| �Editor's Note |
 |
| �Free Software |
|
| �GPG |
|
| �IEEE 802.11a |
|
| �Linux |
|
| �MBSA |
|
| �METU-CC Web Site |
|
| �Thesis Advisor A. Prog. |
|
| �Viruses |
|
| �CISN Archive |
|
| �Questionnaire |
|
| �Send Feedback |
|
 |
  |
 |
 |
 |
GPG - Secure Communication with GNU Privacy Guard |
 |
|
As users, we wish that the people, to whom we have sent, read our e-mail messages safely or we would like to restrict access to most of our personal files and archives. Various methods have been developed to provide this; however they all have vulnerabilities. In this document, you will be able to read about the GnuPG, which took the place of PGP in providing secure ways for e-mail correspondence and archiving, what it means and how it can be practically used. You can access to many sites about GnuPG on Internet and you can get more information about it on GnuPG's pages. This document is prepared on both GNU/Linux operating system and WinME by using gpg (GnuPG) 1.0.6 version. GnuPG is developed as a free software that takes the place of a well-known tool for secure communication, that is commercial and copyrighted PGP. It is an application that complies with GnuPG FRC2440 (OpenPGP) standards. German Ministry of Economy and Technology supports the development of GnuPG as well. This document is comprised of two parts. The first part covers the installation and usage of GnuGPG, the second part explains the method to post e-mail messages securely on some e-mail clients. Before explaining all these, basic concepts should be mentioned to better grasp the subject. 1 Basic Concepts 1.1 Encryption with public keys Traditional encryption uses only one key. The sender of the information encrypts the message with a key and the sender opens it with the same key. However, if the encryption is obtained by a third person, the communication then is revealed. And sending this key over Internet poses a great threat to secure communication at the first instance. However, the concept of public key removed all the vulnerabilities of encrypting and decrypting with one key, mentioned here. There are two pairs of keys on public key. One of them remains absolutely with the user/it must be kept secret (private key). The other one, public key, may be given to anyone with whom the user wants to communicate. The concept mentioned here is very straightforward; the person should own a pair of keys. If you would like to send a file by encrypting it, you should encrypt it with the public key of the receiver. The receiver then is only able to decrypt this message with his/her own private key. No other method can decrypt it for now. Maybe NSA has developed an algorithm to decrypt it; but we do not know about that. However, do not forget that the encryption method is safe and secure only as long as your system remains safe. The most important thing to remember; do create the keys on your personal computer, never crate them on a computer that you remotely access to. Secondly, there should not be any security vulnerabilities on your own personal computer. You can give the public key to everyone via diskette, a page on Internet, as attached to e-mail or by placing it on a server on Internet where all the keys are kept. 1.2 Digital signatures A digital signature certifies that the message came from the person that we expect the mail from and the document is not modified in any way. Creating and verifying signatures uses the public/private keypair in an operation different from encryption and decryption. The message is sent without encryption but it has a digital signature at the end. The digital signature is created using the private key of the signer. And the receiver would use the sender's public key to check the signature to verify that the submission indeed came from the sender and that it had not been modified since the sender sent it. 1.3 Security network The vulnerability of the keypair system is that you cannot really know whether the public key is sent actually by the person whom you think sent the message to you. If your public key is modified somehow by somebody, this unknown attacker may open the encrypted messages that are sent to you via the public key he/she owns and he/she may read them. This vulnerability can be removed from PGP and GnuPG. To remove it, the people / institutions you trust should send their passwords by digitally signing it. That means a new public key should be sent to you by someone whom you trust with a digitally signed message. 1.4 Security vulnerabilities PGP has no vulnerabilities. However, a trojan horse found in February 2002, searches the PGP keys on the system and sends them to an ftp site. If the passphrase that secures your private key is not strong enough, your private key may no more remain private. Although it is quite harder to do so, attackers may take advantage of another vulnerability; they may obtain the keystrokes of your keyboard or they may transfer all the files and the display on the screen to another computer by using programs such as VNC or PCAnywhere. GnuPG would not provide you with ultimate privacy. However, your ultimate goal is to make it more difficult for eavesdroppers to attain their goals. You have to consider the system as a whole and address the issues with respect to your own security needs. 2 Use of GnuPG 2.1 GnuPG installation You can install GnuPG program from this page. On this site, the source code or the installation file for UNIX versions and Microsoft's various operating systems are available. However, in an average GNU/Linux release, this program is available as rpm, deb or tgz package. 2.1.1 Installation of GnuPG on UNIX operating systems You should check whether the file you have downloaded from Internet is modified/damaged or not. In UNIX operating systems, you can check the integrity of the file with the command md5sum gnupg-?.?.?.tar.gz. The value obtained after performing this operation should be the same with the value that the site of download has provided. You should open the file you have downloaded with tar -xvzf gnupg-?.?.?.tar.gz command; then, we recommend you to read the README file. You can read about the parametres that suit your preferences. However, tar.gz packages are installed with default istallation parametres as shown in the following lines. ./configure
In GNU/Linux systems, you should check whether it is installed or not on your system. 2.1.2 The Installation of GnuPG on Windows operating system Download the gnupg-?.?.?.zip file which is developed for Windows operating systems; then open it in a directory. Then create the directory "c:\gnupg". You can run it in the directory where "gpg.exe" is located and you can run it by entering the following commands on MS-DOS mode. 2.2 Creating keys The command you should enter on command field is gpg --gen-key. The response of the system will be as follows: gpg (GnuPG) 1.0.6; Copyright (C) 2001 Free Software Foundation, Inc.
