Secrets
Hiding information from intruders was used as tactics from dawn of civilization. Earlier days of humanity more and more of the Kings and Queens have used lame form of encryption just to hide their information from the carriers and other traitors.
Given the internet and pretty much anyone with an access can look into your information; it has evidently became important privacy is the at most important thing on the Internet.
Alice and Bob invented cryptography, Just KIDDING all most all the texts, presentations, blogs and articles talk about these two people wanting to exchange some secret messages. To have local touch we take names of mythical creations of Rama and seeta, I am not going to say anything different, but present to you with things that I have understood.
Everyone has secrets, so does Rama and Seeta. How do the communicate with each other via written media, even if someone get their hands on the secret message.
Computer Security
Computer security in this article vastly refers to the various levels and dimensions of all the security involved online. To elaborate, Securing the physical computer to login password to encrypted disk, encrypted driver, encrypted folder, encrypted file to encrypted email. In this short-book we concentrate on the encrypted email part.
E-mail security.
E-mail as it stands today was invented in sixties, at the time the network is limited to a single organization (usually defence) and no one else would have access to this network as a person has to have physical access.
Once the small network started to grow (what is today commonly refered to as the Internet (with a I)), people started to realize the e-mail is often sent on the network as a clear text message. Anyone who can tap into the physical network could see the email sent from one person to another.
This is a obvious security concern, and what lead to the inventions of keys. Using these keys the cleartext is converted into ciphertext. The ciphertext is not guaranteed to have same lenght of the original message.
This process of converting from cleartext to ciphertext is known as encryption. The process of converting back from ciphertext to cleartext is known as decryption. There are two types of keys in use
Symmetric keys
Same key is used to encrypt and decrypt messages. The problem with this kind of encryption is that, if a person A gets hold of key belonging to B, which B is not intended to. A can decrypt all the messages that were sent to B.
Asymmetric keys
A pair of keys are used, commonly refered to as private key and public key. A public key is available to public and anyone can use this key to send email to a person to whom this key belongs. And the receiving party uses his/her private key to decrypt the message.
Sample graph
PGP - Pretty Good Privacy
It became evidently clear from the beginning that symmetric encryption would not offer a better infrastructure in terms of security. All the concentration was directed to asymmetric.
Birth of PGP
Terminologies
Confidentiality
The way asymmetric encryption is used in maintaining confidentiality (i.e. the privacy of your precious documents) goes something like this: you generate a ‘keypair’ (a pair of keys such that documents encrypted with one can be decrypted with the other, and vice versa). One of these is your public key, the other is your private key. So, you share your public key with the world, and keep your private key, well, private. People who want to send you an encrypted e-mail find your public key, write the e-mail, encrypt it using the public key and send it to you. You, on receiving the e-mail, whip out your private key, decrypt the ciphertext and read it. This is how confidentiality is obtained with OpenPGP, and it’s relatively simple.
In actual fact, it doesn’t quite work like this. As it happens, and quite unfortunately so, asymmetric encryption has a few drawbacks. It is quite computationally intensive, and some algorithms can produce ciphertext up to twice the size of the original text. For these reasons, a technique known as hybrid encryption is employed. Rather than just encrypting a document with your public key, a unique, random session key is generated for that document. This is also sometimes referred to as a nonce (number used once). The session key needs to be completely random, essentially ‘unguessable’; this is why having a good source of randomness (a.k.a. entropy) is very important in system security.
The document is encrypted symmetrically with that session key, and then the session key is encrypted with your public key. This will probably be much shorter than the document itself, so the computational load of asymmetric encryption is lightened significantly. The encrypted session key is attached to the symmetrically-encrypted document, and the session key discarded forever. Upon receiving the encrypted document, you use your private key to decrypt the session key, and then use the session key to decrypt the entire document.
