Embed Size (px)
Citation preview
Using GPG Strong Encryption for Fun and Profit
George Beranek [email protected] (630) 252-7219
GPG Key: 0x9E3B3CBF
Senior Security and Network Administrator
Argonne National Laboratory
NETSECURE 07, Illinois Institute of Technology's Rice Campus Center for Professional Development
21-Mar-2007 Room 103 11:00 am – 11:45 am
http://www.cpd.iit.edu/netsecure07/
Using GPG Strong Encryption for Fun and Profit
George Beranek, Argonne National Laboratory, IIT NetSecure `07
21-Mar-2007
GPG (GNU Privacy Guard or GnuPG) is a most excellent but highly underutilized way to keep your private documents and communications private. This talk will familiarize you with strong encryption free and available to the public.
The presentation will begin with a brief history including several attempts by the govenrment to to suppress the availability of strong encryption. This will be followed by a discussion of PGP, OpenPGP, GnuPG Public/Private key encryption, digital signatures, web of trust, keyservers, key creation, keyLookup, exporting, importing, revoking and signing.
Practical examples of public key and symmetric (shared secret) file encryption will be presented including integration of GPG with Mozilla Thunderbird and other email tools. GPG front ends for Windows and Linux shall also be touched upon.
3
PGP
PGP Encryption (Pretty Good Privacy) is a computer program that provides cryptographic privacy and authentication. It was originally created by Philip Zimmermann in 1991.
PGP and other similar products follow the OpenPGP standard (RFC 2440) for encrypting and decrypting data. Other such programs are Patrick Townsend & Associates, Authora Inc., EasyByte Cryptocx, Veridis, and the GNU Privacy Guard.
Philip R. Zimmermann, Why I Wrote PGP, Part of the Original 1991 PGP User's Guide (updated in 1999) PGP empowers people to take their privacy into their own hands. There has been a growing social need for it. That's why I wrote it.
http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html http://en.wikipedia.org/wiki/Pretty_Good_Privacy
4
Philip Zimmermann, Why I Wrote PGP
"Whatever you do will be insignificant, but it is very important that you do it." –Mahatma Gandhi.
It's personal. It's private. And it's no one's business but yours. You may be planning a political campaign, discussing your taxes, or having a secret romance. Or you may be communicating with a political dissident in a repressive country. Whatever it is, you don't want your private electronic mail (email) or confidential documents read by anyone else. There's nothing wrong with asserting your privacy. Privacy is as apple-pie as the Constitution.
The right to privacy is spread implicitly throughout the Bill of Rights. But when the United States Constitution was framed, the Founding Fathers saw no need to explicitly spell out the right to a private conversation. That would have been silly. Two hundred years ago, all conversations were private. If someone else was within earshot, you could just go out behind the barn and have your conversation there. No one could listen in without your knowledge. The right to a private conversation was a natural right, not just in a philosophical sense, but in a law-of-physics sense, given the technology of the time.
But with the coming of the information age, starting with the invention of the telephone, all that has changed. Now most of our conversations are conducted electronically. This allows our most intimate conversations to be exposed without our knowledge. Cellular phone calls may be monitored by anyone with a radio. Electronic mail, sent across the Internet, is no more secure than cellular phone calls. Email is rapidly replacing postal mail, becoming the norm for everyone, not the novelty it was in the past.
Until recently, if the government wanted to violate the privacy of ordinary citizens, they had to expend a certain amount of expense and labor to intercept and steam open and read paper mail. Or they had to listen to and possibly transcribe spoken telephone conversation, at least before automatic voice recognition technology became available. This kind of labor-intensive monitoring was not practical on a large scale. It was only done in important cases when it seemed worthwhile. This is like catching one fish at a time, with a hook and line. Today, email can be routinely and automatically scanned for interesting keywords, on a vast scale, without detection. This is like driftnet fishing. And exponential growth in computer power is making the same thing possible with voice traffic.
5
Perhaps you think your email is legitimate enough that encryption is unwarranted. If you really are a law-abiding citizen with nothing to hide, then why don't you always send your paper mail on postcards? Why not submit to drug testing on demand? Why require a warrant for police searches of your house? Are you trying to hide something? If you hide your mail inside envelopes, does that mean you must be a subversive or a drug dealer, or maybe a paranoid nut? Do law-abiding citizens have any need to encrypt their email?
What if everyone believed that law-abiding citizens should use postcards for their mail? If a nonconformist tried to assert his privacy by using an envelope for his mail, it would draw suspicion. Perhaps the authorities would open his mail to see what he's hiding. Fortunately, we don't live in that kind of world, because everyone protects most of their mail with envelopes. So no one draws suspicion by asserting their privacy with an envelope. There's safety in numbers. Analogously, it would be nice if everyone routinely used encryption for all their email, innocent or not, so that no one drew suspicion by asserting their email privacy with encryption. Think of it as a form of solidarity.
Senate Bill 266, a 1991 omnibus anticrime bill, had an unsettling measure buried in it. If this non-binding resolution had become real law, it would have forced manufacturers of secure communications equipment to insert special "trap doors" in their products, so that the government could read anyone's encrypted messages. It reads, "It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." It was this bill that led me to publish PGP electronically for free that year, shortly before the measure was defeated after vigorous protest by civil libertarians and industry groups.
The 1994 Communications Assistance for Law Enforcement Act (CALEA) mandated that phone companies install remote wiretapping ports into their central office digital switches, creating a new technology infrastructure for "point-and-click" wiretapping, so that federal agents no longer have to go out and attach alligator clips to phone lines. Now they will be able to sit in their headquarters in Washington and listen in on your phone calls. Of course, the law still requires a court order for a wiretap. But while technology infrastructures can persist for generations, laws and policies can change overnight. Once a communications infrastructure optimized for surveillance becomes entrenched, a shift in political conditions may lead to abuse of this new-found power. Political conditions may shift with the election of a new government, or perhaps more abruptly from the bombing of a federal building.
6
A year after the CALEA passed, the FBI disclosed plans to require the phone companies to build into their infrastructure the capacity to simultaneously wiretap 1 percent of all phone calls in all major U.S. cities. This would represent more than a thousandfold increase over previous levels in the number of phones that could be wiretapped. In previous years, there were only about a thousand court-ordered wiretaps in the United States per year, at the federal, state, and local levels combined. It's hard to see how the government could even employ enough judges to sign enough wiretap orders to wiretap 1 percent of all our phone calls, much less hire enough federal agents to sit and listen to all that traffic in real time. The only plausible way of processing that amount of traffic is a massive Orwellian application of automated voice recognition technology to sift through it all, searching for interesting keywords or searching for a particular speaker's voice. If the government doesn't find the target in the first 1 percent sample, the wiretaps can be shifted over to a different 1 percent until the target is found, or until everyone's phone line has been checked for subversive traffic. The FBI said they need this capacity to plan for the future. This plan sparked such outrage that it was defeated in Congress. But the mere fact that the FBI even asked for these broad powers is revealing of their agenda.
Advances in technology will not permit the maintenance of the status quo, as far as privacy is concerned. The status quo is unstable. If we do nothing, new technologies will give the government new automatic surveillance capabilities that Stalin could never have dreamed of. The only way to hold the line on privacy in the information age is strong cryptography.
