August 6th, 1997

Pretty Good Privacy, Inc (PGP) response to the
National Committee on Vital & Health Statistics (NCVHS)
Subcommittee on Health Data Needs, Standards and Security

Charles Breed
Sr. Director Technical Marketing

In accordance with requirements of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), PGP, Inc is submitting a testimony on how the PGP technology can be the standard for the U.S. Department of Health and Human Services by the required February 1998 date.

In general, the technology behind PGP-based products is ideal for protecting Vital and Health Statistics, because it can be applied to both data-at-rest and data-in-motion. PGP adds strong encryption techniques to both these types of data, store and forward as well as real-time data in motion. PGP also uses a "dynamic certificate", thus allowing multiple user IDs along with multiple signature assertions. For example, Patients, Physicians, and Insurance Representative all can be give different authorization levels depending upon the type of accompaning digital signature. One of the key elements, often overlooked is ‘ease-of-use", PGP is extremely easy-to-use and has been deployed worldwide to over 4 million users by over 80 different software vendors.

PGP uses well-known, proven encryption techniques such as Public Key Algorithms by Diffie-Hellman and RSA, Symmetric Algorithms like DES, CAST, IDEA. PGP also incorporates the NIST (National Institute for Standards and Technology) FIPS (Federal Information Processing Standards).

The core cryptographic technology is very strong, as quoted by William Crowell, Deputy Director of the National Security Agency, March 1997, "If all the personal computers in the world ~260 million computers - were put to work on a single PGP-encrypted message, it would still take an estimated 12 million times the age of the universe, on average, to break a single message."

PGP, Inc.'s response to the relevant questions from the National Committee on Vital and Health Statistics (NCVHS).

1. What procedures should be employed to safeguard information? What security features do your products employ?

PGP Version 5 client / server software builds on the heritage of PGP, which was originally released as freeware and today has millions of users worldwide. This product operates in standalone mode and also integrates seamlessly into popular email packages and all of the standard operating systems (Windows 95, Windows NT 4.0, UX Solaris, Linux, AIX, HP-UX and Macintosh) for easy encryption and digital signing of email, attachments and files. The significantly improved graphical user interface makes complex mathematical cryptography accessible for novice computer users.

Without strong encryption your healthcare data moving over a public network is at serious risk of third party interception and piracy. Sending unencrypted data and attachments is like mailing a postcard. PGP protects the privacy and security of your transmitted data and files with the strongest encryption available for individual users. Millions of people rely on PGP's advanced cryptography for protection against interception and count on PGP digital signatures for authentication and verification.

2. How should security policies be communicated to internal and external users and consumers?

Since PGP is the world wide de facto standard, many companies, governments and individuals are already familiar with PGP. Additional educational and awareness programs specific to the health care industry can be established and deployed as needed.

3. How do you determine who can have access to heath information?

Specific record access policies can be determined, and the pgp certificate structure allows for multiple signatures, thus anyone trying to access a record may be required to have multiple specific signatures authorizing the multiple uses of one pgp certificate.

4. What are the impediments to implementing health information security?

5. How is training delivered, who needs it? How often?

End-Users, Administrators, and Physicians can be trained in one 2-hour class on the use and understanding of the underlying security policies.

6. What authentication is used?

Trusted Third-Parties or Local Registration Authorities would be established to sign the PGP-certificate. These certifying authorities will check the individual's credential and perform a digital signature, attesting to the identification's association with the public key material. These PGP certificates will be used to authenticate the person and their privileges or authorization level.

7. What type of encryption do you use?

Users and administrators can generate public/private key pairs using either DSS/Diffie-Hellman (the ElGamal variation of Diffie-Hellman) or RSA algorithms, depending upon their preferences and needs. Symmetric encryption is done using Triple DES, 128-bit IDEA, or CAST. Message digest (Hash) algorithms of MD-5 (128-bit) or SHA-1 (160-bit).

8. Are digital signatures possible, How?

YES, PGP uses digital signature along with message digests created from the one-way hash function. The innovative Digital Signature technology ensures integrity of mail and files. The sender uses a private key to digitally sign a document. The recipient verifies the signature (non-repudiation) and contents (integrity) by using the sender's matching public key. If the medical record has been tampered with in transit or is not from the supposed author, PGP will alert the recipient that the material has been altered in transit or produced by someone other than the stated creator. Tracking information, accounting and audit trails is also possible.

9. What are the product features?

Powerful Cryptography - PGP uses the strongest cryptography available (DH-1024, CAST-128, SHA-1).

Unforgeable Digital Signatures - PGP's Digital Signature technology protects your documents from tampering and alteration.

Easy to - PGP's encryption technology is fully compatible with popular programs, and quickly encrypts any type or size of file - from medical records to insurance forms to pharmaceutical information.

Key Server Integration - You can easily and automatically post your public key to a public key server with a single mouse click. By storing your public key on a server, it is easily obtained by others who wish to communicate with you. Likewise, you are easily able to search the key server for other's public keys.

Multi Platform Support - PGP supports both Windows95/NT 4.0 and Macintosh.

Algorithms Supported:
Public Key Algorithms: DSS/Diffie-Hellman, RSA Hash Functions: MD5, RIPEMD-160, SHA-1 Symmetric Algorithms: CAST, IDEA, Triple DES

Certificate Server Support
* Automatically synchronize keys
* Synchronize selected keys on request
* Add/Send Key(s) to Server
* Search server for Keys (LDAP and HTTP servers)

Selective Import Dialog
* User selects which certificates on Certificate Server will be imported into user's local key ring

Message Recovery
* For D-H keys message recovery on messages from outside a corporation coming into the corporation with message recovery turned on

Corporate Certification Key
* Companies can choose: all certificates ok, certificates can only be used if signed by Corp Certification Key, warning msg presented to users using certificates not signed by Corp Certification Key

Passphrase Strength Control
* CSO can set minimum number of characters and entropy. Warning if user generates key less than 768 bits
* Small keys can be broken, PGP's name means strong crypto Simplified Trust Model
* Certificate validity will be displayed as good/bad, trust will not be displayed (additional info can be displayed through advanced preferences dialog
Secure Wipe, Overwrite file multiple times so that it cannot be recovered

Meta-Introducer Trust
* Allows corporations to easily specify and change the set of introducer keys used by their employees. Non-Exportable Signatures

10. What Standards approved technology is used?

NIST (National Institute for Standards and Technology) FIPS (Federal Information Processing Standards).

IETF (Internet Engineering Task Force)

In conclusion, PGP has the technology to provide strong security to Vital and Health statistics, records and reports; by adding well-known, standards-endorsed encryption techniques. Legislation is now underway to allow PGP digital signatures for a variety of State government uses. NASA is using PGP in conjuction with Russia to allow astronauts to vote on public election while in outer-space. PGP secures Financial service worldwide, such as Electronic Data Exchange (EDI). PGP and our partners understand the need and appropriate software applications to meet the needs of the Health Insurance Portability and Accountability Act.

Pretty Good Privacy, Inc. (PGP) provides encryption solutions for secure communications and storage of data to users, corporations and the Healthcare Industry. Developed by founder Phil Zimmermann, the company's initial product, is now the de facto standard for Internet mail encryption. PGP's family of encryption products includes all forms of digital information: e-mail, data, telephony, fax, image and video.

PGP incorporated in March, 1996, to market commercial versions of what has already become a popular product among computer enthusiasts around the world. PGP Headquarters Address and Phone

2121 S. El Camino Real Suite 902
San Mateo, CA 94403
Main: (415) 572-0430
Fax: (415) 572-1932