Resources
PGP encryption and secure FTP technologies have become standard tools in securing data both at-rest and in-transit. When sending files or receiving files with confidential information, both the sender and the recipient of files must use the same security technologies. If a sender uses a public PGP key to encrypt a file, then the recipient must use the matching private key to decrypt the file. Similarly, if a secure FTP client uses a particular protocol (e.g., SSH, TLS, or SSL), then the FTP server must also support those same protocols.
Implementing a PGP encryption and secure FTP file transfer solution means that you will be compatible with many of your trading partners. All Diplomat Transaction Manager products are compatible with the OpenPGP and the secure FTP standards.
PGP was originally developed by Phil Zimmermann at MIT in the early 1990's. Today, PGP encryption is based on an OpenPGP IETF standard that defines formats for encrypted messages, signatures, private keys, and certificates for exchanging public keys.
PGP* products from companies such as PGP Corporation, McAfee (e.g., e-Business Server), and Veridis all comply with the OpenPGP specification. Typically, all OpenPGP-compliant products are compatible with each other:
|
Secure FTP is a broad term that refers to two primary technologies that encrypt authentication information and data files in transit. FTPS generally refers to secure FTP using SSL or TLS for encryption. SFTP generally refers to the use of the Secure Shell or SSH network protocol that allows data to be exchanged using a secure channel.
|
OpenPGP keys, often referred to more simply as PGP keys, are always created as key pairs with a public key and a secret key. The owner of a key pair always keeps their secret key and gives their trading partner their public key.
PGP keys can be used to encrypt/decrypt and to sign/verify files. Digital signatures verify the authenticity of a file's origin and that at the file is intact. A digital signature also provides non-repudiation, which means that it prevents the sender from claiming that he or she did not actually send the information.
|
* PGP Corporation holds the U.S. trademark on the term "PGP".
|
