Where To Get The Pretty Good Privacy Program (PGP) -- Abridged Version

Table of Contents


What Is The Latest Version?

 |-----------------+---------------------+---------------------------------|
 | Platform(s)     | Latest Version      | Distribution File Names         |
 |-----------------+---------------------+---------------------------------|
 | DOS, Unix,      | Viacrypt PGP 2.7    | disk sets                       |
 | Mac, Windows,   |                     |                                 |
 | or WinCIM/CSNav |                     |                                 |
 |-----------------+---------------------+---------------------------------|
 | DOS, Unix,      | MIT PGP 2.6.2       | pgp262.zip  (DOS + docs)        |
 | others          |                     | pgp262s.zip (source)            |
 |                 |                     | pg262s.zip source on CompuServe |
 |                 |                     | pgp262.tar.gz (source)          |
 |                 |                     | pgp262.gz (same as above on DOS)|
 |                 |                     | pgp262.tar.Z (source)           |
 |                 |                     | pgp262dc.zip (documentation)    |
 |                 |                     | pg262d.zip (docs on CompuServe) |
 |-----------------+---------------------+---------------------------------|
 | Macintosh       | MIT PGP 2.6         | MacPGP2.6.sea.hqx (binary+docs) |
 |                 |                     | macpgp26.hqx (same as above)    |
 |                 |                     | MacPGP2.6.src.sea.hqx (source)  |
 |                 |                     | macpgp26.src (same as above)    |
 |                 |                     | MacPGP2.6-68000.sea.hqx (binary)|
 |                 |                     | mcpgp268.hqx (same as above)    |
 |                 |                     | MacPGP2.6.2.beta*.sea.hqx       |
 |                 |                     | MacPGP2.6.2.beta*.src.sea.hqx   |
 |-----------------+---------------------+---------------------------------|
 | Amiga           | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha              |
 |                 |                     | pgp262-a14-020.lha              |
 |                 |                     | pgp262-a14-src.lha              |
 |-----------------+---------------------+---------------------------------|
 | Non-USA version | PGP 2.6.i from      | pgp26i.zip                      |
 | to avoid RSAREF | Stale Schumacher    | pgp26is.zip                     |
 | license.        |                     | pgp26is.tar.gz                  |
 |_________________|_____________________|_________________________________|

Where Can I Get Viacrypt PGP?

If you are a commercial user of PGP in the USA or Canada, contact Viacrypt in Phoenix, Arizona, USA. The commecial version of PGP is fully licensed to use the patented RSA and IDEA encryption algorithms in commercial and goverment applications in the USA and Canada. It is fully compatible with, functionally the same as, and just as strong as the freeware version of PGP.

Orders may be placed by calling 800-536-2664 during the hours of 8:30am to 5:00pm MST, Monday - Friday. They accept VISA, MasterCard, AMEX and Discover credit cards.

If you have further questions, please contact viacrypt@acm.org.

Where Can I Get The Freeware PGP?

There are several ways to get the freeware PGP: ftp, WWW, BBS, CompuServe, email ftp server, and sneakernet (ask a friend for a copy). Just don't ask Philip Zimmermann directly for a copy.

FTP Sites In North America

Telnet to net-dist.mit.edu, log in as getpgp, answer the questions, then ftp to net-dist.mit.edu and change to the hidden directory named in the telnet session to get your own copy.

MIT-PGP is for U. S. and Canadian use only, but MIT is only distributing it within the USA (due to some archaic export control laws).

  1. Read ftp://net-dist.mit.edu/pub/PGP/mitlicen.txt and agree to it.
  2. Read ftp://net-dist.mit.edu/pub/PGP/rsalicen.txt and agree to it.
  3. Telnet to net-dist.mit.edu and log in as getpgp.
  4. Answer the questions and write down the directory name listed.
  5. QUICKLY end the telnet session with ^C and ftp to the indicated directory on net-dist.mit.edu (something like /pub/PGP/dist/U.S.-only-????) and get the distribution files (see the above chart for names). If the hidden directory name is invalid, start over at step 3, above.
You can also get PGP from:

ftp.csn.net/mpj
See ftp://ftp.csn.net/mpj/README.MPJ
ftp.csua.berkeley.edu (for U. S. or Canadian users)
/pub/cypherpunks/pgp/
ftp.wimsey.bc.ca
See ftp://ftp.wimsey.bc.ca/pub/crypto/software/README

World Wide Web Access

Compuserve

GO NCSAFORUM, see library 12. Read the instructions there for access.

Bulletin Board Systems

Other FTP Sites

Also, try an archie search.

PGP Books

Simson Garfinkel, PGP: Pretty Good Privacy, Sebastopol CA: O'Reilly & Associates, Inc., ISBN 1-56592-098-8, US $19.95

William Stallings, Protect Your Privacy: A Guide for PGP Users, New York: Prentice Hall PTR, ISBN 0-13-185596-4, US $19.95

Key Distribution

For information on how to publish your public key, send blank mail to info-pgp@Four11.com (commercial key certification and publication service), or send mail with the subject "help" to pgp-public-keys@pgp.mit.edu (free key server without certification services).

