No 40-bit PGP

In "Encryption for a Small Planet" (March), Thom Stark wrote that Pretty Good Privacy, Inc., is "producing 40-bit exportable and 128-bit domestic versions of its Viacrypt commercial PGP product line." This is not true. PGP keys are at least 128 bits long in all versions of the product. More than a factual error, this undermines the history and reputation of PGP.

Human-rights organizations use PGP to protect the identity of witnesses. Others use it to protect the privacy of everyday correspondence. In either case, no one wants to try to protect their communicati ons with weak encryption. Forty-bit keys can be broken in less than a second by any major government.

My company doesn't do weak cryptography. We now have a strategy based on international agreements for strong cryptographic use worldwide that does not violate U.S. export law yet does not compromise the integrity, strength, or interoperability of PGP software. To learn more about our position, see our Web page at http://www.pgp.com .

Philip Zimmermann
Chairman and Chief Technology Officer
Pretty Good Privacy, Inc.
prz@pgp.com

We do regret the error. At press time, PGP, Inc., was working on international trademark agreements that would allow licensing of the PGP trademark for software that meets the company's standards for security and user control.--Eds.