You don't have to distrust the government to want to use cryptography. Your business can be wiretapped by business rivals, organized crime, or foreign governments. Several foreign governments, for example, admit to using their signals intelligence against companies from other countries to give their own corporations a competitive edge. Ironically, the United States government's restrictions on cryptography in the 1990's have weakened U.S. corporate defenses against foreign intelligence and organized crime.
The government knows what a pivotal role cryptography is destined to play in the power relationship with its people. In April 1993, the Clinton administration unveiled a bold new encryption policy initiative, which had been under development at the National Security Agency (NSA) since the start of the Bush administration. The centerpiece of this initiative was a government-built encryption device, called the Clipper chip, containing a new classified NSA encryption algorithm. The government tried to encourage private industry to design it into all their secure communication products, such as secure phones, secure faxes, and so on. AT&T put Clipper into its secure voice products. The catch: At the time of manufacture, each Clipper chip is loaded with its own unique key, and the government gets to keep a copy, placed in escrow. Not to worry, though–the government promises that they will use these keys to read your traffic only "when duly authorized by law." Of course, to make Clipper completely effective, the next logical step would be to outlaw other forms of cryptography.
7
The government initially claimed that using Clipper would be voluntary, that no one would be forced to use it instead of other types of cryptography. But the public reaction against the Clipper chip was strong, stronger than the government anticipated. The computer industry monolithically proclaimed its opposition to using Clipper. FBI director Louis Freeh responded to a question in a press conference in 1994 by saying that if Clipper failed to gain public support, and FBI wiretaps were shut out by non-government-controlled cryptography, his office would have no choice but to seek legislative relief. Later, in the aftermath of the Oklahoma City tragedy, Mr. Freeh testified before the Senate Judiciary Committee that public availability of strong cryptography must be curtailed by the government (although no one had suggested that cryptography was used by the bombers).
The government has a track record that does not inspire confidence that they will never abuse our civil liberties. The FBI's COINTELPRO program targeted groups that opposed government policies. They spied on the antiwar movement and the civil rights movement. They wiretapped the phone of Martin Luther King Jr. Nixon had his enemies list. Then there was the Watergate mess. More recently, Congress has either attempted to or succeeded in passing laws curtailing our civil liberties on the Internet. Some elements of the Clinton White House collected confidential FBI files on Republican civil servants, conceivably for political exploitation. And some overzealous prosecutors have shown a willingness to go to the ends of the Earth in pursuit of exposing sexual indiscretions of political enemies. At no time in the past century has public distrust of the government been so broadly distributed across the political spectrum, as it is today.
Throughout the 1990s, I figured that if we want to resist this unsettling trend in the government to outlaw cryptography, one measure we can apply is to use cryptography as much as we can now while it's still legal. When use of strong cryptography becomes popular, it's harder for the government to criminalize it. Therefore, using PGP is good for preserving democracy. If privacy is outlawed, only outlaws will have privacy.
It appears that the deployment of PGP must have worked, along with years of steady public outcry and industry pressure to relax the export controls. In the closing months of 1999, the Clinton administration announced a radical shift in export policy for crypto technology. They essentially threw out the whole export control regime. Now, we are finally able to export strong cryptography, with no upper limits on strength. It has been a long struggle, but we have finally won, at least on the export control front in the US. Now we must continue our efforts to deploy strong crypto, to blunt the effects increasing surveillance efforts on the Internet by various governments. And we still need to entrench our right to use it domestically over the objections of the FBI.
PGP empowers people to take their privacy into their own hands. There has been a growing social need for it. That's why I wrote it.
8
Early History
Phil Zimmermann created the first version of PGP encryption in 1991. He had been a long-time anti-nuclear activist, and created PGP encryption so that like-minded people could securely use BBS systems and securely store messages and files. No license was required for non-commercial use. There was not even a nominal charge, and the complete source code was included with all copies. PGP encryption found its way onto Usenet and from there onto the Internet.
The ironic name, "Pretty Good Privacy", was inspired by the name of the grocery store featured in radio host Garrison Keillor's fictional town, Lake Wobegon. The grocery was "Ralph's Pretty Good Grocery".
PGP encryption rapidly acquired a considerable following around the world after it was released and found its way onto the Internet. Users and supporters included dissidents in totalitarian countries (some affecting letters to Zimmermann have been published, and some have been included in testimony before the US Congress), civil libertarians in other parts of the world (see Zimmermann's published testimony in various hearings), and the 'free communications' activists who call themselves cypherpunks. The cypherpunks provided both publicity and distribution.
9
Criminal investigation
Shortly after its release, PGP encryption found its way outside the US, and in February 1993 Zimmermann became the formal target of a criminal investigation by the US Government for "munitions export without a license". Cryptosystems using keys larger than 40 bits were then considered munitions within the definition of the US export regulations; PGP has never used keys smaller than 128 bits so it qualified at that time. Penalties for violation, if found guilty, were substantial. The investigation of Zimmermann was eventually closed without filing criminal charges against him or anyone else.
US export regulations regarding cryptography remain in force, but were liberalized substantially throughout the late 1990s. Since 2000, compliance with the regulations is also much easier. PGP encryption no longer meets the definition of a non-exportable weapon, and can be exported internationally except to 7 specific countries and a named list of groups and individuals.
10
U.S. Encryption Policy
The U.S. government does not want its citizens to use encryption that it cannot crack. To date, it has promoted this goal in several ways:
The Clipper chip. Mandated adoption of Clipper has been largely squashed due to pressure from the technical community, but the proposal occasionally resurfaces.
Export restrictions on encryption software. Software with encryption strength greater than 40 bits is classified "munitions" and must be specially licensed. (Yet, for some reason it is legal to export a book containing the source code to the algorithm!)
Legal action against people who publish, or seek to publish, encryption algorithms and software. For example, harassment of Philip Zimmerman over Pretty Good Privacy, and the recent restraint of publication of Daniel Bernstein's "Snuffle" algorithm.
Pressure on legislators to pass laws that restricts the use of encryption. This is most notable in recent proposals to create a "key escrow infrastructure". A key recovery system is where the government (or a third party) gets a copy of your encryption key. They're not supposed to use it without a warrant.
But, the genie is out of the bottle, there are numerous reasons that these attempts can never succeed.
http://www.rdrop.com/~half/Creations/Writings/Rants/Rants-Crypto.html
11
PGP 3
During this turmoil, Zimmermann's team worked on a new version of PGP encryption called PGP 3. This new version was to have considerable security improvements, including a new certificate structure which fixed small security flaws in the PGP 2.x certificates as well as permitting a certificate to include separate keys for signing and encryption. Furthermore, the experience with patent and export problems led them to eschew patents entirely. PGP 3 introduced use of the CAST-128 (a.k.a. CAST5) symmetric key algorithm, and the DSA and ElGamal asymmetric key algorithms, all of which were unencumbered by patents.
After the US Government criminal investigation ended in 1996, Zimmermann and his team started a company to produce new versions of PGP encryption. They merged with Viacrypt (to whom Zimmermann had sold commercial rights and who had licensed RSA directly from RSADSI) which then changed its name to PGP Incorporated. The newly combined Viacrypt/PGP team started work on new versions of PGP encryption based on the PGP 3 system. Unlike PGP 2, which was an exclusively command line program, PGP 3 was designed from the start as a software library allowing users to work from a command line or inside a GUI environment. The original agreement between Viacrypt and the Zimmermann team had been that Viacrypt would have even-numbered versions and Zimmermann odd-numbered versions. Viacrypt, thus, created a new version (based on PGP 2) that they called PGP 4. To remove confusion about how it could be that PGP 3 was the successor to PGP 4, PGP 3 was renamed and released as PGP 5 in May 1997.
