Table 9: How is RSA supported in modern PGP versions?
1 RSAREF = special non-commercial RSA library provided by RSADSI 2 BSAFE = standard commercial RSA library purchased from RSADSI 3 CryptoAPI = MS CryptoAPI including RSA code licensed by MS from RSADSI. RSA support via CryptoAPI is only provided on machines with “domestic” (e.g. 128-bit) browsers. It is important to note that, apart from RSA support in the highlighted versions, PGP does not rely on CryptoAPI (or any other 3rd party libraries…) for any other cryptographic primitive. Hash functions, symmetric ciphers, DSS etc are all provided by in house code. I can confirm that International builds by: • Stale Schumacher, as distributed from www.pgpi.com • CKT builds by Imad R. Faiad • “official” NAI international builds from PGPInternational all use the PGPInc home grown code rather than RSAREF, CryptoAPI or BSAFE. From a security perspective, I would certainly say that it makes senses at the moment to avoid any versions of PGP (e.g. v6.0.2) that rely on CryptoAPI if you need RSA sup
