In 1991 Phil Zimmerman created Pretty Good Privacy or PGP to support privacy in online communication. Pretty Good Privacy (PGP) is most widely used mechanism in public key cryptography. PGP software is used nowadays in accord with OpenPGP standard.OpenPGP signatures certify:
PGP signature is hash of such data using hashing algorithm like SHA-1,encrypted by public key using PK algorithm. OpenPGP allows uses of multiple PK algorithms including:
GNUPG is GNU project's implementation of OpenPGP standard.
Use it to generate new key pair as follows:
user@USER:$gpg --gen-key
- files
- text blocks
- user IDs
PGP signature is hash of such data using hashing algorithm like SHA-1,encrypted by public key using PK algorithm. OpenPGP allows uses of multiple PK algorithms including:
- DSA US standard for digital signatures from 1994
- ElGamal discrete logarithm PK algorithm of Taher ElGamal from 1994
- RSA Rivest, Shamir and Adelman algorithm from 1978
- DSA/ElGamal can be termed DH/DSS (Diffie Hellman, DS Standard).
GNUPG is GNU project's implementation of OpenPGP standard.
Use it to generate new key pair as follows:
user@USER:$gpg --gen-key
Fill all the details for generating key.
Enter pass phrase: Any secret text you want to enter!
Repeat pass phrase: Any secret text you want to enter!
Public key created in this key pair
- is 2048 bit RSA key
- never expires
- has key ID A5A35B36
- has self-signed user ID Blogger (How to work with PGP.) <Blogger@blogger.com>
- has fingerprint 6429 7328 8C2C 181D 41CA 9558 0ADF EA9D A5A3 5B36
- is stored in public keyring ~/.gnupg/pubring.gpg
Private key is encrypted in private keyring ~/.gnupg/secring.gpg.
In case you forget encryption passphrase, create revocation certificate.
user@USER:$ gpg --output revoke.asc --gen-revoke "Blogger"
To list keys on your public keyring
user@USER:$ gpg --list-keys
To export this public key in binary format to "humbert.gpg"
user@USER:$ gpg --output humbert.gpg --export "Blogger"
Add argument "--armor" to output key in Radix-64 (Base64) format
user@USER:$ gpg --armor --export "Blogger"
Public/private key is added/deleted to one's public/private keyring by
user@USER:$ gpg --import harry_lime.gpg
user@USER:$ gpg --delete-secret-and-public-key Harry
Signing another person's public key requires you to
- import it from public key server to your public keyring
- verify its fingerprint and ID with him (e.g. by phone)
- verify ID(s) you are signing designate him
- verify he can sign message corresponding to that public key
Consider whether to put your reputation on line for him
Keys on your public keyring can be signed as followed:
user@USER:$ gpg --edit-key "Harry Lime"
...
[ unknown] (1). Harry Lime (Cuckoo clocks) <H.Lime@cccp.wien.at>
[ unknown] (2) [jpeg image of size 3100]
Command> sign
Really sign all user IDs? (y/N) y
pub 1024D/D8C0D322 created: 2011-06-08 expires: 2011-09-06 usage: SC
trust: unknown validity: unknown
Primary key fingerprint: 4B31 1C50 4331 2B16 05BC C3E9 EF84 7D38 D8C0 D322
Harry Lime (Cuckoo clocks) <H.Lime@cccp.wien.at>
[jpeg image of size 3100]
This key is due to expire on 2011-09-06.
Are you sure that you want to sign this key with your
key "Blogger (How to work with PGP.) <Blogger@blogger.com>" (A5A35B36)
Really sign? (y/N) y
...
Enter passphrase:
...
Command> quit
Save changes? (y/N) y
Individual IDs can be picked with command "uid n". n=0 deselects all.
Once signed
- export their public key from your keyring
- upload updated public key back to public key server
Updated public key will be merged with their public key on server.
Display details of other person's public key including signatures with:
user@USER:$ gpg --list-sigs "Harry Lime"
Verify their signatures with public keys in your public key ring by
user@USER:$ gpg --check-sigs "Harry Lime"
Encryption and Decryption
Encrypt doc.pdf to send to Harry Lime as follows:
user@USER:$ gpg --output doc.gpg --encrypt --recipient "Harry Lime" doc.pdf
Harry Lime decrypts doc.gpg sent to him as follows:
user@USER:$ gpg --output doc.pdf --decrypt doc.gpg
Enter passphrase:
GNUPG also supports symmetric encryption using a passphrase.
user@USER:$ gpg --output doc.gpg --symmetric doc.pdf
Enter passphrase:
Passphrase is hashed into symmetric key of the right size.