12
OpenPGP Inside PGP Inc., there was still concern about patent issues. RSADSI was
challenging the continuation of the Viacrypt RSA license to the newly merged firm. PGP Inc adopted an informal internal standard called "Unencumbered PGP": "use no algorithm with licensing difficulties". Because of PGP encryption's importance worldwide (it is thought to be the most widely chosen quality cryptographic system), many wanted to write their own software that would interoperate with PGP 5. Zimmermann became convinced that an open standard for PGP encryption was critical for them and for the cryptographic community as a whole. In July 1997, PGP Inc. proposed to the IETF that there be a standard called OpenPGP. They gave the IETF permission to use the name OpenPGP to describe this new standard as well as any program that supported the standard. The IETF accepted the proposal and started the OpenPGP Working Group.
OpenPGP is on the Internet Standards Track; the current specification is RFC 2440 (July 1998). OpenPGP is still under active development and a follow-on to RFC 2440 is being actively finalized by the OpenPGP working group as of January 2006.
The Free Software Foundation has developed its own OpenPGP-compliant program called GNU Privacy Guard (GnuPG). GnuPG is freely available together with all source code under the GNU General Public License (GPL) and is maintained separate from several GUIs. Several other vendors have also developed OpenPGP-compliant software.
http://www.openpgp.org/
13
Network Associates acquisition
In December, 1997 PGP Inc. was acquired by Network Associates, Inc. Zimmermann and the PGP team became NAI employees. NAI continued to pioneer export through software publishing, being the first company to have a legal export strategy by publishing source code. Under its aegis, the PGP team added disk encryption, desktop firewalls, intrusion detection, and IPsec VPNs to the PGP family. After the export regulation liberalizations of 2000 which no longer required publishing of source, NAI stopped releasing source code, over the PGP team's objection. There was consternation amongst PGP users worldwide at this and, inevitably, some conspiracy theories as well.
In early 2001, Zimmermann left NAI. He served as Chief Cryptographer for Hush Communications, who provide an OpenPGP-based email service, Hushmail. He has also worked with Veridis and other companies. In October, 2001, NAI announced that its PGP assets were for sale and that it was suspending further development of PGP encryption. The only remaining asset kept was the PGP E-Business Server (the original PGP Commandline). In February 2002, NAI cancelled all support for PGP products, with the exception of the re-named commandline product. NAI (now McAfee) continues to sell and support the product under the name McAfee E-Business Server.
14
Current situation
In August 2002, several ex-PGP team members formed a new company, PGP Corporation, and bought the PGP assets (except for the command line version) from NAI. PGP Corporation is supporting existing PGP users and honoring NAI support contracts. Zimmermann now serves as a special advisor and consultant to PGP Corporation, as well as continuing to run his own consulting company. In 2003 PGP Corporation created a new server-based product offering called PGP Universal. In mid-2004, PGP Corporation shipped its own command line version called PGP Command Line, which integrates with the other PGP Encryption Platform applications. In 2005 PGP Corporation made its first acquisition - the German software company Glueck and Kanja Technology AG which is now the German headquarters in Frankfurt (PGP Deutschland AG [1]). Since the 2002 purchase of NAI PGP assets, PGP Corporation has offered worldwide PGP technical support from their office in Draper, Utah.
http://www.pgp.com/
15
GnuPG - The GNU Privacy Guard GnuPG is the GNU project's complete and free implementation of the OpenPGP
standard as defined by RFC2440 . GnuPG allows to encrypt and sign your data and communication, features a versatile key managment system as well as access modules for all kind of public key directories. GnuPG, also known as GPG, is a command line tool with features for easy integration with other applications. A wealth of frontend applications and libraries are available. Version 2 of GnuPG also also provides support for S/MIME.
GnuPG is Free Software (meaning that it respects your freedom). It can be freely used, modified and distributed under the terms of the GNU General Public License .
GnuPG comes in two flavours: 1.4.7 is the well known and portable standalone version, whereas 2.0.3 is the enhanced and somewhat harder to build version.
Project Gpg4win provides a Windows version of GnuPG. It is nicely integrated into a installer and features several frontends as well as (German) manuals.
Project Aegypten developed the S/MIME functionality in GnuPG 2. http://www.gnupg.org/ GnuPG makes uses of several cryptographic concepts including symmetric ciphers,
public-key ciphers, and one-way hashing. You can make basic use GnuPG without fully understanding these concepts, but in order to use it wisely some understanding of them is necessary.
http://www.gnupg.org/gph/en/manual.html#CONCEPTS
16
GnuPG - History The GNU Privacy Guard (GnuPG or GPG) is a free software replacement for the
PGP suite of cryptographic software, released under the GNU General Public License. It is a part of the Free Software Foundation's GNU software project, and has received major funding from the German government. GnuPG is completely compliant with RFC 2440, the IETF standard for OpenPGP. Current versions of PGP (and Veridis' Filecrypt) are interoperable with GnuPG and other OpenPGP-compliant systems. Although some older versions of PGP are also interoperable, not all features of newer software are supported by the older software.
GnuPG was initially developed by Werner Koch. Version 1.0.0 was released on September 7, 1999. The German Federal Ministry of Economics and Technology funded the documentation and the port to Microsoft Windows in 2000.
Because GnuPG is an OpenPGP standard compliant system, the history of OpenPGP is of importance. It was designed to interoperate with PGP, the email encryption protocol developed by Phil Zimmermann. See PGP for more information.
Version 2.0 was released November 13, 2006. The old stable 1.x branch, whose last version is 1.4.7 will be continued in parallel with the new GnuPG 2 series, because there were significant changes in the architecture of the program which will not fit every purpose.
17
Symmetric ciphers
A symmetric cipher is a cipher that uses the same key for both encryption and decryption. Two parties communicating using a symmetric cipher must agree on the key beforehand. Once they agree, the sender encrypts a message using the key, sends it to the receiver, and the receiver decrypts the message using the key. As an example, the German Enigma is a symmetric cipher, and daily keys were distributed as code books. Each day, a sending or receiving radio operator would consult his copy of the code book to find the day's key. Radio traffic for that day was then encrypted and decrypted using the day's key. Modern examples of symmetric ciphers include 3DES, Blowfish, and IDEA.
A good cipher puts all the security in the key and none in the algorithm. In other words, it should be no help to an attacker if he knows which cipher is being used. Only if he obtains the key would knowledge of the algorithm be needed. The ciphers used in GnuPG have this property.
Since all the security is in the key, then it is important that it be very difficult to guess the key. In other words, the set of possible keys, i.e., the key space, needs to be large. While at Los Alamos, Richard Feynman was famous for his ability to crack safes. To encourage the mystique he even carried around a set of tools including an old stethoscope. In reality, he used a variety of tricks to reduce the number of combinations he had to try to a small number and then simply guessed until he found the right combination. In other words, he reduced the size of the key space.
18
Britain used machines to guess keys during World War 2. The German Enigma had a very large key space, but the British built specialized computing engines, the Bombes, to mechanically try keys until the day's key was found. This meant that sometimes they found the day's key within hours of the new key's use, but it also meant that on some days they never did find the right key. The Bombes were not general-purpose computers but were precursors to modern-day computers.
