HDTenEightyP/NetNews huggingface dataset:
From: Mike Tighe <tighe@convex.COM>
Subject: Re: PGP as a World Standard
Originator: tighe@convex1.convex.com
Reply-To: tighe@convex.com
Organization: Convex Computer Corporation, Richardson, Texas
Date: Fri, 18 Dec 1992 16:55:51 GMT
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

rja14@cl.cam.ac.uk (Ross Anderson) writes:
>Get your facts right:

>(2) If you don't live in the USA, US law doesn't apply and so neither
>    the ITAR regulations or the RSA patents have any force.

Now, is that a fact? I think that Manuel Noriega and Dr. Hector Alvarez
Machain, just to name two, would probably beg to differ.
-- 
Mike Tighe, (214) 497-4206
tighe@convex.com
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 17 Dec 1992 21:36:27 GMT


mathew argues as if PGP was some European invention we have a problem
with in the U.S. That's a distortion of the real situation.

Read my lips. PGP1.0 was contraband in the U.S., so much so that the
author pulled out. It was illegally exported.  PGP2.0 was based on it.
Thus the Europeans who use it don't have clean hands, regardless of
the state of the law there.

BEING DISHONEST WITH AN EXPLANATION ISN'T THE SAME AS BEING HONEST.

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: jeffb@world.std.com (Jeffrey T Berntsen)
Subject: Re: PGP as a World Standard
Organization: The World @ Software Tool & Die
Date: Sat, 19 Dec 1992 01:10:18 GMT

strnlght@netcom.com (David Sternlight) writes:


>In response to Vesselin Bontchev (who unlike many who sound off
>here seems to have done some work on PGP2.0 and thus deserves
>extra respect):

>Since my position is an ethical one, not a legal one, for Vesselin
>to say that "what is written in the docs doesn't matter" "you must
>PROVE" they copied from a wrongful (PGP1.0) source comes with ill
>grace. The docs amount to a confession which, from an ethical
>point of view is all that's necessary.

Nonsense!  The docs do NOT amount to a confession.  Whoever wrote the docs
may have said what they did to associate their program with PGP 1.0's good
popularity even though the two are unrelated in other than function.  This 
sort of thing has been done before with free or public domain programs where
the original author has stopped work on the programs.

BTW, I also think PKP is missing out in a major way by not having David on
their payroll...

Jeff Berntsen
jeffb@world.std.com

Xref: sparky alt.security:5173 sci.crypt:5924
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP as a World Standard
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 19 Dec 92 00:18:34 GMT
 <1992Dec17.200225.27831@ulysses.att.com> <a_rubin.724630430@dn66> <1992Dec18.202705.16545@netcom.com>
Organization: Beckman Instruments, Inc.

In <1992Dec18.202705.16545@netcom.com> strnlght@netcom.com (David Sternlight) writes:


>Arthur Rubin and others evade/dance around/avoid (I'm trying hard not
>to give offense here--pick some other characterization if you like)
>the issue by claiming a program is an algorithm and thus exempt. It
>is not, and the law is quite specific on this point, no matter
>what logical sophistry of a non-legal character may be argued.

PGP isn't an algorithm.  The RSA patent is a patent on algorithm, which PGP
may use.  (I don't have a copy of PGP any more, so I can't say what it
contains.)

--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: alt.security,sci.crypt
From: gardner@convex.com (Steve Gardner)
Subject: Re: The Boy Who Cried Wolf
Date: Fri, 18 Dec 1992 23:27:50 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Dec18.183124.11289@infodev.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:
>Why are the Americans so stupid? 
	Us, stupid?  Why do you folks put up with the US dictating to you?
	I think our government is evil to do what it does but it wouldn't
	get away with nearly as much if Europe didn't acquiesce to the
	extent it does. 

>The following month, Commodore came along and stole the order. They 
>had no difficulty at all getting US (sorry, COCOM) licences. Shortly 
>afterwards, Sinclair got taken over by Amstrad and closed down. 
>Goodbye to a few thousand jobs in Cambridge and at the assembly plant 
>in Scotland.
	Write your MP man.  Tell them to stop licking Washington's
	boots.  High time you folks stood up to the "new world order".