Authenticity
One of the other uses of asymmetric encryption is for verifying the authenticity of data. For example, how do I know that this e-mail was actually sent to me from Joe Bloggs and not some impostor? We can take advantage of the fact that, if one key can decrypt a piece of ciphertext, the other key must necessarily have encrypted it. First, the sender will take the e-mail and construct a hash using a cryptographic hash function. This function must have several properties:
It should be impractical to find two distinct messages with the same hash. It should be impractical to obtain the original message given a hash (a CHF is a one-way function). It should be easy to compute the hash value for any given message. The sender then takes that hash and his/her own secret key, and encrypt the hash with the secret key. This encrypted hash, known as the signature, is bundled along with the message when it is sent. The recipient can then take the signature, the original message, and the sender’s public key, and attempt to decrypt the signature using the public key. The recipient will hash the message themselves, and compare the decrypted signature to the hash of the message. If equal, the recipient can know for certain that the message was created by someone with a certain private key (without knowing the key themselves). This is how authenticity is obtained using OpenPGP.
It also helps to enforce data integrity, since the hash check will fail if the document has been changed in transit, so either data corruption or malicious intent will be detected.
This is usually used in tandem with encryption, providing confidentiality and integrity, but it’s also pretty useful for things like software releases, where the maintainer will sign the release file with his/her private key. You’ll download the release file and the corresponding .sig or .asc file, and verify that the package was downloaded intact and that it was published by the bona fide maintainer.
Keyservers
Obviously, if you have your public/private keypair, you’ll want to somehow publish the public key somewhere where everyone can access it. Keyservers are a relatively simple way to do so. A keyserver is literally just a repository of public keys; I’ll show you later how to push to and fetch from a keyserver, since this is an important way of keeping your keyring (i.e. the public keys of others you have saved locally) up-to-date, and also keeping others’ keyrings up-to-date (such as when you make a change to your key).
WEB OF TRUST One of the most important concepts in OpenPGP is that of a Web of Trust. Let’s say Alice decides to generate a keypair using your identity (name and e-mail address). How are people to decide which belongs to who? Not only might someone send you e-mail encrypted for Alice, rendering you unable to read it, but Alice could also read that e-mail, constituting a major breach of security (not to mention a serious inconvenience). Alice could also sign documents, tricking recipients into thinking that you created them.
Fortunately, using the concept of signing as detailed above, you can sign a public key, as if to say ‘I trust this key—owner relationship’. The more keys sign that key, the more that key becomes ‘trusted’. Eventually, you will have what is known as a ‘Web of Trust’; where key A is signed by key B and C, key B is signed by keys A and D, and key C is signed by keys A, B and D, for example. The set of keys and signatures makes up the Web of Trust. You can determine whether an identity is to be trusted or not by following the chain of trusted friends. This way, anyone trying to pose as a user will not be able to get much trust; you’ll always go with the key that works out as most trusted.
I’ll give an example. Let’s say you and Bob are best friends. You trust him completely, so you’ve signed his key. Bob has a friend called Chris, who he trusts completely, so he has signed his key. If Chris sends you a signed e-mail, you’re very likely to believe that signature indeed belongs to Chris, because the authenticity of the key with which it is signed has itself been attested to by your best friend Bob (and you can verify that by checking Bob’s signature against his public key). It can get confusing for even relatively small networks, but fortunately a simple computer algorithm can calculate a ‘trust level’ for a given signature, based on following the sequence of connections of trust linking you to that signature.
You might also be happy to know that OpenPGP is a good reason to have a party. At key-signing parties, groups of people get together and exchange their key fingerprints (since each OpenPGP key has a unique identifier); the morning after, everyone goes online and signs the keys they accepted the night before.
GPG - Gnu Privacy Gaurd
Introduction to GPG
There are 3 main flavors of GnuPG:
- 1.4 (AKA gpg) - Old - Super stable (11 years old) & limited features
- 2.0 (AKA gpg2) - Stable - Most people use this for personal encryption
It isrecommended by the GnuPG project version to use the Stable GPG-2 release (2.0). I’ve also included instructions for GnuPG2.1 because I use it personally and find the new features useful.