Today, computers can guess keys very quickly, and this is why key size is important in modern cryptosystems. The cipher DES uses a 56-bit key, which means that there are 256 possible keys. 256 is 72,057,594,037,927,936 keys. This is a lot of keys, but a general-purpose computer can check the entire key space in a matter of days. A specialized computer can check it in hours. On the other hand, more recently designed ciphers such as 3DES, Blowfish, and IDEA all use 128-bit keys, which means there are 2128 possible keys. This is many, many more keys, and even if all the computers on the planet cooperated, it could still take more time than the age of the universe to find the key.
19
Public-key ciphers
Classic methods for encryption only use one key for encryption. The sender encrypts the message with this key. To be able to decrypt this the receiver needs to have this very same key. This key must have been given to the receiver in a way, that others won't have had the opportunity to obtain this key. If somebody else does have the key, this method of encryption is useless.
The use of so-called Public Keys can solve this problem. Public Keys is a concept where two keys are involved. One key is a Public Key that can be spread through all sorts of media and may be obtained by anyone. The other key is the Private Key. This key is secret and cannot be spread. This key is only available to the owner. When the system is well implemented the secret key cannot be derived from the public key. Now the sender will crypt the message with the public key belonging to the receiver. Then decryption will be done with the secret key of the receiver.
Crucial in this concept is that the secret key remains a secret and should not be given away or become available to anyone else but the owner of this key. YOU CANNOT SEND THIS KEY OVER THE INTERNET. Also it is very unwise to use GnuPG over telnet (you might consider never to use telnet based on the high security risks).
The primary problem with symmetric ciphers is not their security but with key exchange. Once the sender and receiver have exchanged keys, that key can be used to securely communicate, but what secure communication channel was used to communicate the key itself? In particular, it would probably be much easier for an attacker to work to intercept the key than it is to try all the keys in the key space. Another problem is the number of keys needed. If there are n people who need to communicate, then n(n-1)/2 keys are needed for each pair of people to communicate privately. This may be OK for a small number of people but quickly becomes unwieldy for large groups of people.
Public-key ciphers were invented to avoid the key-exchange problem entirely. A public-key cipher uses a pair of keys for sending messages. The two keys belong to the person receiving the message. One key is a public key and may be given to anybody. The other key is a private key and is kept secret by the owner. A sender encrypts a message using the public key and once encrypted, only the private key may be used to decrypt it.
20
This protocol solves the key-exchange problem inherent with symmetric ciphers. There is no need for the sender and receiver to agree upon a key. All that is required is that some time before secret communication the sender gets a copy of the receiver's public key. Furthermore, the one public key can be used by anybody wishing to communicate with the receiver. So only n keypairs are needed for n people to communicate secretly with one another.
Public-key ciphers are based on one-way trapdoor functions. A one-way function is a function that is easy to compute, but the inverse is hard to compute. For example, it is easy to multiply two prime numbers together to get a composite, but it is difficult to factor a composite into its prime components. A one-way trapdoor function is similar, but it has a trapdoor. That is, if some piece of information is known, it becomes easy to compute the inverse. For example, if you have a number made of two prime factors, then knowing one of the factors makes it easy to compute the second. Given a public-key cipher based on prime factorization, the public key contains a composite number made from two large prime factors, and the encryption algorithm uses that composite to encrypt the message. The algorithm to decrypt the message requires knowing the prime factors, so decryption is easy if you have the private key containing one of the factors but extremely difficult if you do not have it.
As with good symmetric ciphers, with a good public-key cipher all of the security rests with the key. Therefore, key size is a measure of the system's security, but one cannot compare the size of a symmetric cipher key and a public-key cipher key as a measure of their relative security. In a brute-force attack on a symmetric cipher with a key size of 80 bits, the attacker must enumerate up to 280 keys to find the right key. In a brute-force attack on a public-key cipher with a key size of 512 bits, the attacker must factor a composite number encoded in 512 bits (up to 155 decimal digits). The workload for the attacker is fundamentally different depending on the cipher he is attacking. While 128 bits is sufficient for symmetric ciphers, given today's factoring technology public keys with 1024 bits are recommended for most purposes.
21
Hybrid ciphers
Public-key ciphers are no panacea. Many symmetric ciphers are stronger from a security standpoint, and public-key encryption and decryption are more expensive than the corresponding operations in symmetric systems. Public-key ciphers are nevertheless an effective tool for distributing symmetric cipher keys, and that is how they are used in hybrid cipher systems.
A hybrid cipher uses both a symmetric cipher and a public-key cipher. It works by using a public-key cipher to share a key for the symmetric cipher. The actual message being sent is then encrypted using the key and sent to the recipient. Since symmetric key sharing is secure, the symmetric key used is different for each message sent. Hence it is sometimes called a session key.
Both PGP and GnuPG use hybrid ciphers. The session key, encrypted using the public-key cipher, and the message being sent, encrypted with the symmetric cipher, are automatically combined in one package. The recipient uses his private-key to decrypt the session key and the session key is then used to decrypt the message.
A hybrid cipher is no stronger than the public-key cipher or symmetric cipher it uses, whichever is weaker. In PGP and GnuPG, the public-key cipher is probably the weaker of the pair. Fortunately, however, if an attacker could decrypt a session key it would only be useful for reading the one message encrypted with that session key. The attacker would have to start over and decrypt another session key in order to read any other message.
22
Digital signatures In order to prove that a message was really sent by the alleged sender the concept of Digital Signatures
was invented. As the name says a message is digitally signed by the sender. By using this signature you can check the authenticity of a message. Using this will reduce the risk for Trojan horses (a message that claims to be a patch to a certain problem but actually contains a virus or does something bad with data on your computer). Also information or data can be verified as coming from a legitimate source and thus be regarded as real.
A digital signature is made through a combination of the secret key and the text. Using the senders public key the message can be verified. Not only will be checked if the correct sender is involved, also the content will be checked. So you know that the message comes from the sender and has not been changed during the transportation process.
A hash function is a many-to-one function that maps its input to a value in a finite set. Typically this set is a range of natural numbers. A simple hash function is f(x) = 0 for all integers x. A more interesting hash function is f(x) = x mod 37, which maps x to the remainder of dividing x by 37.
A document's digital signature is the result of applying a hash function to the document. To be useful, however, the hash function needs to satisfy two important properties. First, it should be hard to find two documents that hash to the same value. Second, given a hash value it should be hard to recover the document that produced that value.
Some public-key ciphers could be used to sign documents. The signer encrypts the document with his private key. Anybody wishing to check the signature and see the document simply uses the signer's public key to decrypt the document. This algorithm does satisfy the two properties needed from a good hash function, but in practice, this algorithm is too slow to be useful. The cipher must have the property that the actual public key or private key could be used by the encryption algorithm as the public key. RSA is an example of such an algorithm while ElGamal is not an example.
An alternative is to use hash functions designed to satisfy these two important properties. SHA and MD5 are examples of such algorithms. Using such an algorithm, a document is signed by hashing it, and the hash value is the signature. Another person can check the signature by also hashing their copy of the document and comparing the hash value they get with the hash value of the original document. If they match, it is almost certain that the documents are identical.