>Others say it was just IBM and Racal cutting 
>corners to make a few more sales, and being covered by pals in 
>Washington.
	Probably the truth.

>So is it at all surprising that when the US asks China not to sell missiles
>to Iraq, the answer is `get stuffed'?
	Now if only Europe would show the intestinal fortitude of the
	Chinese.



						smg


Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: neuhaus@vier.informatik.uni-kl.de (Stephan Neuhaus (HiWi Mattern))
Subject: Re: PGP v. 2.1 Released
Organization: University of Kaiserslautern, Germany
Date: Mon, 14 Dec 1992 10:29:23 GMT

Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:

>Unfortunately, it's
>possible that a distributor could be found responsible if someone
>outside the U.S. gets the code from him.

That is precisely the reason why I oppose the PEM RFCs.  There is no
way that a worldwide software distribution can be created that uses
RSAREF, without it violating export laws.

And how good is an Internet standard if it's US-centric?  The Internet
consists of more than the US.

Please RSADSI and PKP, consider that, too.  You might force all US
netters to use RIPEM, but the rest of the world will probably use PGP.

Have fun.

-- 
Stephan <neuhaus@informatik.uni-kl.de>
sig closed for inventory.  Please leave your pickaxe outside.
PGP 2.1 public key available on request.  Note the expiration date.
Newsgroups: alt.security
From: robert.heuman@rose.com (robert heuman)
Subject: PGP v. 2.1 Released
Organization: Rose Media Inc, Toronto, Ontario.
Date: Thu, 17 Dec 1992 03:30:16 GMT
X-Gated-By: Usenet <==> RoseMail Gateway (v1.70)


Date Entered: 12-16-92 22:19
boucher@csl.sri.com (Peter K. Boucher) comments 
B(> 
B(> In article <19921214.055706.262@almaden.ibm.com>, russotto@vnet.ibm.com (Matthew T. Russotto) writes:
B(> |> In <palmer.724336017@news.larc.nasa.gov> Michael T. Palmer writes:
B(> 
B(> [stuff gone...]
B(> 
B(> |> >to be told we should switch to a program we can't even get our hands on
B(> |> >yet, and away from a program that works now (even though the legality of
B(> |> >use is still being debated).
B(> |> 
B(> |> Who's to say RIPEM's legality won't be debated too?  As I recall, PKP
B(> |> claims a patent broad enough to stop ANY public key scheme-- they claim
B(> |> to have the use of arithmetic in a public key scheme patented....
B(> 
B(> Three corrections:
B(>   1) RIPEM can be found with archie and obtained via anonymous ftp.
B(>   2) The legality of PGP is not being seriously debated.  It's illegal.
B(>   3) RIPEM uses RSAREF, which comes with an imbedded license from PKP.

There has been a lot of comment about using RIPEM, and what it does 
and doesn't do.  In today's comments, I have seen a rather long screed 
on RIPEM's deficiencies compared to PGP, which I suspect is accurate. 
The three corrections from Mr Boucher, however, are NOT accurate (for 
me, anyway).  His corrections are inaccurate because:

1. I cannot obtain RIPEM via anonymous ftp, since I use a BBS which 
forbids that practice, because of the load it puts on the system, 
and I do not have a computer with ftp ability, nor can I get to 
archie - if you are going to name locations where it can be found, 
make sure they are universally available.
2. PGP is NOT illegal where I am located (if it is illegal anywhere), 
since US law does NOT apply to me (I am OUTSIDE the US) - condition 
your statements re legality/illegality PLEASE, and
3. I would not give 2 cents for a license from PKP, who does not have 
a valid patent under Canadian Law, since the material was published 
without conditions beforehand.

I am conversant with the ITARs involved, as well as Canadian matching 
of the Export Controls as part of the COCOM group. Therefore I point 
out the following:
1) I can call a US BBS and download anything and I have 
NOT exported it, I have imported it.
  That is perfectly legal under the Export Controls.
2. I can not export  it to the US, but I can put it on a Canadian BBS 
and a US resident can call up and download it and I have NOT exported 
it, he/she has imported it - that IS the law here.

Further, privacy is a right that both governments seem to be doing 
their best to circumvent and ANY product that reinforces MY rights 
over their [attempted] invasion(s) of my rights is going to get my 
support. RIPEM is NOT as strong or as useful as PGP. That is the 
bottom line. 

