From Pretty Good to Great: Enhancing PGP Using Bitcoin and the Blockchain

Abstract

Abstract. PGP is built upon a Distributed Web of Trust in which a user's trustworthiness is established by others who can vouch through a digital signature for that user's identity. Preventing its wholesale adoption are a number of inherent weaknesses to include (but not limited to) the following: 1) Trust Relationships are built on a subjective honor system, 2) Only first degree relationships can be fully trusted, 3) Levels of trust are difficult to quantify with actual values, and 4) Issues with the Web of Trust itself (Certification and Endorsement). Although the security that PGP provides is proven to be reliable, it has largely failed to garner large scale adoption. In this paper, we propose several novel contributions to address the aforementioned issues with PGP and associated Web of Trust. To address the subjectivity of the Web of Trust, we provide a new certificate format based on Bitcoin which allows a user to verify a PGP certificate using Bitcoin identity-verification transactions -forming first degree trust relationships that are tied to actual values (i.e., number of Bitcoins transferred during transaction). Secondly, we present the design of a novel Distributed PGP key server that leverages the Bitcoin transaction blockchain to store and retrieve Bitcoin-Based PGP certificates. Lastly, we provide a web prototype application that demonstrates several of these capabilities in an actual environment.In a recent article, Yahoo announced its intentions to add an extension that will provide its customers with the ability to digitally sign and encrypt messages using Pretty Good Privacy (PGP). Yahoo plans to use a fork of Google's End to End OpenPGP plugin that is currently in development. Yahoo follows the likes of Google, Facebook and Microsoft, who also recently announced they would encrypt internal traffic in response to the Snowden spying revelations [1]. Traditional methods of securely sharing between two or more parties rely on the use of Public-Key Encryption within a Public Key Infrastructure (PKI). In a traditional PKI scheme, a certificate authority or certification authority (CA) is an entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others (relying parties) to rely upon signatures or assertions made by the private key that corresponds to the public key that is certified. In this model of trust relationships, a CA is a Trusted Third Party (TTP) that is trusted by both the

Where Is Current Research on Blockchain Technology?—A Systematic Review

“…Andrychowicz and Dziembowsk [40] ppresent a formal model for peer-to-peer communication and a Proof-of-Work concept used in Bitcoin, and based on the model, propose a broadcast protocol which is more secure against an adversary with arbitrary computational power. Wilson and Ateniese [44] have adopted the Bitcoin technology to enhance the Pretty Good Privacy (PGP) mechanism. In this mechanism, a Bitcoin address, Bitcoin identity verification transactions, and a Blockchain key server are used to improve the user’s trustworthiness.…”

Blockchain Technologies for the Internet of Things: Research Issues and Challenges

“…Interestingly, due to its unique and attractive features such as: transactional privacy, security, the immutability of data, auditability, integrity, authorization, system transparency, and fault tolerance, blockchain is being applied in several sectors beyond the cryptocurrencies. Some of the areas are identity management [9], intelligent transportation [10], [11], [12], [13], [14], [15], supply-chain management, mobile-crowd sensing [16], agriculture [17], Industry 4.0 [18], [19], Internet A miner packs valid transactions into a block and broadcasts back to the network.…”

Certificate Transparency with Enhancements and Short Proofs

“…The blockchain implementation of Coniks on Ethereum appeared in [9]. Wilson and Ateniese recently exploited Bitcoin and its blockchain to store and retrieve Bitcoin-based PGP certificates [39].…”