Terminologies
Passphrase
Password is a word, as the name indicates its an ‘elongated’ password. According to research, a phrase or a sentence makes it hard to crack a secret key.
Subkeys
Subkeys are quite a subtle but powerful concept. The problem with the keypair is this: what happens when a key is compromised? You’ll have to revoke your old keypair (a process which involves you verifying that you are the owner of the key, after which it will be marked as revoked), thus losing your entire Web of Trust, and then re-generate a key and publish that. Clearly not a very good situation to be in.
OpenPGP uses a concept known as a subkey to mitigate this problem. Rather than have a single keypair, you’ll have a ‘master’ keypair which acts as your identity, and a ‘subkey’ pair which does the actual *cryption. If for some reason a subkey pair becomes compromised (i.e. someone finds out your passphrase), you can revoke just that subkey and create a new one, without losing your identity or WoT.
Types of Subkeys
Master Key
Signing Key
Encryption Key
Authentication Key
Signing the Key
This is about authorizing a key that its a trusted one. This is particularly useful in WoT(Web of Trust)
Trusting the Key
Trust level indicates how to use a key to encrypt/decrypt
Configuring your own setup
I recommend that, GnuPG2.1 to be used for all the operation unless there is physically impossible to get hold of this verison
Preliminary
Before we dive into the details of GNUPG and possibly corrupt your existing installation, we create a separate directory for our current installation, and you can overwrite your configuration if necessary create a new directory.
umask 077
echo $SHELL
export GNUPGHOME=/tmp/book/gnupg
mkdir -p ${GNUPGHOME}
# Now setup all the variables
export username='FooFirst BarLast'
export userid=foo
export useremail='foo@bar.com'
export algo=8 # this belongs to RSA with custom capabilities
export keylen=4000
export passphrase='FooIsBar'
List all Secret Keys
There should be none to start with, so below command may just print version and exit.
gpg --list-secret-keys
List All Public keys
gpg --list-public-keys
Generate a Secret-Public key-pair
Key can be generated either by interactive approach or by using batch mode file. A later case is discussed below,
batch mode
create a file pgp_batch.txt with following details
echo %echo Generating a basic OpenPGP key
Key-Type : RSA
Key-Length : 4000
Subkey-Type : ELG-E
Subkey-Length : 2528
Name-Real : FooFirst BarLast
Name-Comment : The Hoe
Name-Email : joe@foobar.com
Expire-Date : 0
Passphrase : Joes passphrase is easy
%pubring foo.pub
%secring foo.sec
# Do a commit here, so that we can later print "done" :-)
%commit
%echo done
To generate key interactively use the following
gpg --full-gen-key
Generate Sub-keys
gpg --list-keys
export mykeyid=`gpg --list-sigs | awk '/sig/ {print $2}' | tail -1`
echo $mykeyid
echo $mykeyid
0x95DC1AC8BB0C0132
and Signing key
echo -e "addkey\n8\nE\nQ\n2048\n10y\nsave\n" | \
gpg2 --expert --passphrase "FooIsBar" \
--command-fd 0 --pinentry-mode loopback \
--yes --edit-key 0x95DC1AC8BB0C0132
Create an Encryption key
echo -e "addkey\n8\nS\nQ\n2048\n10y\nsave\n" | \
gpg2 --expert --passphrase "FooIsBar" --command-fd 0 \
--pinentry-mode loopback \
--yes --edit-key 0x95DC1AC8BB0C0132
Create an Authentication Key
echo -e "addkey\n8\nS\nE\nA\nQ\n2048\n10y\nsave\n" | \
gpg2 --expert --passphrase "FooIsBar" --command-fd 0 \
--pinentry-mode loopback \
--yes --edit-key 0x95DC1AC8BB0C0132
Verify
Finally verify using -­list-keys
gpg --list-keys
/tmp/book/gnupg/pubring.kbx
---------------------------
pub rsa4000/0x95DC1AC8BB0C0132 2016-07-06 [C] [expires: 2026-07-04]
Key fingerprint = EC02 6C19 09D1 8382 692B C67A 95DC 1AC8 BB0C 0132
sub rsa2048/0x480097ADB8D11747 2016-07-06 [A] [expires: 2026-07-04]
sub rsa2048/0xD250AFC4FA53A8C4 2016-07-06 [E] [expires: 2026-07-04]
sub rsa2048/0xE866BCB7F357DA42 2016-07-06 [S] [expires: 2026-07-04]
Create GPG Config
Now its time to create the gpg.conf. Users are encouraged to blindly copy paste the following. Understanding this in detail would take its own time.