Robert Heuman
---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
Xref: sparky alt.security:5187 sci.crypt:5970
From: mitch@cirrus.com (Mitch Wright)
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP/RSA Fundamental mathematics
Keywords: A data-security student miffed at those who believe mathematical ideas
Date: 20 Dec 92 08:53:44 GMT
Followup-To: poster
Organization: Oz

/* smb@research.att.com (Steven Bellovin) writes: */

>First -- the RSA patent does not claim the discovery of the mathematical
>function, nor restrict the mathematics.  What it does claim is a communica-
>tions system based on certain equations.  If you found a different use
>for the same equations, you could use them quite freely.
>
Hmmm... I've heard it put this way several times, but I'm wondering...

Assume that they had a patent on the flying disk (aka frisbee).  Now maybe
I'm reading too much into the above statement, but it looks like it would
be ok for me to make something with the same characteristics but market it
as a dog dish.  Now if this were true, is it my fault that people discover
that they can throw my dog dish just like a frisbee?  Am I liable for _their_
use?  Are _they_ liable for _their_ use???  I mean hey, if I want to buy
a dog dish and toss it around like a frisbee, isn't that my right?

Now, what if I used RSA to simply encrypt files -- nothing more.  Is that ok?
If you as a user want to uuencode them and send them off, 
hey, that is your business... and your right (I think?)...
OK, so my program has an option to uuencode them on the fly, and attach
my public key and ...

Another thing that bothers me is that it covers a communications system...
What *exactly* do they mean?  What if I wanted to add RSA code to my kernel's
filesystem code and cause all data on the disk to be encrypted... Is that
a communications system?  Just about anything we do can be interpreted as
communicating...

Regards,

   ~mitch

---

"I'd much rather be off the deep end than the shallow one..."
Newsgroups: alt.security,sci.crypt
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: PGP v. 2.1 Released
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Sun, 20 Dec 1992 00:47:17 GMT

In article <a_rubin.724526808@dn66>, a_rubin@dsg4 (Arthur Rubin) writes:
>Here, in the US, we have the concept of
>innocent until proven guilty.

It's good to hear that people are familiar with history.

//Jyrki
Newsgroups: alt.security
Subject: LUC - test
From: grhiggie@ccu1.aukuni.ac.nz (Mr. Gavin R. Higgie)
Date: Tue, 15 Dec 1992 02:49:50 GMT
Organization: University of Auckland, New Zealand.
Summary: LUC test

This is a test to see if it works

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: PGP v. 2.1 Released
Followup-To: alt.security.pgp
X-Quoted: 33%
Organization: Computer Science Dept, Indiana University
Date: Mon, 14 Dec 1992 20:43:48 -0500

Thus said russotto@vnet.ibm.com (Matthew T. Russotto):
>Who's to say RIPEM's legality won't be debated too?  As I recall, PKP
>claims a patent broad enough to stop ANY public key scheme-- they claim
>to have the use of arithmetic in a public key scheme patented....

RIPEM uses RSAREF which can be licensed from RSA DSI for noncommercial
use.  Read the license yourself, but most people interpret it as meaning
that it's legal to use.  Unless you know something we don't about the
licensing conditions, in which case please share it.
-- 
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 16 Dec 1992 17:16:37 GMT


mathew reveals his intelligence, forensic skill, and brilliiant
logic with the stunning argument "Go to hell." Of course. That
clarifies everything.

Then he says "We've standardized on PGP." as if he were justifying
something.

Let's take a closer look at that. PGP 2.x was written in Europe
based on PGP1.0. PGP 1.0 was illegally exported from the U.S.
In the U.S. PGP was based on RSA's patents, and used them
without permission, i.e. it was stolen goods.

Thus PGP 2.0 is based on stolen goods.

Any more comments wrapping yourself in the moral high ground,
mathew?

