|
10/27/2009 -- One of the best-known implementations of PGP (Pretty Good Privacy) type encryption with Linux is the GNU Privacy Guard, more commonly known as GnuPG or GPG. With it, you can create your public and private key pair, encrypt files using your key, and digitally sign a message to authenticate that it's really from you. If you send a digitally signed message to someone who has your public key, the recipient can verify that it was you who signed the message.
The basic idea behind public key encryption is to use a pair of keys -- one private, the other public -- that are related but can't be used to guess one from the other. Anything encrypted with the private key can be decrypted only with the corresponding public key, and vice versa. The public key is for distributing to other people while you keep the private key in a safe place. You can use public key encryption to communicate securely with others.
The purpose of digital or electronic signatures is the same as pen-and-ink signatures, but how you sign digitally is completely different. Unlike pen-and-ink signatures, your digital signature depends on the message you're signing. The first step in creating a digital signature is to apply a mathematical function on the message and reduce it to a fixed-size message digest (also called a "hash" or a "fingerprint"). No matter how big your message is, the message digest is always around 128 or 160 bits, depending on the hashing function.
The next step is to apply public key encryption. Simply encrypt the message digest with your private key, and you get the digital signature for the message. Typically, the digital signature is appended to the end of the message, and you get an electronically signed message. Anyone who wants to verify that the message is indeed signed by you takes your public key and decrypts the digital signature. What that person gets is the message digest (the encrypted hash) of the message. Then he or she applies the same hash function to the message and compares the computed hash with the decrypted value. If the two match, then no one has tampered with the message. Because your public key was used to verify the signature, the message must have been signed with the private key known only to you.
Using GPG
GPG includes the tools you need to use public key encryption and digital signatures. The executable is gpg. While one of the best ways to figure out how to use GPG is to use it, the following shows you some of the typical tasks that can be performed with GPG:
Generating the Key Pair
The steps for generating the key pairs go like this:
- Type "gpg --gen-key."
If you're using gpg for the first time, it creates a .gnupg directory in your home directory and a file named gpg.conf in that directory. Then GPG asks what kind of keys you want:
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) RSA (sign only)
Your selection?
- Press Enter for the default choice because it's good enough. GPG then prompts you for the key size (the number of bits).
- Press Enter again to accept the default value of 1,024 bits. GPG asks you when the keys expire (the default is to never expire).
- Press Enter. When GPG asks if you really want the keys to never expire, press Y to confirm. GPG prompts you for your name, e-mail address and a comment so that the key pair is associated with your name. Type each piece of requested information and press Enter.
- When GPG gives you a chance to change or confirm the information, confirm by typing "o" and pressing Enter. GPG then prompts you for a passphrase that protects your private key.
- Type a long phrase (the longer the better) that includes lowercase and uppercase letters, numbers, and punctuation marks, and then press Enter. GPG generates the keys. It may ask you to perform some work on the PC so the random number generator can generate enough random numbers for the key-generation process.
Exchanging Keys
To communicate with others, you have to give them your public key. You also have to get public keys from those who may send you a message, or someone who might sign a file and whose signature you'll want to verify. GPG keeps the public keys in your key ring (which is simply the public keys stored in a file, but it sounds nice to call it a key ring because everybody has a key ring out in the real world, and these are keys of a sort, right?). To list the keys in your key ring, type
gpg --list-keys
To send your public key to someone or to place it on a Web site, you have to export the key to a file. The best way is to put the key in what GPG documentation calls an "ASCII-armored" format, with a command like this:
gpg --armor --export [email protected] > kdulaneykey.asc
This command saves the public key in an ASCII-armored format (it basically looks like garbled text) in the file named kdulaneykey.asc. Of course, you replace the e-mail address with your e-mail address -- the one you used when you created the key -- and the output filename to something different.
After you export the public key to a file, you can mail that file to others or place it on a Web site for use by others.
