File and email encryption with GnuPG (PGP) part four

[InfoSec News <isn () c4i org>]

+------------------------------------------------------------------+
|  Linux Security: Tips, Tricks, and Hackery                       |
|  Published by Onsight, Inc.                                      |
|                                                                  |
|  11-March-2004                                                   |
|  http://www.hackinglinuxexposed.com/articles/20040311.html       |
+------------------------------------------------------------------+

This issue sponsored by Open Source Web Development with LAMP

OSWD w/ LAMP by James Lee and Brent Ware presents a comprehensive
overview of LAMP technologies - Linux, Apache, MySQL, Perl, PHP, WML,
Embperl, and Mason - and allows the reader to decide which tool may
be appropriate for the particular task at hand. It focuses on the
most important core material necessary so that developers can "hit
the ground running" and begin buliding applications right away, while
improving reliability and dramatically cutting costs.

For reviews, sample chapters, or to order, go to
www.opensourcewebbook.com

--------------------------------------------------------------------

File and email encryption with GnuPG (PGP) part four
By Brian Hatch

Summary: Importing and Exporting public keys.
                               ------

GnuPG and other PGP implementations allow you to encrypt (scramble
the data so only intended recipients can read it) and/or sign
(provide proof that the data has been unaltered in transit). As you
should remember, PGP keys are made up of two parts, a public key and
a private key. The public key can (and in most cases should) be
available to anyone - there's no harm in allowing it out to the
entire world. The private key should be kept somewhere secure,
protected with a strong passphrase.

So, in order to communicate with other parties, we'll need to be able
to get a copy of their public key. When encrypting a file, you
encrypt it to their public key. When verifying an electronic
signature, you verify it by decrypting the pgp signature with their
public key.[1] Without their public key, you can't encrypt or verify,
it's as simple as that.

In order to be sure you're talking with the correct party, you need
to do two things: first, get a copy of their public key, and second,
verify the key. This week we'll cover the former.

The easiest way to get a key is if they've put it up on a PGP key
server. For example if you know their keyid is D5D3BDA6, you can
retrieve it as follows:

  $ gpg --recv-key D5D3BDA6
  gpg: key D5D3BDA6: public key "John Doe ... jdoe () example com>" imported
  gpg: Total number processed: 1
  gpg:               imported: 1  (DSA: 1)

In order for --recv-key to work, you need a line like the following
in your ~/.gnupg/gpg.conf or ~/.gnupg/options file:

   # Use the US PGP keyserver
   keyserver wwwkeys.us.pgp.net

Most PGP keyservers synchronise with each other, so pick one close to
you.

To put your key on a keyserver, use --send-key:

  $ gpg --send-key mykeyid
  gpg: success sending to `wwwkeys.us.pgp.net' (status=200)

If you've received a signed file or email from someone, then you
already have access to their keyid. For example Mutt[2] can be
configured to attempt to verify the signatures on every email by
default. If you don't have the other party's public key installed,
it'll tell you it can't verify it, but will let you know the public
key that was used:

  [-- PGP output follows (current time: Wed Feb 25 07:06:06 2004) --]
  gpg: Signature made Wed Feb 25 04:30:51 2004 PDT using DSA key ID D5D3BDA6
  gpg: Can't check signature: public key not found

  [-- End of PGP output --]

In the above output, you can glean that the user's keyid is D5D3BDA6.

Alternatively, you can get the public key in a file. Perhaps the
other party sent it to you in email, or maybe they have it available
on their website. In this case, you need to import the key using
--import:

  $ gpg --import /path/to/john_pgp_public_key.asc
  gpg: key D5D3BDA6: public key "John Doe  ... jdoe () example com>" imported
  gpg: Total number processed: 1
  gpg:               imported: 1  (DSA: 1)

If you want to extract an ascii-armoured copy of your key to be able
to email to people, put on your website, etc, then use --export:

  $ gpg -a --export mykeyid > my_pgp_public_key.asc
  $ more my_pgp_public_key.asc
  -----BEGIN PGP PUBLIC KEY BLOCK-----
  Version: GnuPG v1.2.1 (GNU/Linux)
  ...
  -----END PGP PUBLIC KEY BLOCK-----

An ascii-armoured version is preferred to the binary version, because
it won't get goofed up in 7-bit protocols like email, or have trouble
with CR/LF translations in FTP.

Once you've imported the key, you should be able to see that it's
there using -kv:

  # Show key D5D3BDA6
  $ gpg -kv D5D3BDA6
  pub  1024D/D5D3BDA6 2003-12-14 John Doe (My First PGP Key) <jdoe () example com>
  sub  1024g/26F8D783 2003-12-14

  # Show the key, and all the signatures too
  $ gpg -kvv D5D3BDA6
  pub  1024D/D5D3BDA6 2003-12-14 John Doe (My First PGP Key) <jdoe () example com>
  sig 3       D5D3BDA6 2003-12-14 John Doe (My First PGP Key) <jdoe () example com>
  sub  1024g/26F8D783 2003-12-14
  sig         D5D3BDA6 2003-12-14 John Doe (My First PGP Key) <jdoe () example com>

So, we've learned how to exchange keys with other people. Next time
we'll discuss a crucial component - verifying the keys.

NOTES:

[1] Sorry for the hand-waving, but I'm trying to avoid hurting
people's brain with the math. This is the "trust me, for more details
go read the PGP documentation" explanation.

[2] The greatest mail program in the world.

                            -------------
Brian Hatch is Chief Hacker at Onsight, Inc and author of Hacking
Linux Exposed and Building Linux VPNs. How can one be up from 5:30 am
to 2:30am and still not have time to send out a newsletter that he
wrote a week ago? I know the answer - twins! Brian can be reached at
brian () hackinglinuxexposed com.

--------------------------------------------------------------------
This newsletter is distributed by Onsight, Inc.

The list is managed with MailMan (http://www.list.org). You can
subscribe, unsubscribe, or change your password by visiting
http://lists.onsight.com/ or by sending email to
linux_security-request () lists onsight com.

Archives of this and previous newsletters are available at
http://www.hackinglinuxexposed.com/articles/

--------------------------------------------------------------------

Copyright 2004, Brian Hatch.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.