>. I was 
wondering if you share that.

P: I don't think of my own interest in cryptography as a religious 
fervor. I did miss some mortgage payments while I was working on 
PGP. In fact, I missed five mortgage payments during the 
development of PGP, so I came pretty close to losing my house. So I 
must have enough fervor to stay with the project long enough to 
miss five mortgage payments <laughter>. But I don't think it's a 
religious fervor.

J: I'm impressed with the way encryption in general and PGP in 
particular have caught on with the press, how it's become within the 
last year.

P: Well, PGP 1.0 was released in June of '91. It only ran on MS 
DOS, and it didn't have a lot of the features necessary to do really 
good key certification, which is that achilles' heel that I told you 
about. Theoretically, you could use it in a manual mode to do that, 
but it wasn't automatic like it is in PGP 2.0 and above. The current 
release of PGP is 2.2. It's a lot smoother and more polished that 2.0 
was. 2.0 was tremendously different than 1.0, and the reason the 
popularity has taken off so much since September, when it was 
released, is because it ran on a lot of UNIX platforms, beginning 
with 2.0. Since the main vehicle for Internet nodes is UNIX 
platforms, that made it more popular in the UNIX/Internet world. 
Since Internet seems to be the fertile soil of discourse on 
cryptography, the fact that PGP 2.0 began running on UNIX 
platforms has a lot to do with it's popularity since that version was 
released...Tthat was in September of '92.

J: The easiest way to get PGP is through FTP from various sites?

P: Yeah. Most of them European sites. PGP 2.0 and above was 
released in Europe. The people that were working on it were out of 
reach of U.S. patent law...and not only are they out of reach of patent 
law, but it also defuses the export control issues, because we're 
importing it into the U.S., instead of exporting it. Also PGP 1.0 was 
exported, presumably by somebody, any one of thousands of people 
could have done it...but it was published in the public domain. It's 
hard to see how something like that could be published, and 
thousands of people could have it, and it could not leak overseas. It's 
like saying that the New York Times shouldn't be exported, how can 
you prevent that when a million people have a copy? It's blowing in 
the wind, you can't embargo the wind.

J: And by beginning in Europe, you sort of fanned the flame that 
much better.

P: Yeah.

J: It seems to have spread globally, and I'm sure that you're hearing a 
lot about it, getting a lot of response.

P: Particularly at this conference (CFP93), yes.

J: Do you plan to do more development of PGP, or are you satisfied 
with where it is....

P: PGP will be developed further. My personal involvement is more 
in providing design direction and making sure that the architecture 
stays sound. The actual coding is taking place overseas, or at least 
most of it is. We do get patches sent in by people in the U.S. who 
find bugs, and who say, "I found this bug, here's a patch to fix it." 
But the bulk of the work is taking place outside the U.S. borders. 

J: Is there a Mac version as well as a DOS version now?

P: Yeah, there is a Mac version...there was a Mac version released 
shortly after PGP 2.0 came out. Somebody did that independently, 
and I only found out about it after it was released. People have 
written me about it, and it did seem to have some problems. The 
same guy who did that version is doing a much improved version, 
Mac PGP version 2.2, which I believe should be out in a few 
days...that was the last I heard before I came to the conference. The 
second Mac development group, that's working on a very "Mac"-ish 
GUI, is being managed by a guy named Blair Weiss. That takes 
longer, it's difficult to write a good Mac application, so it's probably 
going to be a couple of months before that hits the streets. 

J: Were you involved in the UNIX version, too?

P: I did the first MS-DOS version entirely by myself, but it's not 
that big a distance between MS-DOS and UNIX, so most of it was 
the same. The UNIX board took place soon after PGP 1.0 was 
released. After that, many other enhancements were added, and 
major architectural changes took place to the code, and that's what 
finally made its way out as version 2.0.

J: You're doing consulting now?

P: That's how I make my living, by consulting. I don't make 
anything from PGP.

J: Do you think you'll just let PGP take a life of its own, let other 
people work on it from here out?

P: Other people are contributing their code, and other people are 
adding enhancements, with my design direction. Perhaps someday 
I'll find a way to make money from PGP, but if I do, it will be done 
in such a way that there will always be a free version of PGP 
available. 

J: I was thinking of the UNIX thing, where everybody's modified 
their versions of the UNIX Operating System so that some 
[customized versions] weren't even interoperable. I was wondering 
if there was a chance that PGP would mutate, whether you're going 
to keep some sort of control over it, or whether people will start 
doing their onw versions of it....

P: Well, I don't know, that could happen. There are so many people 
interested in the product now, it's hard to keep track of everybody's 
changes. When they send in suggested changes, we have to look at it 
carefully to see that the changes are good changes.

J: But you don't have some sort of structure in place where you do 
some kind of approval if somebody wants to make some kind of 
mutant version of PGP....

P: There is a kind of de facto influence that I have over the product, 
because it's still my product, in a kind of psychological sense. In the 
user population, they associate my name with the product in such a 
way that, if I say that this product is good, that I have looked at this 
and that I believe the changes made sense the last version are good 
changes, that people will believe that. So I can determine the 
direction, not by some iron law, not by having people work for me 
that I can hire and fire, but more by my opinion guiding the product. 
It would not be easy for a person to make a different version of PGP 
that went in a different direction than how I wanted it to go, because 
everybody still uses the version that I approved, so to be 
compatible...this has a kind of intertia to it, a de facto standard. PGP 
currently, I believe, is the world's most popular public key 
encryption program, so that has potential to become a de facto 
standard. I don't know what that means in comparison to the PEM 
standard. PEM is for a different environment than PGP, perhaps, 
although the PGP method of certifying keys can be collapsed into a 
special case that mimics in many respects the PEM model for 
certifying keys.