Triple DES (3DES) Encryption and PGP Encryption

Encryption DataExpress 3DES or PGP File Encryption deploys software¬based encryption mechanisms to protect unstructured data files in transit, regardless of the type of communications protocols encountered (i.e. Async, Bisync, SNA, FTP) or the number of computers the data passes through. Use of DataExpress 3DES File Encryption requires no knowledge of encryption algorithms, techniques or procedures. It provides an easy mechanism to extend information over public networks without risking the security of the data. PGP provides a powerful standard public/private key technology that is rich with optional features for enhanced security and control.

3DES File Encryption Server The basic DataExpress mechanism for encryption and decryption of internal data is DES. To meet the need for speedier encryption of files, the DataExpress 3DES Server module has been developed. The 3DES Server module uses a triple DES key to encrypt and decrypt files. When the 3DES Server performs file encryption using the triple DES algorithm, it simultaneously compresses the file to decrease the length of the transmission time. DataExpress 3DES File Encryption maintains a single 16 or 24 byte key for each of its end points. Da-taExpress 3DES File Encryption can support hundreds or thousands of end points. Each end point must have corresponding 3DES client software to encrypt/decrypt files and to host the corresponding encryption key.

3DES End Point Encryption/Decryption support The client software would be deployed to support each end point. The Client maintains a single key that permits interaction with the DataExpress 3DES File Encryption Server. Clients are available for NonStop NSK/NonStop Himalaya, OS/390, UNIX, Linux, and Windows 95/98/2000/NT environments. The 3DES encryption/decryption Clent program licenses must be purchased separately from Xypro.

3DES DataExpress encryption options provide the following features: • Triple DES bi¬directional encryption/decryption functions • Supportforbinary,EBCDICandASCIIdata • Compression capabilities for efficient performance • Inter¬operability across a variety of hardware platforms

including Himalaya (NonStop/NSK), Windows 95/98/2000/NT, UNIX, Linux, and OS390, with others added to meet customer requirements.

PGP File Encryption Server The PGP File Encryption Server is similar to 3DES, although PGP provides even more features, such as pass phrases, and public key propagation. Because of the feature¬rich technology used for PGP, DataExpress provides for the use of profiles to control how the features are used for any group of transmissions. This allows as much or as little of the full power of PGP to be used without unnecessarily complicating the set ups for each transmission. Key maintenance is easy because the keys for all the trading partners are maintained in an external key store using standard tools, and the correct decryp-tion key is identified in the encrypted file itself. Encryption keys can be identified using the DataExpress customer id or by other means. DataExpress enforces double¬custody for updating the pass phrase used to unlock the private keys for decrypting inbound files – each operator only knows half of the pass phrase. Outbound files use

public keys, so no pass phrase is needed.

PGP End Point Compatibility PGP is a standard encryption technology that can use any of several off¬the¬shelf PGP programs to encrypt or decrypt the data on many different platforms. No special proprietary programs are needed at the remote endpoints. Locally, DataExpress uses the Edge PGP program from Authora, which follows the OpenPGP stan-dard, defined in RFC 1991 and RFC 2440, and is compliant with FIPS PUB 140 testing from the National Institute of Standards and Technol-ogy. This program can handle both the older RSA or RS keys and the newer DSS/DH keys, and will use the newer key by default. This license for the Edge program must be purchased separately

from Authora.

PGP DataExpress encryption options provide the fol-lowing features: • PGP bi¬directional encryption/decryption functions • Support for unstructured and entry sequenced plain¬text files

and unstructured encrypted files. • Compression capabilities for efficient transmissions • Compliant to standards so it can inter¬operate with programs

on a variety of platforms • Double¬custody management of the pass¬phrase for private

decryption keys. • Profiles (JCL files) to enable a rich set of advanced features. • Ability to automatically update public encryption keys from

remote endpoints. External key maintenance tools can also be

used.

The concentration of data and communications afforded by networks of computers makes them attractive targets for computer crime. Reacting to security breaches after-the-fact can be very expensive. Business down-time, financial damages, legal liabilities and the repair of a damaged company reputation can easily cost ten times the expense of closing the security holes that enabled the breaches. It is far more cost efficient to imple-ment security mechanisms to prevent abuse of information systems and communications.