cat > ${GNUPGHOME}/gpg.conf <<EOF
no-emit-version
no-comments
keyid-format 0xlong
with-fingerprint
list-options show-uid-validity
verify-options show-uid-validity
use-agent
keyserver hkps://hkps.pool.sks-keyservers.net
# or less secure: keyserver hkp://pool.sks-keyservers.net
keyserver-options no-honor-keyserver-url
keyserver-options include-revoked
personal-cipher-preferences AES256 AES192 AES CAST5
personal-digest-preferences SHA512 SHA384 SHA256 SHA224
cert-digest-algo SHA512
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
EOF
Testing your setup
Test Signing
echo 'hello' | \
gpg2 --armor --clearsign -r foo -q \
--passphrase "FooIsBar" --pinentry-mode loopback | \
gpg2 --verify -q
gpg: Signature made Thu 07 Jul 2016 01:17:56 AM IST gpg: using RSA key 0xE866BCB7F357DA42 gpg: Good signature from “FooFirst BarLast foo@bar.com” [ultimate] Primary key fingerprint: EC02 6C19 09D1 8382 692B C67A 95DC 1AC8 BB0C 0132 Subkey fingerprint: BCD4 8411 1DA5 AE45 AED9 78AE E866 BCB7 F357 DA42
Test encrypt/decrypt
echo 'sekrats!' | \
gpg2 --armor --encrypt -r foo --passphrase 'FooIsBar' | \
gpg2 --decrypt --passphrase 'FooIsBar' -q
> sekrats!
Miscalaneous Topics
Creating Revoke keys
Generate a revokation key for both keys
gpg --out revoke-728716EC.asc --gen-revoke 728716EC
#
gpg --full-gen-key
#
gpg --out revoke-DE1CB2BF.asc --gen-revoke DE1CB2BF
See how many keys are there
gpg --list-keys
Adding Photo to your PGP key
Generating SSH keys using PGP key
Enable SSH support in GnuPG Agent by adding the corresponding option in the agent configuration file ~/.gnupg/gpg-agent.conf :
enable-ssh-support
While GnuPG programs can start the GnuPG Agent on demand, starting explicitly the agent is necessary to ensure that the agent is running when a SSH client needs it. The two lines below, to be inserted into a ~/.xprofile script, are sufficient: gpg-connect-agent /bye
export SSH_AUTH_SOCK=$HOME/.gnupg/S.gpg-agent.ssh
With the GPG agent running, you can start using it with your existing SSH keys, exactly like you would use ssh-agent. For example, to load your default ~/.ssh/id_rsa key into the agent, just run as usual: $ ssh-add Using an OpenPGP key as a SSH key Create an authentication subkey Let’s assume you already have an OpenPGP key such as the following (note the –expert flag, which will enable advanced key generation options):
$ gpg2 --expert --edit-key alice
pub rsa4096/CB2F38F25B491A54
created: 2014-12-31 expires: 2017-12-30 usage: SC
trust: ultimate validity: ultimate
sub rsa2048/04BB7F8FDEC5E5D9
created: 2014-12-31 expires: 2015-12-31 usage: S
sub rsa2048/BBB6B86627C2D43A
created: 2014-12-31 expires: 2015-12-31 usage: E
[ultimate] (1). Alice <alice@example.org>
This is a 4096-bit master key with a 2048-bit subkey for encryption and a 2048-bit subkey for signing. We will add a new 2048-bit subkey for authentication purposes:
gpg> addkey
Please select what kind of key you want:
(3) DSA (sign only)
(4) RSA (sign only)
(5) Elgamal (encrypt only)
(6) RSA (encrypt only)
(7) DSA (set your own capabilities)
(8) RSA (set your own capabilities)
(10) ECC (sign only)
(11) ECC (set your own capabilities)
(12) ECC (encrypt only)
(13) Existing key
Your selection?
