Gpg - Revision history

Admin: /* Creating a Detached Signature */

2018-09-09T21:42:07Z

Creating a Detached Signature

← Older revision		Revision as of 21:42, 9 September 2018
Line 584:		Line 584:
	</pre>		</pre>

	This creates a signature file, file.tar.gz.asc. ~~Note~~ that ~~while anyone tampering~~ with file.tar.gz ~~may~~ also tamper with file.tar.gz.~~asc~~, ~~they~~ ''~~cannot~~'' ~~create~~ a valid signature file ~~unless they have~~ the original ~~creator~~'s private key.		This creates a signature file, file.tar.gz.asc.

			Take a moment to consider why this works: the original author uses a private key to sign a file; that signature can then be combined with their public key to verify that yes, in fact, the file you have was precisely the file they signed.

			If someone tampers with file.tar.gz, it will change the resulting signature. This will result in an invalid signature file.

			However, here's the key: even though someone who could tamper with file.tar.gz could also tamper with the signature file, there is NO WAY for an attacker to generate a signature file for the tampered-with file.tar.gz file that would be VALID when combined with the original author's public key, unless the attacker had their private key. Which is much harder than getting access to a web server to tamper with a download file.

			The result is that any tampering with file.tar.gz, even the slightest change, will be evident in a failed/mismatched signature. And the real strength of the signature method is ''that a new signature is impossible to create without the private key''. So being able to tamper with the signature file does not help an attacker, because they aren't able to generate a valid signature file without the original author's private key.

	===Verifying Using a Signature===		===Verifying Using a Signature===

Admin: /* Hashing Files */

2018-09-09T21:34:38Z

Hashing Files

← Older revision		Revision as of 21:34, 9 September 2018
Line 498:		Line 498:
	==Hashing Files==		==Hashing Files==

	This is the "poor-man's" quick way to sign a file. A hash is a one-way algorithm, difficult to reverse-engineer, that can be used to digest a large amount of information into a small/fixed number of bits. ~~See:~~		This is the "poor-man's" quick way to sign a file. A hash is a one-way algorithm, difficult to reverse-engineer, that can be used to digest a large amount of information into a small/fixed number of bits. See [[wikipedia:Hash function\|Hash function (wikipedia)]] for details.

	See [[wikipedia:Hash function\|Hash function (wikipedia)]] for details.

	There are a large number of hash algorithms available in GPG; these are:		There are a large number of hash algorithms available in GPG; these are:

Admin: /* Install libgpg-error */

2018-02-09T20:29:30Z

Install libgpg-error

← Older revision		Revision as of 20:29, 9 February 2018
Line 38:		Line 38:
	&& make install \		&& make install \
	&& make clean \		&& make clean \
	ln -fs ~/pkg/gpg/libgpg-error/{x.y.z,std}		&& ln -fs ~/pkg/gpg/libgpg-error/{x.y.z,std}

	</source>		</source>

Admin: /* Encrypting With Keys */

2017-10-10T00:57:43Z

Encrypting With Keys

← Older revision		Revision as of 00:57, 10 October 2017
Line 398:		Line 398:
	1. Make sure you have the public key of the individual you want to send the file to, by running		1. Make sure you have the public key of the individual you want to send the file to, by running

	<~~syntaxhighlight lang="bash"~~>		<pre>
	$ gpg --list-keys		$ gpg --list-keys
	</~~syntaxhighlight~~>		</pre>

	2. Encrypt the file using the <code>-e</code> or <code>--encrypt</code> flag, and specify a recipient by putting their name (the one that shows up from their public key) after the <code>-r</code> or <code>--recipient</code> flag:		2. Encrypt the file using the <code>-e</code> or <code>--encrypt</code> flag, and specify a recipient by putting their name (the one that shows up from their public key) after the <code>-r</code> or <code>--recipient</code> flag:

Admin: /* List Keys in Your Keyring */

2017-10-10T00:57:28Z

List Keys in Your Keyring

← Older revision		Revision as of 00:57, 10 October 2017
Line 312:		Line 312:
	Once you've created your public key, it will be added to your GPG key ring. You can see all the public keys on your GPG key ring using:		Once you've created your public key, it will be added to your GPG key ring. You can see all the public keys on your GPG key ring using:

	<~~syntaxhighlight lang="bash"~~>		<pre>
	gpg --list-keys		gpg --list-keys
	</~~syntaxhighlight~~>		</pre>

	==Sharing Public Keys==		==Sharing Public Keys==

Admin: /* Hashing Files */

2017-10-10T00:57:15Z

Hashing Files

← Older revision		Revision as of 00:57, 10 October 2017
Line 514:		Line 514:
	To hash a string on the command line, use the following command:		To hash a string on the command line, use the following command:

