Question

•   What precautions should you take to protect your pass phrase in PGP?

Answer 1

Precautions:

The security plays a important role in every aspect of activity that is done in the various enterprises and organizations.

One must be sure that the file transferred across various sites is safe and secure to avoid any business loss. This requirement paves a way and need for the use of PGP.

Since the beginning, the PGP has been a great tool that is used by these enterprises to encrypt and secure the file transfer across various sites in conducting their businesses and digital signatures.

There are various precautions that are generally taken to avoid the various risks that are prone to occur in the PGP.Some of the precautions are described as shown below.

• The main precaution is to use the public key encryption.The PGP generally uses the symmetric key algorithms in safeguarding the files. But these symmetric keys can be cracked easily using the brute force techniques which makes it vulnerable to attacks.So, it is recommended to use the public key encryption.
• Try to maintain only a few private keys because it is easier to manage if only few keys are present. As the business requirements change, introduce more keys into the system.
• Introduce the concept of life spans to the key pairs. Setting a expiry date for the keys makes the customers regularly update the passwords that increases the security and decreases the damage.
• Maintain the permissions that allow the access to the keys. The most vulnerable things to the attacks are the public keys which can be easily decrypted. Ensure that the private keys are stored in the secure places.
• You may not find it secure to save the private keys on a storage device, but it is essential that you find some storage source that is secure.
• For the approval of client's public keys, create a permanent key. This helps to avoid re-signing the client's keys again when the private key expires.
• Make sure that you the public key of the client is verified and eliminate the main-in-the-middle attacks.
• Never create and store the files that cannot be decrypted. Because there is no point in storing the files that can't be decrypted.
• Permit only the known clients to interact through the firewall. Create a new server to use for the PGP file transfer and make sure that it is secure so that the trusted partners can reach the FTP port.
• Install the anti virus in your system so that all the files can be scanned before and after the encryption and decryption.

These are some of the precautions that must be taken to protect the passphrase in PGP.