gpg: /home/altay/.gnupg/secring.gpg: keyring created
Your selection is the task of selecting encryption algorithm. The tasks that it will carry out are explained in the parantheses. Select 1 which carries out default tasks. After selecting the kind of key, the system prompts the length of the key for key creation task. Default is 1024 byte and the recommended one is the 2048 byte, which is the maximum value. Your selection? 1
If your answer is 2048; the system will ask you whether such length is necessary. Write down yes; then the expiry date of the key that will be created shall be asked. You can change this date later. Then the system will prompt the user name of the key that will be created. You need a User-ID to identify your key; the software constructs the user id
Real name: Altay S. Ozaygen
After you answer the questions, the password that will protect your private key shall be prompted twice. Then the system will start creating the keys. It takes 3-4 minutes a PII 350MHz computer with GNU/Linux to create a 2048 byte key. The following lines will then be displayed: We need to generate a lot of random bytes. It is a good idea to perform
You will have created two keys at the end of these processes. You can distribute the public key to whom you want to communicate to. Your private key is protected by this password. 2.3 The first use of the key If you would like to use the key you have created, you can try and test it on one of your files (myconfessions.txt). You can encrypt this file with your own public key. gpg --encrypt -r altay myconfessions.txt The encrypted file generated is myconfessions.txt.gpg. However, your previous unencrypted file is still on the system. The last command enabled you to create a new encrypted file. This encrypted file can only be opened by user altay with his/her own private key. To open this encrypted file, use the command below. This command enables the user altay to open the file myconfessions.txt.gpg, which is encrypted with this altay's public key, with altay's private key. gpg --decrypt -r altay myconfessions.txt.gpg The response of the system will be as follows and it will prompt the password that will allow you to use your private key. You need a passphrase to unlock the secret key for
Though the gpg --decrypt -r altay myconfessions.txt.gpg command displays this txt.file, it cannot display it by writing the open text into a file, the command gpg --decrypt -r altay myconfessions.txt.gpg >> openconfession.txt opens the file and places it into openconfession.txt that it creates. Your first experience with encryption is over. Do not forget however that if you would like to send an e-mail with an attachment (sending encrypted e-mail will be explained later), that attachment will not be encrypted. Only the text of the e-mail, can be encrypted on e-mail programs. For that reason, encrypt the important e-mail attachments with the public key of the receiver as in the case above. 2.4 Other tasks available on the command line Working on the command line might be boring at the beginning. But, more hands-on experience with them will render it easier for you to understand what you are actually performing. Now, a few other commands shall be explained. If you have not received any public key yet, the only public key available on the system (that is your key) will be written into the own_public_key. txt file after you run the command below. gpg --export -a > own_public_key.txt However, if you placed a public key of someone on the system, and if you would like to write it into a file,enter the following command: gpg --export -a [user_name] > user_public_key.txt This command will enable you to enter the public key with .txt extension, which is sent to you by a person with whom you want to communicate with or which you have taken from a web page, into your own public key database gpg --import someones_public_key.txt The following command diplays the keys and the owner of the keys available in the database where you keep the public keys. gpg --list-keys The response will be as follows: /home/altay/.gnupg/pubring.gpg
pub 1024D/BD5D97EC 2002-04-02 Ayberk Koc (ayberk)
This command displays the private keys that you own. The numbers of the private keys are just no more than two or three. In fact, only one will do the job. If you have generated only one keypair, you can display that only. The following command allows you to delete a public key of a user from your public key database, gpg --delete-key [user name] The following command allows you to delete a private key of a user, gpg --delete-secret-key [user name] The following command allows you to change the settings of a keypair that belongs to you (such settings include expiry date etc.). Of course, you have to use the password required for the keypair to do this. gpg --edit-key [user_name] 2.5 GPA - GNU privacy assistant GPA is a graphical interface with which you can use GnuPG on the UNIX systems. This graphical interface facilitates the use of commands and replaces commands mentioned above with a few mouse clicks. GPA is still work in progress; therfore, as also mentioned on GPA's site, you should be careful when using it. There is no need to explain how to use this program here; since it renders it possible for us to do the operations we have done on the command line through a grahical interface. 