23
Of course, the problem now is using a hash function for digital signatures without permitting an attacker to interfere with signature checking. If the document and signature are sent unencrypted, an attacker could modify the document and generate a corresponding signature without the recipient's knowledge. If only the document is encrypted, an attacker could tamper with the signature and cause a signature check to fail. A third option is to use a hybrid public-key encryption to encrypt both the signature and document. The signer uses his private key, and anybody can use his public key to check the signature and document. This sounds good but is actually nonsense. If this algorithm truly secured the document it would also secure it from tampering and there would be no need for the signature. The more serious problem, however, is that this does not protect either the signature or document from tampering. With this algorithm, only the session key for the symmetric cipher is encrypted using the signer's private key. Anybody can use the public key to recover the session key. Therefore, it is straightforward for an attacker to recover the session key and use it to encrypt substitute documents and signatures to send to others in the sender's name.
An algorithm that does work is to use a public key algorithm to encrypt only the signature. In particular, the hash value is encrypted using the signer's private key, and anybody can check the signature using the public key. The signed document can be sent using any other encryption algorithm including none if it is a public document. If the document is modified the signature check will fail, but this is precisely what the signature check is supposed to catch. The Digital Signature Standard (DSA) is a public key signature algorithm that works as just described. DSA is the primary signing algorithm used in GnuPG.
24
Creating your Public / Private Key Pair
testy@beraneklapect:~$ gpg --gen-keygpg (GnuPG) 1.4.3; Copyright (C) 2006 Free Software Foundation, Inc.This program comes with ABSOLUTELY NO WARRANTY.This is free software, and you are welcome to redistribute itunder certain conditions. See the file COPYING for details.
Please select what kind of key you want: (1) DSA and Elgamal (default) (2) DSA (sign only) (5) RSA (sign only)Your selection? 1DSA keypair will have 1024 bits.ELG-E keys may be between 1024 and 4096 bits long.What keysize do you want? (2048) Requested keysize is 2048 bitsPlease specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n yearsKey is valid for? (0) 30yKey expires at Tue 10 Mar 2037 07:02:10 PM CDTIs this correct? (y/N) y
25
You need a user ID to identify your key; the software constructs the user IDfrom the Real Name, Comment and Email Address in this form: "Heinrich Heine (Der Dichter) <[email protected]>"
Real name: Testy TestEmail address: [email protected]: NETSECURE 07You selected this USER-ID: "Testy Test (NETSECURE 07) <[email protected]>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? OYou need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to performsome other action (type on the keyboard, move the mouse, utilize thedisks) during the prime generation; this gives the random numbergenerator a better chance to gain enough entropy.++++++++++++++++++++.++++++++++++++++++++.++++++++++++++++++++.++++++++++++++++++++++++++++++++++++++++..+++++...++++++++++++++++++++.++++++++++>..+++++.........+++++
Not enough random bytes available. Please do some other work to givethe OS a chance to collect more entropy! (Need 267 more bytes)We need to generate a lot of random bytes. It is a good idea to performsome other action (type on the keyboard, move the mouse, utilize thedisks) during the prime generation; this gives the random numbergenerator a better chance to gain enough entropy.+++++.++++++++++.+++++++++++++++.++++++++++.+++++.++++++++++...++++++++++..++++++++++++++++++++.+++++.+++++++++++++++.+++++++++++++++.+++++.++++++++++++++++++++>++++++++++>+++++........................................................................................................>..+++++...........................<.+++++............................................>..+++++.......<+++++.................>+++++.....<+++++..........................>.+++++.<..+++++....>+++++..............+++++^^^gpg: key 38F8994D marked as ultimately trustedpublic and secret key created and signed.
26
List your keys
gpg: checking the trustdbgpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust modelgpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1ugpg: next trustdb check due at 2037-03-11pub 1024D/38F8994D 2007-03-19 [expires: 2037-03-11] Key fingerprint = A4E1 F3F5 E050 3AE5 B1C4 C40C 942A 6C8A 38F8 994Duid Testy Test (NETSECURE 07) <[email protected]>sub 2048g/6EC95A54 2007-03-19 [expires: 2037-03-11]
testy@beraneklapect:~$ gpg --list-keys --list-options show-keyring/home/testy/.gnupg/pubring.gpg------------------------------pub 1024D/38F8994D 2007-03-19 [expires: 2037-03-11]uid Testy Test (NETSECURE 07) <[email protected]>sub 2048g/6EC95A54 2007-03-19 [expires: 2037-03-11]
testy@beraneklapect:~$ gpg --list-secret-keys --list-options show-keyring/home/testy/.gnupg/secring.gpg------------------------------sec 1024D/38F8994D 2007-03-19 [expires: 2037-03-11]uid Testy Test (NETSECURE 07) <[email protected]>ssb 2048g/6EC95A54 2007-03-19
27
Revoke a key
For several reasons you may want to revoke an existing key. For instance: the secret key has been stolen or became available to the wrong people, the UID has been changed, the key is not large enough anymore, etc. In all these cases the command to revoke the key is:
gpg --gen-revoke This creates a revocation certificate. To be able to do this, you need a secret key,
else anyone could revoke your certificate. This has one disadvantage. If I do not know the passphrase the key has become useless. But I cannot revoke the key! To overcome this problem it is wise to create a revoke license when you create a key pair. And if you do so, keep it safe! This can be on disk, paper, etc. Make sure that this certificate will not fall into wrong hands!!!! If you don't someone else can issue the revoke certificate for your key and make it useless.
28
Generating your key revocation certificatetesty@beraneklapect:~$ gpg --gen-revoke --armor --output 38F8994D.rev 0x38F8994D
sec 1024D/38F8994D 2007-03-19 Testy Test (NETSECURE 07) <[email protected]>
Create a revocation certificate for this key? (y/N) yPlease select the reason for the revocation: 0 = No reason specified 1 = Key has been compromised 2 = Key is superseded 3 = Key is no longer used Q = Cancel(Probably you want to select 1 here)Your decision? 3Enter an optional description; end it with an empty line:> NETSECURE 07> Reason for revocation: Key is no longer usedNETSECURE 07Is this okay? (y/N) y
You need a passphrase to unlock the secret key foruser: "Testy Test (NETSECURE 07) <[email protected]>"1024-bit DSA key, ID 38F8994D, created 2007-03-19
Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory getsaccess to this certificate he can use it to make your key unusable.It is smart to print this certificate and store it away, just in caseyour media become unreadable. But have some caution: The print system ofyour machine might store the data and make it available to others!
29
Exporting your keys
testy@beraneklapect:~$ gpg --export --armor --verbose --output 38F8994D.pub 0x38F8994Dgpg: writing to `38F8994D.pub'
testy@beraneklapect:~$ gpg --export-secret-keys --armor --verbose --output 38F8994D.sec 0x38F8994Dgpg: writing to `38F8994D.sec'
The command for exporting a key for a user is: gpg --export [UID] If no UID has been submitted all present keys will be exported. By default the
output is set to stdout. But with the -o option this is sent to a file. It may be advisable using the option -a to write the key to a 7-bit ASCII file instead of a binary file.
By exporting public keys you can broaden your horizon. Others can start contacting you securely. This can be done by publishing it on your homepage, by finger, through a key server like http://www.pca.dfn.de/dfnpca/pgpkserv/ or any other method you can think of.
BACKUP your ~/.gnupg files to secure external media!
