DC LoCo

Digital Encryption and Digital Signatures with GPG

Kevin Cole, 2006.07.12

For those of you who are unfamiliar with the concept of digital signature and encryption, here's a "nutshell" overview. (Follow the links for more details than you probably want.) This doesn't cover the specific commands needed to use GPG or PGP. The resources listed at the end of this document will get you into that. DO follow the link to the Keysigning Steps near the bottom of this page, once you have a feel for this material.

Digital Encryption and Digital Signatures

As people become more concerned about the security of e-mail, efforts have been made to improve privacy and guarantee authenticity of various digital media. Typically, this involves some kind of encryption.

A popular encryption system created by Phil Zimmermann is known as Pretty Good Privacy (PGP). The disciples of the Free Software Foundation have created a PGP-compatible, free, open-source encryption system known as the GNU* Privacy Guard (GPG or, occasionally, gnupg). Popular open-source mail clients such as Pine, Mutt, Thunderbird, Evolution and Kmail all have mechanisms for handling PGP/GPG, although in some cases you may need to do a bit of work to install a plugin or extension or to configure your mail client to work with them.

These encryption programs use an encryption technique known as public key cryptography.

The gist of these systems is that when you encrypt a file, you use a key (i.e., a rule or method of mapping your original file to an encrypted form). An example of a simple key would be the reversing the order of the alphabet so that all A's are changed to Z's, B's become Y's, and so on. This type of key is known as a symmetric key, because by applying it a second time to the encrypted message, you will end up with the unencrypted message. In other words, the same key (or two very similar keys) is used both to encrypt and decrypt the message.

Symmetric keys are not considered very secure by today's standards. The modern way to do encryption involves the use of asymmetric key pairs, where one key is used to encrypt a file and a DIFFERENT key is used to decrypt the file back into its readable form. One of the keys in a keypair remains private and secret, while the other is public and is often published on web sites or sent to systems known as keyservers. Each participant in these systems has their own public/private pair of keys. Users can collect public keys from other users and add them into a personal database known as a keyring. (A different kind of public/private pair is a username and password. Many people make their username--part of their e-mail address--public, but should keep their password secret.)

GPG (and PGP) can also be used to sign files and e-mail messages. Signing a file involves creating a digital fingerprint of the file or e-mail message, which you can think of as sort of a very abbreviated snapshot of the file; it includes both your name and e-mail address, and the time and date when the fingerprint was created.

This fingerprint is then encrypted with your private key and tacked on the end of the file or message. The encrypted fingerprint becomes the digital signature of that document. This digital signature is rather difficult to forge. Digital signatures can be used to verify that the person sending the message is indeed who you think they are, and that the message's content has not been tampered with while travelling from the sender's computer to your inbox.

 To get an idea of what a digital fingerprint is like, imagine you have two documents. Now, count the number of pages, lines, words and letters in each document. That will give you four numbers. In addition, count the number of times each letter (a-z) is used. If the letter is unused, it will have a count of zero. You should end up with a string of 30 numbers for each (4 + 26). This group of numbers would almost always be different and unique for every document. In effect, a document of any length would have a 30-number fingerprint. You COULD, with effort, create two documents that would have the same fingerprint, but it's unlikely to happen by accident. Note: This isn't how actual fingerprints are made.

Keysigning

Well... not exactly. A signed document can be used to verify that a document or message was sent by someone CLAIMING to be the person you think they are. This is where keysigning comes in.

If you receive a document and check the signature using your encryption software, you may see a message indicating that the signature is good but untrusted. What that means is that the program being used to decrypt the signature has verified that it was able to successfully decrypt the signature using a public key in your keyring, and that the resulting decrypted fragment has a fingerprint which matches the document in question. (The program that decrypts the signature also recomputes the fingerprint of the document and compares the computed fingerprint to the fingerprint found in the decrypted signature.) So, this "proves" that the document has not been tampered with since being signed. However, you have no real verification that the person sending it is who he/she claims to be.

However, if you could meet that person, face to face, and satisfy for yourself that the person is who he/she claims to be, AND if that person can verify that the public key that you have added to your keyring is indeed theirs, you could be more confident in any document signed with that key. You could also vouch for that person when someone else is unsure about the individual's identity.

Since their public key is, in essence, a document itself, you can sign it as you would any document you create. (This concept is "key" -- pun intended. ;-) ) By signing it as if it were a document you created, you are, in effect, attesting to the authenticity of the key. Your signature is a stamp of approval, notarizing the key. If I have a strong sense that the public key I have for you is legitimate, and you have signed someone else's key, then I have an increased level of trust that that the person associated with that key is who they claim to be. You (a well-trusted party) have vouched for them by signing their key and making that signed copy available to me.

Collect lots of signatures, win valuable prizes

The more you play, the more you win. ;-) Documents can be signed by more than one person. Typically with e-mail, messages are only signed by the sender, and most mail software keeps the signature separated from the message as an attachment. However, multiple signatures can be attached to documents (or embedded in them) and can travel with them. By having multiple people to whom you have proven your identity sign your key, you increase the credibility of your key. And by signing others keys after verifying their identity, you help them become more trustworthy. This network of signed keys is often referred to as the web of trust.

At a keysigning "party" (well, it's a party if you bring something to eat or drink), participants bring a government ID--usually a passport--and several slips of paper with their public key's digital fingerprint. (Remember, since a key is, in effect, a "document", it will have a fingerprint, just as any other document would.) The fingerprint is printed as a long hexadecimal number. (Your encryption software will offer a way to display key fingerprints.) Distribute your slips of paper to everyone and collect theirs. Each time you exchange slips, also verify each others identity by examining the government ID. Don't lose the papers you've collected...

The next time you're sitting at your computer, haul out those slips of paper. Using your encryption software, verify that you have their key in your keyring. If not, you'll need to retrieve it either from a keyserver or a web page where they have published a readable version of their binary key. (Keys are normally stored in a binary format that cannot be displayed accurately.) After you have imported the key, you can "edit" it, specifying how much trust you place on it, and then sign it. Finally, you should either export it to a readable format and send it to the owner, or publish it to a keyserver, letting the owner know you've done so. Or both.

Next: A quick Keysigning Steps overview.

Resources

* GNU = "GNU's Not Unix" (Don't ask.)