When you import a key from someone else, you typically get it in an ASCII-armored format, as well. For example, if you have a [email protected] GPG public key in a file named uscertkey.asc (obtained from here), you then import it into the key ring with the following command:
gpg --import uscertkey.asc
Use the gpg --list-keys command to verify that the key is in your key ring. For example, here's what you might see when typing "gpg --list-keys" on the system:
/home/kdulaney/.gnupg/pubring.gpg
-----------------------------
pub 1024D/7B38A728 2008-08-28
uid Kristin Dulaney <[email protected]>
sub 2048g/3BD6D418 2005-08-28
pub 2048R/F0E187D0 2004-09-08 [expires: 2008-10-01]
uid US-CERT Operations Key <[email protected]>
The next step is to check the fingerprint of the new key. Type the following command to get the fingerprint of the US-CERT key:
gpg --fingerprint [email protected]
GPG prints the fingerprint:
pub 2048R/F0E187D0 2007-09-08 [expires: 2008-10-01]
Key fingerprint = 049F E3BA 240B 4CF1 3A76 06DC 1868 49EC F0E1 87D0
uid US-CERT Operations Key <[email protected]>
At this point, you need to verify the key fingerprint with someone at the US-CERT organization (you can do that here).
If you think the key fingerprint is good, you can sign the key and validate it. Here's the command you use to sign the key:
gpg --sign-key [email protected]
GPG asks for confirmation and then prompts you for your passphrase. After that, GPG signs the key. Because the key verification and signing is a potential weak link in GPG, be careful about what keys you sign. By signing a key, you basically say that you trust the key to be from that person or organization. Signing a File
You may find signing files useful if you send out a file to someone and want to assure the recipient that 1) no one tampered with the file, and 2) that the file was, in fact, sent by you. GPG makes signing a file very easy. You can compress and sign a file named message with the following command:
gpg -o message.sig -s message
To verify the signature, type
gpg --verify message.sig
To get back the original document, simply type
gpg -o message --decrypt message.sig
Sometimes you don't care about keeping a message secret, but you simply want to sign it to indicate that the message is from you. In that case, you can generate and append a clear-text signature with the following command:
gpg -o message.asc --clearsign message
This command basically appends a clear-text signature to the text message. Here's a typical clear-text signature block:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDEhAtaHWlHHs4pygRAhiqAJ9Qj0pPMgKVBuokDyUZaEYVsp6RIQCfaoBm
9zCwrSAG9mo2DXJvbKS3ri8=
=2uc/
-----END PGP SIGNATURE-----
When a message has a clear-text signature appended, you can use GPG to verify the signature with the following command:
gpg --verify message.asc
If you had indeed signed the message, the last line of the output says it's a good signature. Encrypting and Decrypting Documents
To encrypt a message meant for a recipient, you can use the --encrypt (or -e) GPG command. Here's how you might encrypt a message for US-CERT using its GPG key:
gpg -o message.gpg -e -r [email protected] message
The message is encrypted using the US-CERT public key (without a signature, but you can add the signature with the -s command). When US-CERT receives the message.gpg file, the recipient has to decrypt it using US-CERT's private key. Here's the command someone at US-CERT can use:
gpg -o message --decrypt message.gpg
GPG then prompts for the passphrase to unlock the US-CERT private key, decrypts the message and saves the output in the file named message.
If you simply want to encrypt a file, and no one else has to decrypt the file, you can use GPG to perform what's called "symmetric encryption." In this case, you provide a passphrase to encrypt the file with the following GPG command:
gpg -o secret.gpg -c somefile
GPG prompts you for the passphrase and asks you to repeat it (to make sure you didn't mistype anything). Then GPG encrypts the file using a key generated from the passphrase.
To decrypt a file encrypted with a symmetric key, type
gpg -o myfile --decrypt secret.gpg
GPG prompts you for the passphrase. If you enter the correct passphrase, GPG decrypts the file and saves the output (in this example) in the file named myfile.
These are some of the more common actions performed with GPG. For more information on this tool, look at the documentation sources available here.
|