30
Importing Keys
testy@beraneklapect:~$ gpg --import --verbose 10F8EE52.ascgpg: armor header: Version: SKS 1.0.9gpg: pub 1024D/10F8EE52 1997-07-02 Brian Elliott Finley <[email protected]>gpg: using PGP trust modelgpg: key 10F8EE52: public key "Brian Elliott Finley <[email protected]>" importedgpg: Total number processed: 1gpg: imported: 1gpg: 2 keys cached (194 signatures)gpg: 1 keys processed (1 validity counts cleared)gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust modelgpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1ugpg: next trustdb check due at 2037-03-11
When you received someone's public key (or several public keys) you have to add them to your key database in order to be able to use them. To import into the database the command looks like this:
gpg --import [Filename] if the filename is omitted the data will be read from stdin.
31
Sending and Retrieving keys from keyservers
tetesty@beraneklapect:~$ gpg --recv-keys --verbose 0x9E3B3CBFgpg: requesting key 9E3B3CBF from hkp server subkeys.pgp.netgpg: armor header: Version: SKS 1.0.9gpg: pub 1024D/9E3B3CBF 2005-08-04 George Beranek <[email protected]>gpg: using PGP trust modelgpg: key 9E3B3CBF: public key "George Beranek (George Beranek's Argonne gpg key) <[email protected]>" importedgpg: Total number processed: 1gpg: imported: 1tetesty@beraneklapect:~$ gpg --send-keys --verbose 0x38F8994D
Ideally, you distribute your key by personally giving it to your correspondents. In practice, however, keys are often distributed by email or some other electronic communication medium. Distribution by email is good practice when you have only a few correspondents, and even if you have many correspondents, you can use an alternative means such as posting your public key on your World Wide Web homepage. This is unacceptable, however, if people who need your public key do not know where to find it on the Web.
To solve this problem public key servers are used to collect and distribute public keys. A public key received by the server is either added to the server's database or merged with the existing key if already present. When a key request comes to the server, the server consults its database and returns the requested public key if found.
A keyserver is also valuable when many people are frequently signing other people's keys. Without a keyserver, when Blake sign's Alice's key then Blake would send Alice a copy of her public key signed by him so that Alice could add the updated key to her ring as well as distribute it to all of her correspondents. Going through this effort fulfills Alice's and Blake's responsibility to the community at large in building tight webs of trust and thus improving the security of PGP. It is nevertheless a nuisance if key signing is frequent.
Using a keyserver makes the process somewhat easier. When Blake signs Alice's key he sends the signed key to the key server. The key server adds Blake's signature to its copy of Alice's key. Individuals interested in updating their copy of Alice's key then consult the keyserver on their own initiative to retrieve the updated key. Alice need never be involved with distribution and can retrieve signatures on her key simply by querying a keyserver.
One or more keys may be sent to a keyserver using the command-line option --send-keys. The option takes one or more key specifiers and sends the specified keys to the key server. The key server to which to send the keys is specified with the command-line option --keyserver. Similarly, the option --recv-keys is used to retrieve keys from a keyserver, but the option --recv-keys requires a key ID be used to specify the key. In the following example Alice updates her public key with new signatures from the keyserver certserver.pgp.com and then sends her copy of Blake's public key to the same keyserver to contribute any new signatures she may have added.
32
testy@beraneklapect:~$ gpg --list-keys --list-options show-photos --photo-viewer "/usr/bin/xv %I &"/home/testy/.gnupg/pubring.gpg------------------------------pub 1024D/38F8994D 2007-03-19 [expires: 2037-03-11]uid Testy Test (NETSECURE 07) <[email protected]>sub 2048g/6EC95A54 2007-03-19 [expires: 2037-03-11]
pub 1024D/10F8EE52 1997-07-02uid Brian Elliott Finley <[email protected]>uid Brian Elliott Finley <[email protected]>uid Brian Elliott Finley <[email protected]>uid Brian Elliott Finley <[email protected]>uid [jpeg image of size 6283]sub 3072g/C6B80F12 1997-07-02
pub 1024D/9E3B3CBF 2005-08-04 [expires: 2035-07-28]uid George Beranek (George Beranek's Argonne gpg key) <[email protected]>uid George Beranek <[email protected]>uid George Beranek (Comcast) <[email protected]>uid George Beranek (ShoniBrook Server) <[email protected]>uid [jpeg image of size 5444]sub 2048g/7496E1E6 2005-08-04 [expires: 2035-07-28]
33
Other “key” commands
With the GnuPG system comes a file that acts as some kind of database. In this file all data regarding keys with the information that comes with the keys is stored (everything until the Ownertrust values: for more information on that read Key signing). With
gpg --list-keys all present keys will be displayed. To see the signatures as well type: gpg --list-sigs (see Key signing for further information). To see the fingerprints type: gpg --fingerprint You want to see "Fingerprints" to ensure that somebody is really the person they claim (like in a telephone
call). This command will result in a list of relatively small numbers. To list the secret keys you type: gpg --list-secret-keys Note that listing fingerprints and signatures from private keys has no use what soever. In order to delete a public key you type: gpg --delete-key UID For deleting a secrete key you type: gpg --delete-secret-key There is one more important command that is relevant for working with keys. gpg --edit-key UID Using this you can edit (among other things) the expiration date, add a fingerprint and sing your key.
Although it is too logic to mention. For this you need your passphrase. When entering this you will see a command line.
34
Encrypting and decrypting documents A public and private key each have a specific role when encrypting and decrypting documents. A public key may be thought
of as an open safe. When a correspondent encrypts a document using a public key, that document is put in the safe, the safe shut, and the combination lock spun several times. The corresponding private key is the combination that can reopen the safe and retrieve the document. In other words, only the person who holds the private key can recover a document encrypted using the associated public key.
The procedure for encrypting and decrypting documents is straightforward with this mental model. If you want to encrypt a message to Alice, you encrypt it using Alice's public key, and she decrypts it with her private key. If Alice wants to send you a message, she encrypts it using your public key, and you decrypt it with your private key.
To encrypt a document the option --encrypt is used. You must have the public keys of the intended recipients. The software expects the name of the document to encrypt as input; if omitted, it reads standard input. The encrypted result is placed on standard output or as specified using the option --output. The document is compressed for additional security in addition to encrypting it.
alice% gpg --output doc.gpg –armor --encrypt --recipient [email protected] doc The --recipient option is used once for each recipient and takes an extra argument specifying the public key to which the
document should be encrypted. The encrypted document can only be decrypted by someone with a private key that complements one of the recipients' public keys. In particular, you cannot decrypt a document encrypted by you unless you included your own public key in the recipient list.
