Bart Bania

Adventures in Linux

GNU Privacy Guard – The Basics

According to Edward Snowden in his QA session on the Guardian, much of the existing encryption is weak, so the NSA can frequently find ways round it, but there are strong crypto systems that can still be relied on. This means most of the available digital, wireless, wired encryption tools are, to be honest, useless. What is even more fearsome, we are no longer hidden in the depths of our own homes, and even if one doesn’t have access to the Internet, it doesn’t mean they’re being watched. Almost every electronic equipment you use, leaves behind metadata – information generated as you use technology. Examples include the date and time you called somebody or the location from which you last accessed your email. However, if you believe what Snowden says, there are still some tools that help protect privacy and your physical location by providing anonymity as well as encrypting your data. The first one appears to be TOR network – a protective layer that sits between the user and the internet, providing anonymous path between you and the sites you visit. I’m not going to go into details about TOR, you can read about it on the official website. The second one – PGP (Pretty Good Privacy) – a popular program used to encrypt and decrypt e-mail over the Internet. It can also be used to send an encrypted digital signature that lets the receiver verify the sender’s identity and know that the message was not changed en route.

  1. What is GPG?
  2. How to use GPG?
  3. Revocation-Certificate.
  4. How to make your public key public?
  5. The Keyring.
  6. Key Signing and Trusted Keys.
  7. Encryption and Decryption and Signing.
  8. Further Reading.

What is GPG?

GnuPG allows to encrypt and sign your data and communication, features a versatile key management system as well as access modules for all kinds of public key directories. GnuPG is Free Software (meaning that it respects your freedom). It can be freely used, modified and distributed under the terms of the GNU General Public License.

Pretty Good Privacy is a data encryption technology commonly used for encrypting files, especially emails.

How it works?

pgp_animation

Source: The Guardian NSA Files

PGP (or GnuPG – a GNU licensed equiuvalent) depends on users having two keys: one public and one private. These two keys can only be used with one another. The sender uses a random key to encrypt the file. They then encrypt the key using their private key and the receiver’s public key. The file and the key are sent to the receiver. The receiver decrypts the key with their private key and the sender’s public key. They then decrypt the file using the key. The receiver could then reciprocate the process using the sender’s public and private keys.

This might seem difficult, but in fact, it’s pretty simple to use. You create your keyring (private and public key). You make your public key available, put it on your website, send it to as many people as possible (the ones you want to contact you in a secure way). Anyone that wants to send you encrypted messages, does so, using your public key. You encrypt them with the private key.

My public key can be found here: 
https://pool.sks-keyservers.net:11371/pks/lookup?op=get&search=0x348751C9F9FA286E

TOP

How to use it?

Linux comes with all the needed tools pre-installed. On Windows machines, you have to download the GnuPG libraries. If you want to use GnuPG on Windows, head HERE for instructions. There are also lots of tools available that simplify encrypting/decrypting of messages. For the list of GnuPG frontends, head HERE.

Once you’ve installed the tools and libraries, you can create your first key. In your terminal window type:

Here we chose the coding algorithm. To be able to encrypt and sign your messages, chose option #1. Next, the program asks you about the length of your key (in bits):

The default 2048 should be fair enough. Hit Enter. The tool asks us now about the time the key would be valid:

The default non expiration is fine, as we’ll also create a revocation key, but about that later on. Hit Enter and move on. The tool will ask you if you’re positive about non expiration:

Confirm it with Y and move on. Now, we provide you data, name, email address and some comment (could be anything, a quote, our nickname) – this helps a little to make the key more recognisable.

We provide a passphrase for encrypting/decrypting our messages and move to key generation. It’s good to run a memory-eating process (rsync, opening a lot of webpages) to create lots of randomness and chaos to make your key as random as possible:

You might get a message like this at some point:

Don’t worry, and keep creating randomness. If nothing happens on the screen, don’t worry either, the key is being created, you need to create more disk shuffling. Once finished, we get a confirmation:

Congratulations! You’ve created you first public and private key! To get a list of available keys in your keyring, type:

gpg --list-keys 

The description is simply anything of your name, email-address, comment or part of it. So, for our example User-ID being “Agent Smith (We’re not here because we are free. We’re here because we are not free. There is no escaping reason. No denying purpose. Because we both know without purpose, we would not exist.) “, the  could be anything like:

  • Agent Smith
  • agent
  • smith@matrix
  • matrix
  • gent smi
  • because.

etc. In our case, the shell output looks like this:

You can get even more information if you include -v --fingerprint option in the command:

The Key-ID (here 86BCF5C7) together with the finger-print (the 10×4 digits) uniquely determines your key. Furthermore it shows that so far only you have signed this key.

Now, it is very important to generate a revocation-certificate.