	<~~syntaxhighlight lang="bash"~~>		<pre>
	$ echo "This is the string that will be hashed." \| gpg --print-md MD5		$ echo "This is the string that will be hashed." \| gpg --print-md MD5
	5E 3D 07 8C 07 07 97 09 C8 52 9C 76 C5 DC 3C BF		5E 3D 07 8C 07 07 97 09 C8 52 9C 76 C5 DC 3C BF
Line 523:		Line 523:
	$ echo "This is the string that will be hashed." \| gpg --print-md SHA256		$ echo "This is the string that will be hashed." \| gpg --print-md SHA256
	6062F9DA B80754B4 CEF9327B ABC813EC 956A6CF8 6C5D4522 770AF540 92B465F2		6062F9DA B80754B4 CEF9327B ABC813EC 956A6CF8 6C5D4522 770AF540 92B465F2
	</~~syntaxhighlight~~>		</pre>

	Next, comparing hashes of very similar data:		Next, comparing hashes of very similar data:

	<~~syntaxhighlight lang="bash"~~>		<pre>
	$ echo "This is the string that will be hashed." \| gpg --print-md SHA512		$ echo "This is the string that will be hashed." \| gpg --print-md SHA512
	C5418750 FDE2E24F 1CD52E76 5662023F 7384D706 B36F8E93 59F24D28 158968E3 003F34E0		C5418750 FDE2E24F 1CD52E76 5662023F 7384D706 B36F8E93 59F24D28 158968E3 003F34E0
Line 535:		Line 535:
	C111B315 271989B5 8683FD72 320B47FA C6FFBE8C 08763629 D6E9AEBB 4F76320B 0649ED45		C111B315 271989B5 8683FD72 320B47FA C6FFBE8C 08763629 D6E9AEBB 4F76320B 0649ED45
	F85011AC DFA8898E 3A5E0361 E9AB35CD FCE137AA 989D91CD 5408C525		F85011AC DFA8898E 3A5E0361 E9AB35CD FCE137AA 989D91CD 5408C525
	</~~syntaxhighlight~~>		</pre>

	Even a small change in the original string or data will lead to a completely different hash, which is one of the strengths of a hash. If a file is changed or corrupted in even a very minor way, the hash will be completely different. If a hash is not long enough, this strength can be overcome using a Birthday Attack (see [[wikipedia:Birthday attack\|Birthday Attack (wikipedia)]]).		Even a small change in the original string or data will lead to a completely different hash, which is one of the strengths of a hash. If a file is changed or corrupted in even a very minor way, the hash will be completely different. If a hash is not long enough, this strength can be overcome using a Birthday Attack (see [[wikipedia:Birthday attack\|Birthday Attack (wikipedia)]]).
Line 543:		Line 543:
	To hash a file on the command line, use the following command:		To hash a file on the command line, use the following command:

	<~~syntaxhighlight lang="bash"~~>		<pre>
	$ cat file		$ cat file
	This is the file that will be hashed.		This is the file that will be hashed.
Line 550:		Line 550:
	9CDE290F 65062013 C9AD3164 F1D1687B 8670C9C5 BFA510B2 F49EE882 E2CF6318 8DD0FD74		9CDE290F 65062013 C9AD3164 F1D1687B 8670C9C5 BFA510B2 F49EE882 E2CF6318 8DD0FD74
	09EDEB57 167179E4 D9E0F826 26ED58B9 56A9B79A 88BC8F25 9A770AB6		09EDEB57 167179E4 D9E0F826 26ED58B9 56A9B79A 88BC8F25 9A770AB6
	</~~syntaxhighlight~~>		</pre>

	To eliminate the spaces from the hashes, you can use a little [[sed]] one-liner:		To eliminate the spaces from the hashes, you can use a little [[sed]] one-liner:

	<~~syntaxhighlight lang="bash"~~>		<pre>
	$ echo "This is the string that was hashed." \| gpg --print-md SHA512		$ echo "This is the string that was hashed." \| gpg --print-md SHA512
	39F1083B 3D6C5522 301CCEFA DD2578EA A453DBFD F344CB1F 8221CE5F BC596840 3CF987FB		39F1083B 3D6C5522 301CCEFA DD2578EA A453DBFD F344CB1F 8221CE5F BC596840 3CF987FB
Line 561:		Line 561:
	$ echo "This is the string that was hashed." \| gpg --print-md SHA512 \| sed -E -e :a -e '$!N; s/\n/ /g; ta' \| sed 's/ *//g'		$ echo "This is the string that was hashed." \| gpg --print-md SHA512 \| sed -E -e :a -e '$!N; s/\n/ /g; ta' \| sed 's/ *//g'
	B57DF60A4BBD1797433EF2EC184F06E18442B23B03E19261434B649D29757434D70ECB34243C1FFD0F88F6821485C424D01B10841A90ADC74BC1D62DACEEC0C7		B57DF60A4BBD1797433EF2EC184F06E18442B23B03E19261434B649D29757434D70ECB34243C1FFD0F88F6821485C424D01B10841A90ADC74BC1D62DACEEC0C7
	</~~syntaxhighlight~~>		</pre>