To decrypt a message the option --decrypt is used. You need the private key to which the message was encrypted. Similar to the encryption process, the document to decrypt is input, and the decrypted result is output.
blake% gpg --output doc --decrypt doc.gpg You need a passphrase to unlock the secret key for user: "Blake (Executioner) <[email protected]>" 1024-bit ELG-E key, ID 5C8CBD41, created 1999-06-04 (main key ID 9E98BC16) Enter passphrase: Documents may also be encrypted without using public-key cryptography. Instead, you use a symmetric cipher to encrypt the
document. The key used to drive the symmetric cipher is derived from a passphrase supplied when the document is encrypted, and for good security, it should not be the same passphrase that you use to protect your private key. Symmetric encryption is useful for securing documents when the passphrase does not need to be communicated to others. A document can be encrypted with a symmetric cipher by using the --symmetric option.
alice% gpg --output doc.gpg --symmetric doc Enter passphrase:
35
GUI Front Ends: GPA
36
GUI Front Ends: Seahorse
37
MUA Frontends
Enigmail is a plug-in for Mozilla's mailer. http://enigmail.mozdev.org/ The G DATA GnuPG Plugin for Outlook adds easy to use email encryption to
Outlook. http://www3.gdata.de/gpg/ pgp4pine A PGP/GPG Wrapper for Pine Many mail programs like Mutt and Evolution have native support. http://www.gnupg.org/(en)/related_software/frontends.html#mua
38
GnuPG for Windows (gnupg-w32cli-1.4.5.exe)
39
Signing Documents (better than md5sum) A digital signature certifies and timestamps a document. If the document is subsequently modified in any
way, a verification of the signature will fail. A digital signature can serve the same purpose as a hand-written signature with the additional benefit of being tamper-resistant. The GnuPG source distribution, for example, is signed so that users can verify that the source code has not been modified since it was packaged.
Creating and verifying signatures uses the public/private keypair in an operation different from encryption and decryption. A signature is created using the private key of the signer. The signature is verified using the corresponding public key. For example, Alice would use her own private key to digitally sign her latest submission to the Journal of Inorganic Chemistry. The associate editor handling her submission would use Alice's public key to check the signature to verify that the submission indeed came from Alice and that it had not been modified since Alice sent it. A consequence of using digital signatures is that it is difficult to deny that you made a digital signature since that would imply your private key had been compromised.
The command-line option --sign is used to make a digital signature. The document to sign is input, and the signed document is output.
alice% gpg --output doc.sig --sign doc You need a passphrase to unlock the private key for user: "Alice (Judge) <[email protected]>" 1024-bit DSA key, ID BB7576AC, created 1999-06-04 Enter passphrase: The document is compressed before being signed, and the output is in binary format. Given a signed document, you can either check the signature or check the signature and recover the
original document. To check the signature use the --verify option. To verify the signature and extract the document use the --decrypt option. The signed document to verify and recover is input and the recovered document is output.
blake% gpg --output doc --decrypt doc.sig gpg: Signature made Fri Jun 4 12:02:38 1999 CDT using DSA key ID BB7576AC gpg: Good signature from "Alice (Judge) <[email protected]>"
40
Clearsigning documents
A common use of digital signatures is to sign usenet postings or email messages. In such situations it is undesirable to compress the document while signing it. The option --clearsign causes the document to be wrapped in an ASCII-armored signature but otherwise does not modify the document.
alice% gpg --clearsign doc You need a passphrase to unlock the secret key for user: "Alice (Judge) <[email protected]>" 1024-bit DSA key, ID BB7576AC, created 1999-06-04 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [...] -----BEGIN PGP SIGNATURE----- Version: GnuPG v0.9.7 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjdYCQoACgkQJ9S6ULt1dqz6IwCfQ7wP6i/
i8HhbcOSKF4ELyQB1 oCoAoOuqpRqEzr4kOkQqHRLE/b8/Rw2k =y6kj -----END PGP SIGNATURE-----
41
Detached signatures
A signed document has limited usefulness. Other users must recover the original document from the signed version, and even with clearsigned documents, the signed document must be edited to recover the original. Therefore, there is a third method for signing a document that creates a detached signature, which is a separate file. A detached signature is created using the --detach-sig option.
alice% gpg --output doc.sig --detach-sig doc You need a passphrase to unlock the secret key for user: "Alice (Judge) <[email protected]>" 1024-bit DSA key, ID BB7576AC, created 1999-06-04 Enter passphrase: Both the document and detached signature are needed to verify the signature. The
--verify option can be to check the signature. blake% gpg --verify doc.sig doc gpg: Signature made Fri Jun 4 12:38:46 1999 CDT using DSA key ID BB7576AC gpg: Good signature from "Alice (Judge) <[email protected]>"
42
Signing KeysOnce a key is imported it should be validated. GnuPG uses a powerful and flexible trust model that does not require you to personally validate each key you import. Some keys may need to be personally validated, however. A key is validated by verifying the key's fingerprint and then signing the key to certify it as a valid key. A key's fingerprint can be quickly viewed with the --fingerprint command-line option, but in order to certify the key you must edit it.
alice% gpg --edit-key [email protected]
pub 1024D/9E98BC16 created: 1999-06-04 expires: never trust: -/q
sub 1024g/5C8CBD41 created: 1999-06-04 expires: never
(1) Blake (Executioner) <[email protected]>
Command> fpr
pub 1024D/9E98BC16 1999-06-04 Blake (Executioner) <[email protected]>
Fingerprint: 268F 448F CCD7 AF34 183E 52D8 9BDE 1A08 9E98 BC16
A key's fingerprint is verified with the key's owner. This may be done in person or over the phone or through any other means as long as you can guarantee that you are communicating with the key's true owner. If the fingerprint you get is the same as the fingerprint the key's owner gets, then you can be sure that you have a correct copy of the key.
After checking the fingerprint, you may sign the key to validate it. Since key verification is a weak point in public-key cryptography, you should be extremely careful and always check a key's fingerprint with the owner before signing the key.
Command> sign
pub 1024D/9E98BC16 created: 1999-06-04 expires: never trust: -/q
Fingerprint: 268F 448F CCD7 AF34 183E 52D8 9BDE 1A08 9E98 BC16
Blake (Executioner) <[email protected]>
Are you really sure that you want to sign this key
with your key: "Alice (Judge) <[email protected]>"
Really sign?
Once signed you can check the key to list the signatures on it and see the signature that you have added. Every user ID on the key will have one or more self-signatures as well as a signature for each user that has validated the key.
Command> check
uid Blake (Executioner) <[email protected]>
sig! 9E98BC16 1999-06-04 [self-signature]
sig! BB7576AC 1999-06-04 Alice (Judge) <[email protected]>
43
Signing should be based on “Fingerprints”
List public keys on your ring: gpg --list-keys --list-options show-keyring | more to display signatures as well type: gpg --list-sigs --list-options show-keyring | more or to display fingerprints: gpg --fingerprint --list-options show-keyring | less or to display validity (calculated trust values): gpg --list-keys --with-colons | more gpg --export-ownertrust List secret keys on your ring: gpg --list-secret-keys --list-options show-keyring HAVE A KEYSIGNING PARTY! http://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html
44
Web of Trust
A correspondent's key is validated by personally checking his key's fingerprint and then signing his public key with your private key. By personally checking the fingerprint you can be sure that the key really does belong to him, and since you have signed they key, you can be sure to detect any tampering with it in the future. Unfortunately, this procedure is awkward when either you must validate a large number of keys or communicate with people whom you do not know personally.
GnuPG addresses this problem with a mechanism popularly known as the web of trust. In the web of trust model, responsibility for validating public keys is delegated to people you trust. For example, suppose
Alice has signed Blake's key, and Blake has signed Chloe's key and Dharma's key. If Alice trusts Blake to properly validate keys that he signs, then Alice can infer that
Chloe's and Dharma's keys are valid without having to personally check them. She simply uses her validated copy of Blake's public key to check that Blake's signatures on Chloe's and Dharma's are good. In general, assuming that Alice fully trusts everybody to properly validate keys they sign, then any key signed by a valid key is also considered valid. The root is Alice's key, which is axiomatically assumed to be valid.