David
Xref: sparky alt.security:5122 sci.crypt:5818 talk.politics.guns:25400 talk.politics.misc:64710 alt.security.pgp:260
From: cdt@sw.stratus.com (C. D. Tavares)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Followup-To: alt.security,sci.crypt,talk.politics.misc,alt.security.pgp
Date: 18 Dec 1992 01:19:05 GMT
Organization: Stratus Computer, Inc.
Distribution: world
NNTP-Posting-Host: rocket.sw.stratus.com

In article <1992Dec17.215323.1154@netcom.com>, strnlght@netcom.com (David Sternlight) writes:
> PGP 1.0 was a violation of the RSA patents...

This is no longer relevant to talk.politics.guns.  Please set followups
appropriately.
-- 

cdt@rocket.sw.stratus.com   --If you believe that I speak for my company,
OR cdt@vos.stratus.com        write today for my special Investors' Packet...

Xref: sparky alt.security:5143 sci.crypt:5866
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP as a World Standard
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 17 Dec 92 22:13:50 GMT
 <1992Dec16.171637.11957@netcom.com> <BzDF1r.5Cw@cs.uiuc.edu> 
 <BzDKHy.Dpv@cs.uiuc.edu> <1992Dec17.124326.17185@infodev.cam.ac.uk> <1992Dec17.200225.27831@ulysses.att.com>
Organization: Beckman Instruments, Inc.

In <1992Dec17.200225.27831@ulysses.att.com> smb@research.att.com (Steven Bellovin) writes:

>You're quite correct about RSA not being protected outside of the U.S.
>Within the U.S., a patent may be infringed by making, selling, or using
>the protected device.

A program is not a "device" under patent law, or you would be patenting an
algorithm, which we all know is improper.  It requires a program + computer
to infringe, and that means the user, (the one who puts them together)
might be the infringer.

--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: alt.security
From: elekokws@nuscc.nus.sg (Netweaver)
Subject: encryption program?
Organization: National University of Singapore
X-Newsreader: Tin 1.1 PL4
Date: Wed, 16 Dec 1992 10:48:06 GMT

Hello,
I have some data file ( binary and text ) that I would like to
encrypt, using something better than the Unix's crypt().
can anyone tell me where I can ftp one?

thanks.
-wai
P.S. I just doing for security, so PGP does not seem to be
     the right choice.
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 12 December 1992
Date: Sat, 12 Dec 1992 22:00:19 EST
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<alt.security_723854602@aber.ac.uk> "alt.security FAQ posting"
<Bz3x8o.86t@mentor.cc.purdue.edu> "patch 2 for Tripwire"
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 19 December 1992
Date: Sat, 19 Dec 1992 22:00:26 EST
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<1gm0muINNabp@mirror.digex.com> "architecture overiew of UNIX security (version 3)"
From: anthis@bcstec.ca.boeing.com (Mike Anthis)
Subject: Re: I have a problem with a ATM transaction
Organization: Boeing
Date: Wed, 16 Dec 1992 17:14:22 GMT

In article <1992Dec16.031322.12493@colorado.edu> bear@tigger.cs.Colorado.EDU (Bear Giles) writes:
>
>Now, what I liked was the people who put an "out-of-order" sign on the
>night-deposit box of a Denver bank, and then put this flimsy box in front
>of it.  A number of people were actually dumb enough to put their deposits
>in this freestanding box.
>
>Somebody called the police and they arrested these rather creative people
>when they returned to collect the loot.  WHAT WAS THE CRIME?  They put a
>bogus "out-of-order" sign on the night-deposit box, but should they be
>held accountable that other people were dumb enough to leave their deposits
>in the other box?!

How about fraud, plus conspiracy to commit same?

The crooks are not accountable for other people's stupidity,
but they _are_ accountable for their own dishonesty.

Cute trick, but a crook is a crook and theft is theft.

My $.02,
mike
-- 
------------------------------------------------------
Mike Anthis          anthis@sleepy.ns.cs.boeing.com
90% of good taste is found in 10% of the population.
------------------------------------------------------
Newsgroups: alt.security,sci.crypt
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP v. 2.1 Released
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 18 Dec 1992 22:43:31 GMT

In article <a_rubin.723923379@dn66> a_rubin@dsg4.dse.beckman.com (Arthur 
Rubin) writes:
>
>Well, the patent may be invalid, and it may not cover the algorithms uses
>in PGP (if it does, it is IMHO too broad), 

and if my grandma had baytzim she'd have been my grandpa. Amazing
how many rationalizations are being invented by many here, not
just Rubin, to justify a wrong.

