File and email encryption with GnuPG (PGP) part one

[InfoSec News <isn () c4i org>]

+------------------------------------------------------------------+
|  Linux Security: Tips, Tricks, and Hackery                       |
|  Published by Onsight, Inc.                                      |
|                                                                  |
|  04-December-2003                                                |
|  http://www.hackinglinuxexposed.com/articles/20031204.html       |
+------------------------------------------------------------------+

This issue sponsored by LinuxQuestions.org.

LinuxQuestions.org offers a free, friendly and active Linux Community
with over 85,000 members from newbies to experts. We have forums,
quizzes, reviews, tutorials, links and much more. Many of our forums
are officially recognized, such as Arch, Conectiva, Fedora, Libranet,
Linux From Scratch, Mandrake, Red Hat, Slackware, and VectorLinux. If
you have Linux questions or want to help out the Linux community,
come by http://www.LinuxQuestions.org.

--------------------------------------------------------------------

File and email encryption with GnuPG (PGP) part one
By Brian Hatch

Summary: File and mail security is easy to achieve with the right
tools. PGP has proven itself the leader, and GnuPG is the tool of
choice in the Linux world..
                               ------

Sorry for the delay. Read the footnote[1] if you're curious what's
going on out here in Seattle.

Anyone who has read this column a while knows I'm a bit obsessive
about crypto. With the speed of modern or even old processors,
there's no reason that there should be any cleartext transmissions on
the Internet at all.

Over the next few articles, I'll cover PGP (Pretty Good Privacy) and
the GnuPG (GNU Privacy Guard) implementation of it.

PGP is the defacto encryption and authentication algorithm for file
and email security.[2] PGP does not protect transmissions, such as
Telnet, HTTP, etc. You could probably build something to do a VPN in
a PGP-like manner[3], but it's traditional use is file/email
protection.

PGP offers the abilities you'd expect from crypto:

Encryption
    The ability to keep anyone except your intended recipient(s) from
    reading what you send.

Authentication
    The ability to verify that a message came from the sender, not
    someone impersonating as the sender.

Integrity
    The ability to prove that the message arrived intact, as the
    sender created it, without any tampering.

PGP relies on two mathematically related keys to do it's job, known
as a public key and a private key. I'll skip the mumbo jumbo of how
it all works -- if you're mathematically inclined, there are many
places you can read about the specifics online. Google is your
friend.[4] The fancy name for cryptographic algorithms which use
public and private keys is 'asymmetric cryptography' because there
are two keys, used asymmetrically, rather than one single key.

The important thing about the public and private keys is that they
are complementary. Specifically:

    Data encrypted with the public key can only be decrypted with the
    private key.

    Data encrypted with the private key can only be decrypted with
    the public key.

To explain how these keys work a bit more, let's take an analogy. In
the 'real' world, you have a lock on the front door of your house.
You use the same key to lock and unlock the door. This is akin to
symmetric key cryptography in the crypto world, algorithms like
blowfish, IDEA, or RC4.

In PGP, the keys that the end user will be dealing with are the
public/private keys, which are part of an asymmetric cryptographic
system. Examples include RSA and DSA. If we had this in the real
world, you'd have two front door keys. You could use key 'a' to lock,
and then only key 'b' could unlock it, or vice versa.

Over the next weeks I'll show you how all the pieces go together, but
here's our rough outline:

First, we'll create a key pair, and learn about the various bits of
info it contains. We'll then learn how to exchange this key with
others, including key servers, and how you can encrypt, sign, and
verify messages manually. We'll also show a bit of how PGP/GnuPG can
be integrated with other tools so you can have everything automated.

NOTES:

[1] Delay was due mostly to problems with the twins -- Bree went into
pre term labour, ultrasound shows twin-to-twin transfusion syndrome,
Bree in the hospital for two weeks over Thanksgiving, daughter having
trouble getting accustomed to the situation, etc. Bree's back home
now on bed rest.

In other news, we're conducting a survey for baby names for the
twins. You can find it at http://tinyurl.com/xnv4.

[2] S/MIME, which uses X509 certificates, is the other main
contender. X509 certs are the same things you are authenticating when
you use SSL such as with https:// url's.

[3] And I'd be surprised if no one has done so at some point.

[4] Now had they allowed themselves to be bought out by Microsoft,
that'd be another matter.

                            -------------
Brian Hatch is Chief Hacker at Onsight, Inc and author of Hacking
Linux Exposed and Building Linux VPNs. Once he's reached the end of
this topic of newsletters, he's going to give a free book to one
randomly chosen person who's signed his PGP key (keyid 5217530F). If
you want to verify it with him, by all means do so. Brian can be
reached at brian () hackinglinuxexposed com.

--------------------------------------------------------------------
This newsletter is distributed by Onsight, Inc.

The list is managed with MailMan (http://www.list.org). You can
subscribe, unsubscribe, or change your password by visiting
http://lists.onsight.com/ or by sending email to
linux_security-request () lists onsight com.

Archives of this and previous newsletters are available at
http://www.hackinglinuxexposed.com/articles/

--------------------------------------------------------------------

Copyright 2003, Brian Hatch.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.