45
Trust in a key's owner
In practice trust is subjective. For example, Blake's key is valid to Alice since she signed it, but she may not trust Blake to properly validate keys that he signs. In that case, she would not take Chloe's and Dharma's key as valid based on Blake's signatures alone. The web of trust model accounts for this by associating with each public key on your keyring an indication of how much you trust the key's owner. There are four trust levels.
unknown
Nothing is known about the owner's judgment in key signing. Keys on your public keyring that you do not own initially have this trust level.
none
The owner is known to improperly sign other keys.
marginal
The owner understands the implications of key signing and properly validates keys before signing them.
full
The owner has an excellent understanding of key signing, and his signature on a key would be as good as your own.
A key's trust level is something that you alone assign to the key, and it is considered private information. It is not packaged with the key when it is exported; it is even stored separately from your keyrings in a separate database.
The GnuPG key editor may be used to adjust your trust in a key's owner. The command is trust. In this example Alice edits her trust in Blake and then updates the trust database to recompute which keys are valid based on her new trust in Blake.
alice% gpg --edit-key blake
pub 1024D/8B927C8A created: 1999-07-02 expires: never trust: q/f
sub 1024g/C19EA233 created: 1999-07-02 expires: never
(1) Blake (Executioner) <[email protected]>
46
Trust in a key's ownerCommand> trust
pub 1024D/8B927C8A created: 1999-07-02 expires: never trust: q/f
sub 1024g/C19EA233 created: 1999-07-02 expires: never
(1) Blake (Executioner) <[email protected]>
Please decide how far you trust this user to correctly
verify other users' keys (by looking at passports,
checking fingerprints from different sources...)?
1 = Don't know
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
s = please show me more information
m = back to the main menu
Your decision? 3
pub 1024D/8B927C8A created: 1999-07-02 expires: never trust: m/f
sub 1024g/C19EA233 created: 1999-07-02 expires: never
(1) Blake (Executioner) <[email protected]>
Command> quit
[...]
Trust in the key's owner and the key's validity are indicated to the right when the key is displayed. Trust in the owner is displayed first and the key's validity is second. The four trust/validity levels are abbreviated: unknown (q), none (n), marginal (m), and full (f). In this case, Blake's key is fully valid since Alice signed it herself. She initially has an unknown trust in Blake to properly sign other keys but decides to trust him marginally.
47
Using trust to validate keys
The web of trust allows a more elaborate algorithm to be used to validate a key. Formerly, a key was considered valid only if you signed it personally. A more flexible algorithm can now be used: a key K is considered valid if it meets two conditions:
1. it is signed by enough valid keys, meaning
you have signed it personally,
it has been signed by one fully trusted key, or
it has been signed by three marginally trusted keys; and
2. the path of signed keys leading from K back to your own key is five steps or shorter.
The path length, number of marginally trusted keys required, and number of fully trusted keys required may be adjusted. The numbers given above are the default values used by GnuPG.
The figure shows a web of trust rooted at Alice. The graph illustrates who has signed who's keys. The table shows which keys Alice considers valid based on her trust in the other members of the web. This example assumes that two marginally-trusted keys or one fully-trusted key is needed to validate another key. The maximum path length is three.
When computing valid keys in the example, Blake and Dharma's are always considered fully valid since they were signed directly by Alice. The validity of the other keys depends on trust. In the first case, Dharma is trusted fully, which implies that Chloe's and Francis's keys will be considered valid. In the second example, Blake and Dharma are trusted marginally. Since two marginally trusted keys are needed to fully validate a key, Chloe's key will be considered fully valid, but Francis's key will be considered only marginally valid. In the case where Chloe and Dharma are marginally trusted, Chloe's key will be marginally valid since Dharma's key is fully valid. Francis's key, however, will also be considered marginally valid since only a fully valid key can be used to validate other keys, and Dharma's key is the only fully valid key that has been used to sign Francis's key. When marginal trust in Blake is added, Chloe's key becomes fully valid and can then be used to fully validate Francis's key and marginally validate Elena's key. Lastly, when Blake, Chloe, and Elena are fully trusted, this is still insufficient to validate Geoff's key since the maximum certification path is three, but the path length from Geoff back to Alice is four.
48
Using trust to validate keys
The web of trust model is a flexible approach to the problem of safe public key exchange. It permits you to tune GnuPG to reflect how you use it. At one extreme you may insist on multiple, short paths from your key to another key K in order to trust it. On the other hand, you may be satisfied with longer paths and perhaps as little as one path from your key to the other key K. Requiring multiple, short paths is a strong guarantee that K belongs to whom your think it does. The price, of course, is that it is more difficult to validate keys since you must personally sign more keys than if you accepted fewer and longer paths.
A hypothetical web of trust
trust trust validity validity
marginal full marginal full
Dharma Blake, Chloe, Dharma, Francis
Blake, Dharma Francis Blake, Chloe, Dharma
Chloe, Dharma Chloe, Francis Blake, Dharma
Blake, Chloe, Dharma Elena Blake, Chloe, Dharma, Francis
Blake, Chloe, Elena Blake, Chloe, Elena, Francis
49
Refrences:
GnuPG “official” documentation:http://www.gnupg.org/(en)/documentation/index.html
The GNU Privacy Handbook: http://www.gnupg.org/gph/en/manual.html Gnu Privacy Guard (GnuPG) Mini Howto (English):
http://webber.dewinter.com/gnupg_howto/english/GPGMiniHowto.html A Rant about Cryptography and the U.S. Government:
http://www.rdrop.com/~half/Creations/Writings/Rants/Rants-Crypto.html PGP: http://en.wikipedia.org/wiki/Pretty_Good_Privacy http://www.pgp.com/
http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html GPG: http://en.wikipedia.org/wiki/GnuPG Partial List Of Public Keyservers: gnv.us.ks.cryptnet.net subkeys.pgp.net
pgp.mit.edu
50
QUESTIONS?
USE OPEN SOURCE http://www.opensource.org/ UBUNTU http://www.ubuntu.com/ FIREFOX http://www.mozilla.com/firefox/ Open Office http://www.openoffice.org/ http://www.anl.gov/ Argonne National Laboratory is located on 1,500 acres, 25 miles southwest of
downtown Chicago.
51
Speaker Bio
George Beranek began his professional computer career in the early 1980's as a test engineer / designer programming in HP Rocky Mountain Basic, Pascal, Fortran, and C supplying intelligent replacement for electro-mechanical test systems as an independent contractor for Eaton Corporation and Gould Research Center. In 1990 he transitioned into Unix System and Network administration at Motorola where he eventually headed a team of system administration and networking professionals dedicated to quick response and high performance technical computing for their Cellular Infrastructure International Systems Engineering Group during the peak of their cellular boom. George is presently a Senior Security and Network Administrator at Argonne National Laboratory where he essentially functions as an internal Linux consultant. George received a BS in Electrical Engineering and Computer Science from Northwestern University's Technological Institute and a MS in Electrical Engineering and Computer Engineering from IIT. He is also a RedHat Certified Engineer (RHCE) but of late has become passionate about the Debian based Ubuntu Linux distribution. George has been a member of the IEEE for the past 25 years.
52
The Advanced Photon Source (APS) is the nation’s brightest source of X-rays for research.
