PGP Desktop Storage

Overview

Mobile computers and file servers have quickly emerged as industry-standard tools for enabling user productivity and collaboration. Unfortunately, unprotected mobile devices and data pose a critical risk to an enterprise's most sensitive data. Exposure of this data can result in financial loss, legal ramifications, and brand damage.

PGP® Desktop Storage provides flexible, multilayered encryption using PGP® Whole Disk Encryption to protect confidential files stored on local desktop or laptop systems and using PGP® NetShare to securely share files with selected colleagues. This approach ensures that only authorized users can access sensitive data, fulfilling partner and regulatory requirements for information partitioning and security.

• Easy, automatic operation-Protects files and disks without changing the user experience.
• Enforced security policies-Automatically enforce data protection with centrally managed policies.
• Accelerated deployment-Achieves disk and network encryption using the existing infrastructure.
• Reduced operation costs-Result from centrally automating encryption policies.

As a PGP® Encryption Platform-enabled application, PGP Desktop Storage can be used with PGP Universal™ Server to manage existing policies, users, keys, and configurations, expediting deployment and policy enforcement. PGP Desktop Storage can also be used in combination with other PGP® encryption applications to provide multiple layers of security.

Technical Specifications

Technical Specifications

Supported Operating Systems

• Microsoft Windows Vista (all 32-bit and 64-bit versions, including Service Pack 1)
• Microsoft Windows XP Professional 32-bit (Service Pack 1, 2 and 3)
• Microsoft Windows XP Professional 64-bit (Service Pack 1 and 2)
• Microsoft Windows XP Home
• Microsoft Windows XP Tablet PC Edition 2005 (requires attached keyboard)
• Microsoft Windows 2003 Server (Service Pack 1 and 2)*
• Microsoft Windows 2000 Professional (Service Pack 4)

* Full disk encryption functionality is not supported on Windows 2000 Server or 2003 Server.

Localization

• English
• German
• Japanese

Authentication Options

• OpenPGP RFC 4880 keys
• X.509 keys

Messaging Security Standards

• PGP/MIME RFC 3156
• OpenPGP RFC 4880
• S/MIME v3 RFC 2633
• X.509 v3

Symmetric Key Algorithms

• AES (up to 256-bit keys)
• CAST
• TripleDES
• IDEA
• Twofish

Symmetric Key Algorithms-PGP® Whole Disk Encryption

• AES 256-bit keys

Symmetric Key Algorithms-PGP® NetShare

• AES 256-bit keys in EME mode

Hashes

• SHA-2 (up to 512-bit hashes)
• SHA-1
• MD5
• RIPEMD-160

Public Key Algorithms

• Diffie-Hellman
• DSA (1024-bit keys only)
• RSA (up to 4096-bit keys)

Centralized Management Requirements

• PGP Universal™ Server 2.9

* PGP Universal Server requires a dedicated server.

Two-Factor Authentication

Supported USB Tokens-PGP NetShare, PGP® Virtual Disk, and PGP® Zip

PGP Desktop Storage recognizes and works with the following:

• DoD Common Access Cards (CACs) with the ActivCard Gold 2.0 profile
• Athena Smart Card Solutions smart cards, including the ASEKey USB token
• AET SafeSign smart cards, including ASEKey 1.0
• Axalto (formerly Schlumberger) smart cards, including the Cryptoflex 32K
• SafeNet smart cards, including iKey 2032
• Aladdin smart cards, including eToken PRO USB 16K, 32K, and 64K
• GemPlus smart cards, including SafesITe and GemXpresso Pro, using GemSafe Libraries 4.2.0-015 (Gold)

PGP Desktop Storage also recognizes and works with smart cards from other vendors if the vendor includes a standards-based PKCS-11 library in its software drivers.

Supported Pre-Boot Authentication Smart Cards and USB Tokens

The following smart card readers are supported for communicating to a smart card at pre-boot time. These readers can be used with any supported removable smart card (it is not necessary to use the same brand of smart card and reader). Any CCID smart card reader is supported. The following readers have been tested by PGP Corporation:

• OMNIKEY CardMan 3121 USB for desktop systems
• OMNIKEY CardMan 6121 USB for mobile systems
• ActivIdentity USB 2.0 reader
• Reiner SCT CyberJack pinpad
• Athena ASEDrive IIIe USB reader

PGP® Whole Disk Encryption supports the following smart cards for pre-boot authentication:

• ActiveIdentity ActivClientCAC cards, 2005 models.
• Aladdin eToken 64K, 2048-bit RSA-capable*
• Aladdin eToken PRO USB Key 32K, 2048-bit RSA-capable¹
• Aladdin eToken PRO without 2048-bit capability (older smart cards)¹
• Athena ASEKey Crypto USB Token for Microsoft ILM²
• Athena ASECard Crypto Smart Card for Microsoft ILM²
• EMC RSA SecurID SID800 Token³
• Charismathics CryptoIdentity plug 'n' crypt Smart Card only stick
• S-Trust StarCOS smart card⁴
• Rainbow iKey 3000

¹ Other Aladdin eTokens, such as tokens with flash, should work provided they are APDU compatible with the supported tokens. OEM versions of Aladdin eTokens, such as those issued by VeriSign, should work provided they are APDU compatible with the supported tokens.
² The Athena tokens are supported only for credential storage.
³ This token is supported only for credential storage. SecurID is not supported.
⁴ S-Trust SECCOS cards are not supported.

FAQ

General

What is PGP Desktop Storage and why is it important?

PGP Desktop Storage combines the network storage encryption of PGP NetShare with the transparent full disk encryption of PGP Whole Disk Encryption, securing the entire contents of a disk, including system and temporary files. PGP Desktop Storage provides secure, shared file encryption without requiring changes to end-user applications, processes, and workflow or to an organization's storage infrastructure. IT backup and archiving applications remain as is. PGP Desktop Storage enables complete role separation between those authorized to create, change, and view content and systems administration personnel. PGP Desktop Storage whole disk encryption capability provides worry-free protection against unauthorized access of private and confidential data.

What business problem does PGP Desktop Storage solve?

Network file servers can contain the most sensitive customer, patient, financial, or intellectual property data. Likewise, data stored on systems or removable media can be easily exposed due to system loss or theft. PGP Desktop Storage allows organizations to meet audit and compliance requirements while securing sensitive data stored on file servers, desktop and laptop systems, and removable media.

What are the key benefits of PGP Desktop Storage?

PGP Desktop Storage provides the following benefits:

• Enforces data security policies-Used in combination with PGP Universal™ Server, PGP Desktop Storage automatically secures protected directories based on policy while locking down the entire contents of a system drive.
• Reduces operational costs, accelerates deployment-By operating in the background, PGP Desktop Storage can be quickly deployed without the need for special user training or increased help desk calls. As a PGP Encryption Platform–enabled application, PGP Desktop Storage can share policies across groups and quickly tailor them, allowing administrators to deploy PGP Desktop Storage and focus on other projects.

How does PGP Desktop Storage work?

Using PGP NetShare technology, PGP Desktop Storage operates as a Windows File Filter, enabling transparent encryption and decryption of files, including those stored over the network. PGP NetShare uses public key cryptography to protect folders and files, allowing access only to specific authorized users. The PGP Whole Disk Encryption engine operates at a system level between the operating system and the disk drive, providing user-transparent, sector-by-sector disk encryption and decryption. A successful pre-boot authentication unlocks the decryption key, enabling users to work without any additional changes to their experience. When centrally managed, PGP Desktop Storage key management, policy, and software updates are managed by PGP Universal Server.

What is the end-user experience?

For end users, PGP Desktop Storage operates in the background, securing protected directories (local or networked) and the entire contents of disk drives. If allowed by policy (or if not managed by PGP Universal Server), encryption policies and change configuration can be made through the PGP Desktop Storage application interface. When encryption operations are performed, the PGP Desktop Storage notifier window alerts users that an encryption operation is being performed and its status.

What's new in PGP Desktop Storage 9.9?

PGP Desktop Storage 9.9 is a package that includes PGP Whole Disk Encryption 9.9 and PGP NetShare 9.9.

New features in PGP Desktop Whole Disk Encryption 9.9 include the following:

• Mac OS X Support–Supports whole disk encryption with pre-boot authentication for Mac OS X-based systems.
• Expanded International Keyboard Support–Supports 38 keyboard locales.

New features in PGP NetShare 9.9 include the following:

• Centrally defined data protection–Defines policy to protect files stored in specific directories or based on application, enforcing security without impacting user behavior.*
• Remote Application Delivery–Supports data protection in Citrix and Microsoft Terminal Server sessions (Remote Desktop)

* Requires PGP Universal Server 2.9

What languages (localization) does PGP Desktop Storage support?

The PGP Desktop Storage user interface is localized in English, German, and Japanese.

Is the source code available for download?

Yes. To validate the integrity of its products, PGP Corporation releases all product source code, including PGP Desktop Storage, for peer review. For more information, see PGP® Source Code.

How does PGP Desktop Storage fit into the PGP Encryption Platform architecture?

PGP Desktop Storage is a PGP Encryption Platform–enabled application managed by PGP Universal Server. PGP Desktop Storage account management, key management, and policy and software update distribution are automated for all PGP Encryption Platform–enabled applications.