Securing E-mail (PGP)

Computer Network & Network Security System — Network Security, NEC licence examination syllabus (Nepal Engineering Council).

Securing E-mail: PGP

Email was never designed with privacy in mind — PGP retrofits it on top.

PGP (Pretty Good Privacy) combines several techniques covered in this chapter into one practical email security tool: it uses symmetric encryption for the actual message body (fast), asymmetric encryption just to securely share that symmetric key (solving the key-distribution problem), and digital signatures for authentication — essentially a real-world showcase of everything you've learned so far, applied to email specifically.

💡 One-liner: "Why does PGP use BOTH symmetric and asymmetric encryption together?" → Symmetric encryption is fast for the actual message; asymmetric encryption safely delivers the symmetric key without needing a pre-shared secret — combining both gets speed AND secure key exchange.

Why the hybrid design is forced, not chosen

PGP's combination looks like a convenience. It is closer to a necessity, and the reason is a hard constraint of RSA rather than a matter of taste.

Asymmetric encryption is not merely slower — it is typically hundreds to thousands of times slower than symmetric encryption, and it can only encrypt data smaller than the modulus. Encrypting a large attachment with RSA directly is impractical on both counts. So the message gets a fast symmetric cipher with a fresh random session key, and RSA is used on that key alone — a small, fixed-size piece of data, which is exactly what RSA handles well.

📧 What PGP does to one message

1. Hash and signHash the message, sign the hash with the sender's private key — authenticity and integrity.

2. Random session keyGenerate a fresh symmetric key, used for this one message and never again.

3. Encrypt the bodyEncrypt message and signature with that session key — fast, whatever the size.

4. Encrypt the keyEncrypt the session key with the RECIPIENT's public key, and send it alongside.

The recipient reverses it: decrypt the session key with their private key, use it to decrypt the body, then verify the signature with the sender's public key.

💡 A fresh session key per message matters. If one message's key is ever compromised, only that message is exposed — every other message used a different key. Reusing one key across messages would turn a single compromise into a total one.

The problem PGP does not solve

All of this assumes you have the correct public key for the person you are writing to. If an attacker substitutes their own key, they can read everything and sign convincingly, and the mathematics will report success throughout.

PGP addresses this with a web of trust, where users sign each other's keys to vouch for them, rather than the central certificate authorities used by SSL. Key distribution — not the encryption — is the genuinely hard part of the problem, and every practical system has to answer it somehow.

Syllabus points

PGP services and operation

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.