Symmetrically encrypted message can be decrypted as follows:
user@USER:$ gpg --output doc.pdf --decrypt doc.gpg
Document doc.pdf can be signed and compressed as follows:
user@USER:$ gpg --output doc.sig --sign doc.pdf
Document is signature checked and decompressed by
user@USER:$ gpg --output doc.pdf --decrypt doc.sig
Documents can be signed without compression by
user@USER:$ gpg --clearsign doc.txt
user@USER:$ gpg --output doc.sig --detach-sig doc.txt
Detached signature doc.sig can be verified over doc.txt
user@USER:$ gpg --verify doc.sig doc.txt
Subkeys and signatures on OpenPGP keys can be individually revoked.
Example shows revocation of subkey and self-signature of photo-id:
user@USER:$ gpg --edit-key "Blogger"
pub 1024D/D8E1C459 created: 2011-06-27 expires: never usage: SC
trust: ultimate validity: ultimate
sub 2048g/933254DE created: 2011-06-27 expires: never usage: E
[ultimate] (1). Blogger (How to work with PGP.) <Blogger@blogger.com>
[ultimate] (2) [jpeg image of size 25817]
Command> key 1
...
Command> revkey
...
Command> uid 2
...
Command> revsig
...
Create a revocation certificate for this signature? (y/N) y
...
pub 1024D/D8E1C459 created: 2011-06-27 expires: never usage: SC
trust: ultimate validity: ultimate
This key was revoked on 2011-06-30 by DSA key D8E1C459
Blogger (How to work with PGP.) <Blogger@blogger.com>
sub 2048g/933254DE created: 2011-06-27 revoked: 2011-06-30 usage: E
[ultimate] (1). Blogger (How to work with PGP.) <Blogger@blogger.com>
[ revoked] (2) [jpeg image of size 25817]
New subkey can be added as follows:
Command> addkey
...
Please select what kind of key you want:
...
(4) Elgamal (encrypt only)
...
Your selection? 4
ELG-E keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
...
pub 1024D/D8E1C459 created: 2011-06-27 expires: never usage: SCtrust: ultimate validity: ultimate
...
sub 4096g/11E26C5B created: 2011-06-30 expires: never usage: E
Revoked components can be trimmed by delkey and deluid.
However, once own key is published on servers, trimming it is inept.
Adjustments can be made in a key's trust level
user@USER:$ gpg --edit-key Harry
pub 1024D/D8C0D322 created: 2011-06-08 expires: 2011-09-06 usage: SC
trust: unknown validity: full
sub 2048g/9EED759F created: 2011-06-08 expires: 2011-09-06 usage: E
[ full ] (1). Harry Lime (Cuckoo clocks) <H.Lime@cccp.wien.at>
[ full ] (2) [jpeg image of size 3100]
Command> trust
...
Please decide how far you trust this user to verify other users' keys
(by looking at passports, checking fingerprints from various sources etc.)
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu
Your decision? 3
pub 1024D/D8C0D322 created: 2011-06-08 expires: 2011-09-06 usage: SC
trust: marginal validity: full
Web of trust parameters can also be altered in .gnupg/gpg.conf to
- completes-needed 2
- marginals-needed 5
- max-cert-depth 3
GNUPG supports interactive maintenance of trust database
user@USER:$ gpg --update-trustdb
This indicates web of trust is built over two keys
- one is marginally trusted (Harry Lime's)
- other is ultimately trusted (own public key)
Query pgp.mit.edu or keyserver.pgp.com for public key.Use key ID to import it into your public keyring
user@USER:$ gpg --keyserver pgp.mit.edu --recv-key 4B2700B9
Check out its 22 signatures with
user@USER:$ gpg --list-sigs Ross
Added signatures to it can be republished back to keyserver with
user@USER:$ gpg --keyserver pgp.mit.edu --send-key rja14@cl.cam.ac.uk
