Robert Book's PGP Keys

If you already know what PGP is and just want to download my public keys, skip to here.

When you send e-mail, your message travels through many computers on the Internet on its way to its intended recipient. Anyone with appropriate access to any of those computers can read your mail. In short sending e-mail is more like writing a message on a postcard than putting a letter in an envelope. The mailman can read your postcards; the system administrators and possibly other people can read your e-mail. Some people think that if you aren't doing anything illegal, this is no problem -- but if you found out everyone at the post office was reading all your letters, you probably wouldn't be happy. This is the way it is with e-mail. Another way of looking at it is, everyone knows you aren't doing anything illegal on the toilet, but you still wouldn't want the whole world to watch.

The only way around this problem is the encrypt your e-mail. The best publicly-available way to encrypt e-mail is with a protocol called PGP. (PGP stands for ``Pretty Good Privacy.'') This protocol allows you to encrypt e-mail without have to pre-arrange passwords or secret keys, either via e-mail (which would miss the point since anyone could read the passwords), or some other method (which would be inconvenient). The idea is, everyone has a ``key pair'' consisting of a ``private key'' and a ``public key.'' Any message encrypted with a given person's public key can be decrypted only with that person's private key. So, public keys can be published for the whole world to see, sent unencrypted by e-mail, or stored on web pages like this one. If you want to send me encrypted mail, use one of my public keys below. I keep my private key private, of course, so only I can read messages sent to me. If you want me to be able to send you encrypted mail, generate a key pair and send me the public key. Keep the private key to yourself.

You can also use PGP to ``sign'' messages with a digital signature. The role of the keys here is reversed -- you sign messages with your private key, and anyone can verify with your public key that the message is really from you and has not been altered.

PGP is available for Windows, Mac, DOS, Linux, Unix, and probably several other types of computers also. To download PGP from within the USA or Canada, click here. To download PGP from anywhere else, or for more information, click here. PGP is free for non-commercial use. There is also a program called GPG (GNU Privacy Guard, also known as GnuPG) which is fully compatible and has different features, available for Windows, Linux, and Unix, and free for any use, commercial or otherwise. For more information and to download GPG, click here. For more information on encryption generally and PGP in particular, click here. For a brief bio of Philip Zimmerman, the creator of PGP, and lots of other useful links, click here.

I have three main PGP Public Keys. They have different e-mail addresses associated with them, but that's just to help me keep track of the keys. You can use any key with any e-mail address. All the mail goes to the same place anyway. In particular, mail address to rbook@pobox.com will reach me even after I leave the university. Consider this my ``permanent'' e-mail address.

Key number "5DF4DCC5" (rbook@pobox.com) is my ``more secure'' key. The corresponding private key is not stored on a computer normally connected to the Internet, so I only use it when I am at my own personal computer. It is thus less convenient, though more secure. It may take longer for me to read and respond to messages encrypted with this key. Use it for messages that actually ought to be kept secret. This key is also used to sign the ``less secure'' key below.

Key number "C1D8AD37" (prbook@gsbphd.uchicago.edu) is my ``less secure'' key. The corresponding private key is stored on the shared Unix computer which is always connected to the Internet. This is also the computer on which I normally receive e-mail, so it is very convenient, since I can access it whenever I read my e-mail. Of course, if you know anything about PGP, you know that important keys should not be stored this way. It is a trade-off between convenience and security. I can respond more quickly to messages encrypted with this key than message encrypted with the ``more secure'' key, but the passphrase is vulnerable to keyboard sniffers or anyone with root access. Use this key if it would not be all that horrible if someone were to discover their content. Think of this key as placing your message in an envelope, but not a lock-box. This ``less secure'' key is signed with the ``more secure'' key.

The above keys are DSS/DH keys, compatible with PGP versions 5.0 and above, and GnuPG.

Key number "03967911" (prbook@gsbphd.uchicago.edu) is an RSA key, compatible with PGP versions 2.6 and below. It is ``less secure'' as defined above. Use this key if you have an older version of PGP that does not support DSS/DH keys. (RSA keys are not supported by GnuPG versions prior to 1.0.3. They are supported by all versions of PGP, as far as I know.)

Key IDs and fingerprints are in the following block, which is signed with the ``more secure'' key. (PGP uses key fingerprints to verify that keys have been downloaded correctly and not altered by clever evil people.) The actual keys follow the fingerprint block.

Key Fingerprints:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Type bits      keyID      Date       User ID

DSS 2048/1024 0x5DF4DCC5 1999/02/01 Robert A. Book (rbook@uchicago.edu)
    Key fingerprint =  FCDE 3E91 A93A E97E  1E6C AF48 F13C D6A5  5DF4 DCC5
    ``More Secure''

DSS 2048/1024 0xC1D8AD37 2000/08/22 Robert A. Book (prbook@gsbphd.uchicago.edu)
    Key fingerprint =  BEBB A1B6 E779 FD35  78BF 59ED 45C1 D6E3  C1D8 AD37
    ``Less Secure''

RSA 1024      0x03967911 2000/06/01 Robert A. Book (prbook@gsbphd.uchicago.edu)
    Key fingerprint =  CE11 C806 B9D0 754B  2DC7 8455 97D3 CC8C
    ``Less Secure''

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use 

iQA/AwUBO0Tn1PE81qVd9NzFEQKTIQCeL6xVMBfZJja46vQjMUCQGaZ8tdYAoKel
Bb/sVfJEUfq3+qWPlNG83ieZ
=2Ixi
-----END PGP SIGNATURE-----

The actual keys:

``More Secure''

``Less Secure''

``Less Secure'' RSA key (for PGP version 2.6 and below)

Last Update: August 1, 2001

Free counters provided by
Honesty Communications.

Robert Book's home page
The University of Chicago home page
Graduate School of Business home page