3 Using GnuPG on e-mail client programs After you generate your keys, it is very easy to use this program on advanced e-mail programs. However, it is NOT safe to open an encrypted e-mail on another server, which you accessed remotely. It is strongly recommended that you perform all these processes on your desktop computer. Many popular e-mail clients support GnuPG. You can check that from the web page of your e-mail client program or from this page that lists which e-mail clients are running with which plug-ins. You should be careful when using thriving e-mail clients such as Sylpheed since their GnuGP support is yet tentative. The mental model for e-mail clients that supports GnuPG or PGP is all the same. In the first place, you should generate your keypair as mentioned above. Then, you should enter your personal pgp/gnupg id that you use on your e-mail client. To be able to send encrypted e-mails, the public keys of the people you want to communicate with should be available in your public key database. If you have not changed the default settings of your e-mail client, check it with a mark to indicate whether the e-mail will be encrypted and/or signed before sending. If you posess the plain password of the address you have sent the e-mail to, your wish will come true. You should remember that e-mail clients generally do not encrypt the attached files of the e-mails. Before sending the e-mail with attached file, you should encrypt the attached file with the public key of the receiver as mentioned above. 3.1 KMail 2.2.x KMail is an e-mail client that is made available in KDE, which is the most popular desktop graphical interface used in GNU/Linux. Enter your own user id that you use with GnuPG in the PGP user id field under Settings -> Configure KMail -> Identity. Then select Settings -> Configure KMail ->Security. Then click PGP tab.
3.2 Evolution 1.x Evolution is an advanced e-mail client, which is avialable in GNOME window manager project. This e-mail client is available in all GNU/Linux releases. After you select "Mail Settings" under "Tools" menu, the directory where the PGP runs is specified under "Other". Usually this varies according to the release; but it is specified /usr/bin/gpg as a standard. No other settings are required. Your GnuPG id, which you have crated previously and the public key of the person you intend to send the e-mail to should be present in your database. When writing an e-mail, click New Message and select "PGP sign" and/or "PGP encrypt" options according to your preferences. An e-mail that you have sent by selecting "PGP encrypt" option will be received as encrypted.asc file. The receiver must open this file with "gpg --decrypt -r altay encrypted.asc" command where "altay" should be the name of the receiver. 3.3 Mozilla/Netscape For quite a length of time, Netscape has been engaged with the Mozilla project. Mozilla is being developed following the principles of free software philosophy. If you want to use GnuPG on Mozilla/Netscape, you need a plug-in named Enigmail. Before downloading it, you should NOT forget that Enigmail has many versions. You should download the file that is compatible with the Mozilla version you are using or you should click the Install option next to your Mozilla version. If you are using Linux, you should NOT forget to run Mozilla as root user. After you install Enigmail successfully, you have to reboot the machine with Windows operating systems and you have to restart Mozilla program on machines with GNU/Linux. Then you will see that Enigmail menu and Decrypt button is created on the e-mail client. You should follow the path "Edit -> Preferences -> Privacy&Security -> Enigmail" to do the settings. On the screen that is displayed, you can perform some required simple settings. You have to specify the location of the executable file of GPG by clicking the advanced button. The other settings are features that you may use according to your own preferences. The settings you can specify on the menu of Enigmail when writing a new e-mail;
3.4 Outlook You should be very careful when using Microsoft products because it is very easy to send viruses involuntarily to here and there with Microsoft programs. Outlook e-mail client does not directly support GnuPG. You should download the required plug-in from this link and install it on your system. Peform the following steps afterwards:
Sending digitally signed e-mail messages
3.5 Outlook Express 5.x/6.0 Outlook Express e-mail server does not directly support GnuPG. You should download the required plug-in from this blink and install it on your system. Peform the following steps afterwards:
Sending digitally signed e-mail messages
4 Conclusion GnuPG is a significant tool for secure communication. GnuPG program can be effectively used both on Windows and Linux. Kmail and Evolution have built-in tools as against the e-mail clients like GNU/Linux, which require plug-ins; therefore it is easier to use them and they are more stable. Enjoy secure communications. Altay S. Ozaygen |
||
| - TOP - |
Design: CC - INFO