Select (8) RSA (set your own capabilities):
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection?
Select successively (S), (E), and (A) to remove the signing and encryption capabilities and enable the authentication capability.
Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Authenticate
(S) Toggle the sign capability
(E) Toggle the encrypt capability
(A) Toggle the authenticate capability
(Q) Finished
Your selection?
Once the only allowed action is Authenticate, select (Q) Finished to exit this sub-menu. The remaining of the procedure is like any other key generation:
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 1y
Key expires at Thu 31 Dec 2015 02:02:56 PM CEST
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
pub rsa4096/CB2F38F25B491A54
created: 2014-12-31 expires: 2017-12-30 usage: SC
trust: ultimate validity: ultimate
sub rsa2048/04BB7F8FDEC5E5D9
created: 2014-12-31 expires: 2015-12-31 usage: S
sub rsa2048/BBB6B86627C2D43A
created: 2014-12-31 expires: 2015-12-31 usage: E
sub rsa2048/7D2233B8833E70AF
created: 2014-12-31 expires: 2015-12-31 usage: A
[ultimate] (1). Alice <alice@example.org>
gpg> save
Using the authentication subkey To tell the agent that the authentication subkey can be used with SSH, extract the keygrip of that subkey:
$ gpg2 --with-keygrip -k alice
pub rsa4096/CB2F38F25B491A54 2014-12-31 [SC] [expires: 2017-12-30]
Keygrip = D4DF0C35D3E22FA6AC37DA2E54FB03F73616A3CB
uid [ultimate] Alice <alice@example.org>
sub rsa2048/04BB7F8FDEC5E5D9 2014-12-31 [S] [expires: 2015-12-31]
Keygrip = 21B2EDF018D7CAF0B45644FDB753DD42307C4425
sub rsa2048/BBB6B86627C2D43A 2014-12-31 [E] [expires: 2015-12-31]
Keygrip = 2E149DA9C5E46E0DECC6A17EFD8B5FB1DF1E1BAB
sub rsa2048/7D2233B8833E70AF 2014-12-31 [A] [expires: 2015-12-31]
Keygrip = ECF4591CC28EC303BB12D1E866C8B8AFFB675C7D
As can be seen from last few lines the key marked with [A] is the auth key and write it into the ~/.gnupg/sshcontrol file:
# List of allowed ssh keys. Only keys present in this file are used
# in the SSH protocol. The ssh-add tool may add new entries to this
[…]
ECF4591CC28EC303BB12D1E866C8B8AFFB675C7D
You may then verify that the key is indeed available for SSH by querying the agent for available identities:
$ ssh-add -l
2048 e3:40:d5:eb:ef:b1:3a:37:87:3d:a8:44:1d:81:ed:6a (none) (RSA)
Finally, extract the public key from the agent in a form suitable for inclusion into a ~/.ssh/authorized_keys file:
$ ssh-add -L
ssh-rsa AAAAB3NzaC1yc2EAA[…truncated output…]KhJHfdIcCMRF (none)
Un-categorized topics
Entropy
A measurement randomness. Though the universe is said to be truly random, more often than not its NOT. The reason the universe is random is a subject in its own, but in computer world
Share this post