TOP

Revocation-Certificate

So, you’ve created your first key. But what if you wanted to destroy it? Perhaps you think that this is not important at the moment, and basically you are right. However, there is a problem: in a few months or years, a lot of people will know your public key. In case you don’t want to use this particular key any more (maybe you forgot the passphrase, or somebody found it out), you will have to tell everybody. Otherwise, you will be receiving emails encrypted with this key, and will not be able to decrypt them yourself. In order to do so, there is a so-called revocation-certificate. If this certificate is sent to the key-servers the key is definitively wiped-out. It’s best to create the revocation now, as it’s only possible to make one if you know the passphrase. You have to do the following:

As you can see, gpg is warning us about risks of making the revocation certificate available to the Mallroy’s (meaning: just anyone). Keep this key safe, best print it out and don’t show to anyone, unless you want to loose your key.

TOP

How to make your public key public?

We’ve now reached the point when we can publicize our key. The easiest way of doing so is to use one of the many key-servers. Which one you use, doesn’t really matter as they are connected and update each other at least daily:

You SHOULD use the sks-keyservers.net server, and HERE is why. And HERE you’ll find instructions on adding certificates to your system.

There is a small nice feature with gpg. Instead of specifying a key-server every time you want to submit your key, you can define it in your config-file. Edit the file ~/.gnupg/gpg.conf.  Here, search for “keyserver” and uncomment (or add) the entries:

A second option is to use a web interface. You can access the key-server from your web browser at https://sks-keyservers.net/i/ and copy-paste your public key there. But first, you have to export the key to be able to copy it:

Once you submit your key, it becomes public. You can check if your key is already available:

Here you can see our test Agent Smith key in the wild:

https://pool.sks-keyservers.net:11371/pks/lookup?op=vindex&search=0x606F461A86BCF5C7

TOP

The Keyring

So far, so good, you can receive encrypted messages, but what if you wanted to send a coded message to your friend? If you used your key to encrypt it, he wouldn’t be able to decrypt it, as he doesn’t have access to your private key (unless you’re foolhardy and gave him your private key alongside with the passphrase). For this task, you need their public key. As it is impractical and tedious to search a key every time on a key-server , you keep your own keyring with all keys of those people you often communicate with. You check the list of your keys with:

At the moment, I guess, the only key in your keyring is the one you’ve just created. If a person you want to exchange secure messages provided you with a file containing their public key, you may add this key to your key-ring in the following way:

However, you don’t need to have a file, if a person exported their key to a key server (and I’m sure they did), it is even easier to get the keys directly from the server:

We’re provided with a list of possible instances. We choose the one we’re interested with.

If in doubt (e.g. there are may Agents Smiths out there), we ask the Smith we know, to send us their public key in a file. Once we’ve chosen the appropriate key, we have it in our keyring. Once added, we can list our keys to check if they’ve been added correctly with the mentioned gpg -v --list-keys. Of course you can also remove any key from your keyring (it’s been revoked, you don’t need it any more, etc.) with:

TOP

Key Signing and Trusted Keys

GPG solves the problem of the need of exchanging keys in advance, as public and private keys are introduced. However, this creates a new problem: How do I know the key REALLY belongs to the person it is said that it belongs to? Anyone could have created a key under my name and use it and nobody would realize that it’s not me! The only solution to this problem is, that I have to be very careful in accepting other keys, i.e., I have to be sure that key and person belong together. This can be checked by comparing the Key-ID and the fingerprint.  This is not really satisfactory,  however, you don’t need to be able to check if a key and a person belong together, as long as there are a few friends (that you trust) that confirm a certain key. And this is done by the key-signing. If you sign the public key of another person (by using your key), then you confirm that this key belongs to the person that it should. Therefore, it is important that your key is signed by as many people as possible, and you will probably also sometimes be asked if you would sign a key.

How to sign a key? In order to sign a public key, you must have the key in your keyring. To do so, use the gpg --import or gpg --search-keys . Once we added the key, it’s time to sign it. Type:

And you will get to a menu:

This will ask you:

Next, we can put a trust on the key:

After you have signed it, nobody knows about this new signature. Thus, next, the key has to be sent again to the owner of the key or even better back to a key-server. This is done exactly the same way as before:

The owner who receives such a newly signed public key only has to include it again into his keyring. As you don’t know when someone has signed your key, it’s good to update your keyring from time to time. You do so by a command:

It will communicate with the key server and update any changes in your keyring.

TOP

Encryption and Decryption and Signing

Finally, a few words about using your key.

If you want a simple encryption of a file or a message, whether it’s for you only or for another person, you use the command:

or for short:

This will create an ASCII armoured output (--armor / -a option): file.asc. If the option is not set, the output will be binary and the file named file.gpg.

To decrypt the file again use the following command:

But remember, you can decrypt the file only and only if the file has been encrypted using YOUR public key. If another key was used, you will not be able to decrypt the file!

If you only want to sign the message without encrypting it to make sure everyone who gets it know it’s coming from you, you can simply sign it:

With signing, you don’t have to know a persons public key, they can decrypt it, as it has not been encrypted with any key.

However, it is not very convenient, if you have to write your mail firstly, then encrypt it, and then finally send it. Thus, it would be easier if the mail-program knew how to deal with gpg. Earlier on I’ve wrote about Mutt, and it’s really easy to incorporate gpg with the mail program. Not to make this post horrendously long, I send you to a great tutorial on this matter, on the Mutt website:

Also, for my configuration, check my GitHub repository.

TOP

Further Reading

TOP