My public key is available from both of the above services. Send e-mail to key@Four11.com with one of my e-mail addresses (m.p.johnson@ieee.org or mpj@netcom.com, for example) in the body of the message to get my key from Four11.com. Send email to pgp-public-keys@pgp.mit.edu with a subject of "get mpj8" to get my key from a free key server.

FTPmail

You can get FTP files mailed to you. Send a message saying "help" to ftpmail@decwrl.dec.com. You will be sent an instruction sheet on how to use the ftpmail service.

To get pgp 2.6.i by email:
Send a message to hypnotech-request@ifi.uio.no with your request in the Subject: field.

  Subject             What you will get

  GET pgp26i.zip      MS-DOS executable (uuencoded)
  GET pgp26is.zip     MS-DOS source code (uuencoded)
  GET pgp26is.tar.gz  UNIX source code (uuencoded)

Language Modules

What Is All This Nonsense About Export Controls?

The U. S. International Traffic in Arms Regulations claim to prohibit export of PGP from the USA without a license, except to Canada. Canada has similar rules. Therefore, if you are outside of North America, please get your copy of PGP from a site outside of North America.

What Intellectual Property Restrictions Exist In The USA?

MIT PGP is only for personal, noncommercial use because of restrictions on the licensing of both the RSA algorithm (attached to RSAREF) and the IDEA algorithm. PKP/RSADSI insist that we use RSAREF instead of the mpi library for reasons that make sense to them.

For commercial use, use Viacrypt PGP, which is fully licensed to use both the RSA and IDEA algorithms in commercial and corporate environments (as well as personal use, of course).

Another restriction is due to an exclusive marketing agreement between Philip Zimmermann and Viacrypt that applies to the USA and Canada only. Viacrypt has exclusive rights to market PGP commercialy in this area of the world. This means that if you want to market PGP commercially in competition with Viacrypt in the USA or Canada, you would have to create a new implementation of the functions of PGP containing none of Philip Zimmermann's copyrighted code. You are free to modify existing PGP code for your own use, as long as you don't sell it. Phil would also appreciate your checking with him before you distribute any modified versions of PGP as freeware.

"PGP", "Pretty Good Privacy" and "Phil's Pretty Good Software" are trademarks owned by Philip Zimmermann. This means that if you modify an older version of PGP that was issued under the copyleft license and distribute it without Phil's permission, you have to call it something else. This avoids confusing all of us and protects Phil's good name.

What Intellectual Property Restrictions Exist In Canada?

MIT PGP is only for noncommercial use because of restrictions on the licensing of the IDEA algorithm. Because the RSA algorithm isn't patented in Canada, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license associated with the RSAREF copyright, which is valid in Canada.

For commercial use, use Viacrypt PGP, which is fully licensed to use the IDEA algorithm in commercial and corporate environments.

The exclusive marketing agreement with Viacrypt also applies in Canada. See the section on USA intellectual property restrictions for more details.

What Intellectual Property Restrictions Exist Outside North America?

MIT PGP is only for noncommercial in areas where there is a patent on software implementations of the IDEA algorithm. Because the RSA algorithm isn't patented outside of the USA, you are free to use the mpi library instead of RSAREF, if you want to, thus freeing yourself of the RSAREF license restrictions. The RSAREF copyright holds outside of the USA, even though the RSA patent does not.

The IDEA conventional block cipher is covered by US Patent 5,214,703 and European patent EP 0 482 154 B1. IDEA is a trademark of Ascom-Tech AG. Commercial users of IDEA (including commercial use of PGP) may obtain licensing details from Ph. Baumann, Ascom Tech Ltd., IDEA Lizenz, Postfach 151, CH-4502 Solothurn, Switzerland, Tel ++41 65 242828, Fax ++41 65 242847.

What Is Commercial Use?

Use some common sense. If you are running a business and using PGP to protect credit card numbers sent to you electronically, then you are using PGP commercially. Your customers, however, need not buy the commercial version of PGP just to buy something from you, if that is the only commercial use they make of PGP (since they are spending, not making, money with PGP).

If you are just encrypting love letters or other personal mail (for which you don't get paid) on your own personal computer, that is not commercial. If you are encrypting official business mail on your for-profit corporation's computer with PGP, that is commercial use.

Note that there are some gray areas not covered above, and the patent owners of RSA and IDEA may differ from my interpretation in the areas not covered above, so if you are in doubt, you should consider the licensing of Viacrypt PGP (or outside of North America, direct licensing of IDEA) to be cheap legal insurance. Indeed, the license fee is probably a lot cheaper than a legal opinion from a lawyer qualified to make such a judgement. Note that I am not a lawyer and the above is not legal advice. Use it at your own risk.

MacPGP Kit

The MacPGP kit is a user interface for the Mac version of PGP.

For More Information

Permission is granted to distribute unmodified copies of this FAQ.

To get the longer version of this FAQ, get ftp://ftp.netcom.com/pub/mp/mpj/getpgp.asc or send mail to ftp-request@netcom.com with the line

SEND mp/mpj/getpgp.asc

in the body of the message.

There are many other frequently asked questions. Most of them are covered in the documentation that comes with PGP, and the few that aren't are addressed in documents referenced above.