>and PKP (the patent holder),
>although they claim to license anyone in the US to use it for a nominal
>fee, refuse to license Zimmerman or the current updater of PGP.

Surely there's no compulsion on a patent holder to license what they
consider to be a violation, after the fact. Both PGP 1.x and 2.x were
presented as faits accompli. There was no advance request or
inquiry about licensing. In fact, as I read it the notion of licensing
came up after PKP objected. Hardly clean hands, if accurate.

David
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: PGP as a World Standard
Followup-To: alt.security,talk.politics.guns,talk.politics.misc,alt.security.pgp
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Fri, 18 Dec 1992 12:06:11 GMT

In article <1992Dec16.171637.11957@netcom.com>, strnlght@netcom (David Sternlight) writes:
>Let's take a closer look at that. PGP 2.x was written in Europe
>based on PGP1.0. PGP 1.0 was illegally exported from the U.S.

It was allegedly illegal.  How do you know?  Perhaps an U.S. citizen
memorized the code, travelled out of USA, recited it aloud and someone
happened to overhear it and type the code in.  Or, perhaps ITAR really
talks about exporting cryptic labels on software packages because
someone can use them as munition by throwing them at people, and
everybody just has misunderstood the law.

>In the U.S. PGP was based on RSA's patents, and used them
>without permission, i.e. it was stolen goods.
>
>Thus PGP 2.0 is based on stolen goods.

Gee.  PGP is illegally exported munitions (sorry about the above
paragraph, by your astounding argumentation I now know you really do
know the Truth and are Right), and illegally exported weapons are
often used in wars, thus PGP is built on the blood of many many people
who have died in wars.  Also, as we have read here it has been used
(no, not just allegedly, it _Must_ be true, the Police say so) in a
child abuse case, thus PGP is based on sexual exploitation of
children.  Right?

Followups directed out of sci.crypt.

//Jyrki
Xref: sparky alt.security:5060 sci.crypt:5657 talk.politics.guns:25180 talk.politics.misc:64139 alt.security.pgp:162
From: palmer@icat.larc.nasa.gov (Michael T. Palmer)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP v. 2.1 Released
Date: 14 Dec 92 12:26:57 GMT
Organization: NASA Langley Research Center, Hampton, VA  USA
NNTP-Posting-Host: icat.larc.nasa.gov

Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:

>Thus said palmer@icat.larc.nasa.gov (Michael T. Palmer):
>>cme@ellisun.sw.stratus.com (Carl Ellison) writes:
>>
>>>Sounds like a good reason to switch from PGP to RIPEM.
>>
>>Okay, could you please point us to where we can find a PGP-type program
>>that uses RIPEM?  I would love to not have to even *consider* patent stuff
>>when using a crypt program.

>Since you're posting from a .gov site, I think you don't have worries in
>that regard.

Well... it's not like I would necessarily be using it for work-related
uses, except maybe for protecting company proprietary data.  I was more
interested in crypt programs for protecting PERSONAL privacy (on my OWN
equipment).


>Also, RIPEM IS NOT YET WIDELY AVAILABLE.  It is in use by a small number
>of beta testers, who have been asked not to redistribute it further.  It
>is not on any public FTP site that I know of, nor should it be.

Thank you for clearing this up.  Someone else on the net (I believe it
was David Sternlight) also mentioned this to me a while back, but since
so many recent posts recommended switching to RIPEM, it seemed to me
(and many others, I guess) that the program was now widely available.


>I really wish RIPEM's beta testers would stop advocating its use as
>though you could get it and use it today.  It will be soon.  It's not
>now (or, if it is, it's against the express wishes of the author.)

I agree.  For those of us without access to RIPEM, it's quite frustrating
to be told we should switch to a program we can't even get our hands on
yet, and away from a program that works now (even though the legality of
use is still being debated).

-- 
Michael T. Palmer, M/S 152, NASA Langley Research Center, Hampton, VA 23681
Voice: 804-864-2044,   FAX: 804-864-7793,   Email: m.t.palmer@larc.nasa.gov
PGP 2.0 Public Key now available -- Consider it an envelope for your e-mail
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp