Imported from previous forum
We are deploying PGP on our FIX front end processors and have received various comments from some clients that seem to indicate the use of PGP-MD5-DES is not fully understood. Some have even denied that they use PGP.
This is contrary to what I believe and am looking for feedback from anyone who has been talking to clients using FIX over dedicated lines. Has everyone/anyone standardized on the NAI PGP Suite?
Note - Our FIX FEPs areconnected to both the internet and dedicated lines. (of course we firewall)
[ original email was from Ryan Pierce - rpierce@taltrade.com ]
> We are deploying PGP on our FIX front end processors and have received various comments from some clients that seem to indicate the use of PGP-MD5-DES is not fully understood. Some have even denied that they use PGP.
Are these clients claiming that they are capable of doing ANY encryption at all? I believe some firms use DES in ECB mode, but that’s even more rare than PGP-DES-MD5.
From what I have seen, not that many firms actually use any form of FIX encryption. Most firms either:
-
Buy private point to point leased lines, ATM, or Frame Relay (read: NOT Internet), and put trust in the nation’s telecommunications carriers, or
-
Use a VPN solution where the network, not the FIX engine, handles encryption and authentication.
It is my hope that SSLv3 and/or TLS will be standardized upon as a recommended FIX encryption mechanism. One benefit of this approach is that makers of FIX engines can choose to implement it natively, or it can be retrofitted on to an existing engine with an external proxy.
While I’m looking forward to the SSLv3 and/or TLS investigative effort, my experience is different than Ryan’s as far as current PGP-DES-MD5 usage goes. Our firm has more than 40 FIX sessions implementing PGP-DES-MD5. The algorithm and approach are pretty well documented within “Specifications”, “App Notes”. PGP is used on the Logon messages to exchange a random DES session key. Subsequent messages use DES for the crypto and contain a MD5 digital signature.
Certainly my experience with FIX encryption is that PGP-DES-MD5 is the predominant choice. Most of the DES only implementations have been in place for a while. Most firms use PGP software from Network Associates formerly PGP Inc. formerly ViaCrypt (Phil Zimmerman’s base), however, I have heard that public domain PGP is available (Ireland and Australia, I believe) and can be used.
> > We are deploying PGP on our FIX front end processors and have received various comments from some clients that seem to indicate the use of PGP-MD5-DES is not fully understood. Some have even denied that they use PGP.
>
> Are these clients claiming that they are capable of doing ANY encryption at all? I believe some firms use DES in ECB mode, but that’s even more rare than PGP-DES-MD5.
>
> From what I have seen, not that many firms actually use any form of FIX encryption. Most firms either:
>
> 1. Buy private point to point leased lines, ATM, or Frame Relay (read: NOT Internet), and put trust in the nation’s telecommunications carriers, or
>
> 2. Use a VPN solution where the network, not the FIX engine, handles encryption and authentication.
>
> It is my hope that SSLv3 and/or TLS will be standardized upon as a recommended FIX encryption mechanism. One benefit of this approach is that makers of FIX engines can choose to implement it natively, or it can be retrofitted on to an existing engine with an external proxy.
>
>
[ original email was from Alik Rivkind - alik@btobits.com ]
For the purpose of preventing the program from calling an external program (PGP) what exactly algorinthms is used in PGP-DES-MD5 schema? As I understand, base text is encrypted with DES, message digest is built according to MD5 and DES secret key is encrypted with recipient public key. Is that right? And what algorithm is used to generate key pair?
> While I’m looking forward to the SSLv3 and/or TLS investigative effort, my experience is different than Ryan’s as far as current PGP-DES-MD5 usage goes. Our firm has more than 40 FIX sessions implementing PGP-DES-MD5. The algorithm and approach are pretty well documented within “Specifications”, “App Notes”. PGP is used on the Logon messages to exchange a random DES session key. Subsequent messages use DES for the crypto and contain a MD5 digital signature.
>
> Certainly my experience with FIX encryption is that PGP-DES-MD5 is the predominant choice. Most of the DES only implementations have been in place for a while. Most firms use PGP software from Network Associates formerly PGP Inc. formerly ViaCrypt (Phil Zimmerman’s base), however, I have heard that public domain PGP is available (Ireland and Australia, I believe) and can be used.
>
>
> > > We are deploying PGP on our FIX front end processors and have received various comments from some clients that seem to indicate the use of PGP-MD5-DES is not fully understood. Some have even denied that they use PGP.
> >
> > Are these clients claiming that they are capable of doing ANY encryption at all? I believe some firms use DES in ECB mode, but that’s even more rare than PGP-DES-MD5.
> >
> > From what I have seen, not that many firms actually use any form of FIX encryption. Most firms either:
> >
> > 1. Buy private point to point leased lines, ATM, or Frame Relay (read: NOT Internet), and put trust in the nation’s telecommunications carriers, or
> >
> > 2. Use a VPN solution where the network, not the FIX engine, handles encryption and authentication.
> >
> > It is my hope that SSLv3 and/or TLS will be standardized upon as a recommended FIX encryption mechanism. One benefit of this approach is that makers of FIX engines can choose to implement it natively, or it can be retrofitted on to an existing engine with an external proxy.
> >
> >
>
There are API-based vs. external program call-based implementations of PGP. The key pairs are generated by the PGP implementation software. I believe Phil Zimmerman (the author of PGP)published the actual source code to PGP in a book (which later resulting in a legal battle with the US government re: crypto export laws). You exchange public keys out of band from the FIX messaging session. When constructing or parsing the Logon message, you invoke the PGP algorithm which uses your private key and the public key of your counterparty. I hope this helps.
> For the purpose of preventing the program from calling an external program (PGP) what exactly algorinthms is used in PGP-DES-MD5 schema? As I understand, base text is encrypted with DES, message digest is built according to MD5 and DES secret key is encrypted with recipient public key. Is that right? And what algorithm is used to generate key pair?
>
> > While I’m looking forward to the SSLv3 and/or TLS investigative effort, my experience is different than Ryan’s as far as current PGP-DES-MD5 usage goes. Our firm has more than 40 FIX sessions implementing PGP-DES-MD5. The algorithm and approach are pretty well documented within “Specifications”, “App Notes”. PGP is used on the Logon messages to exchange a random DES session key. Subsequent messages use DES for the crypto and contain a MD5 digital signature.
> >
> > Certainly my experience with FIX encryption is that PGP-DES-MD5 is the predominant choice. Most of the DES only implementations have been in place for a while. Most firms use PGP software from Network Associates formerly PGP Inc. formerly ViaCrypt (Phil Zimmerman’s base), however, I have heard that public domain PGP is available (Ireland and Australia, I believe) and can be used.
> >
> >
> > > > We are deploying PGP on our FIX front end processors and have received various comments from some clients that seem to indicate the use of PGP-MD5-DES is not fully understood. Some have even denied that they use PGP.
> > >
> > > Are these clients claiming that they are capable of doing ANY encryption at all? I believe some firms use DES in ECB mode, but that’s even more rare than PGP-DES-MD5.
> > >
> > > From what I have seen, not that many firms actually use any form of FIX encryption. Most firms either:
> > >
> > > 1. Buy private point to point leased lines, ATM, or Frame Relay (read: NOT Internet), and put trust in the nation’s telecommunications carriers, or
> > >
> > > 2. Use a VPN solution where the network, not the FIX engine, handles encryption and authentication.
> > >
> > > It is my hope that SSLv3 and/or TLS will be standardized upon as a recommended FIX encryption mechanism. One benefit of this approach is that makers of FIX engines can choose to implement it natively, or it can be retrofitted on to an existing engine with an external proxy.
> > >
> > >
> >
>