	That first sed trick is thanks to [http://stackoverflow.com/questions/1251999/sed-how-can-i-replace-a-newline-n]. It's difficult to do with sed because sed isn't very graceful at handling multi-line stuff; it's mainly built to operate on text on a line-by-line basis.		That first sed trick is thanks to [http://stackoverflow.com/questions/1251999/sed-how-can-i-replace-a-newline-n]. It's difficult to do with sed because sed isn't very graceful at handling multi-line stuff; it's mainly built to operate on text on a line-by-line basis.
Line 567:		Line 567:
	You can do it a lot easier with [[Perl]]:		You can do it a lot easier with [[Perl]]:

	<~~syntaxhighlight lang="bash"~~>		<pre>
	$ echo "This is the string that was hashed." \| gpg --print-md SHA512 \| perl -p -e 's/\n//;s/ *//g'		$ echo "This is the string that was hashed." \| gpg --print-md SHA512 \| perl -p -e 's/\n//;s/ *//g'
	B57DF60A4BBD1797433EF2EC184F06E18442B23B03E19261434B649D29757434D70ECB34243C1FFD0F88F6821485C424D01B10841A90ADC74BC1D62DACEEC0C7		B57DF60A4BBD1797433EF2EC184F06E18442B23B03E19261434B649D29757434D70ECB34243C1FFD0F88F6821485C424D01B10841A90ADC74BC1D62DACEEC0C7
	</~~syntaxhighlight~~>		</pre>

	==GPG Signatures of Files==		==GPG Signatures of Files==

Admin: /* Encrypting With Keys */

2017-08-12T21:54:44Z

Encrypting With Keys

← Older revision		Revision as of 21:54, 12 August 2017
Line 221:		Line 221:
	Bob can then decrypt the file by combining his private key with Alice's public key, which creates a complimentary combo-key, and allows Bob to decrypt the file. In this way, Alice never knows Bob's private key, and Bob never knows Alice's private key, but they can still create complimentary combo-keys to encrypt/decrypt the file.		Bob can then decrypt the file by combining his private key with Alice's public key, which creates a complimentary combo-key, and allows Bob to decrypt the file. In this way, Alice never knows Bob's private key, and Bob never knows Alice's private key, but they can still create complimentary combo-keys to encrypt/decrypt the file.

	Eve can also download the file sent from Alice to Bob, but because she does not have either Alice's private key, or Bob's private key, she cannot reconstruct the same combo-key to decrypt the file.		Evil Eve can also download the file sent from Alice to Bob, but because she does not have either Alice's private key, or Bob's private key, she cannot reconstruct the same combo-key to decrypt the file.

	=Public/Private Key Tasks=		=Public/Private Key Tasks=

Admin: /* Encrypting With Keys */

2017-08-12T21:54:08Z

Encrypting With Keys

← Older revision		Revision as of 21:54, 12 August 2017
Line 392:		Line 392:
	===Encrypting With Keys===		===Encrypting With Keys===

	~~If you are paranoid, or want very strong security, you~~ can encrypt a file so that only someone else can open it. To do this, you must create a GPG private key and a GPG public key (see [[#References]], and GPG Quick Start).		You can encrypt a file so that only someone else can open it. To do this, you must create a GPG private key and a GPG public key (see [[#References]], and GPG Quick Start).

	You can also encrypt a file for yourself, so that only your public/private keys can open it.		You can also encrypt a file for yourself, so that only your public/private keys can open it.
Line 428:		Line 428:
	</pre>		</pre>

	If you don't specify an output file, then it will output to stdout - probably not the best idea ~~for information that~~ is ~~sensitive enough~~ to be ~~encrypted~~.		If you don't specify an output file, then it will output to stdout. If you are paranoid, this is probably not the best idea, since it is vulnerable to over-the-shoulder peeking. If you are extremely paranoid, it is probably a good idea because the data won't be written to disk. If you are incredibly, extremely, hyper-paranoid, it is not a good idea because it can be intercepted using Van Eck phreaking or screen-watching. And if you're at a level of paranoia beyond that - well, stay away from computers.

	===Encrypting With Passphrases Instead of Keys===		===Encrypting With Passphrases Instead of Keys===

Admin: /* Sharing Public Keys */

2017-08-12T21:40:12Z

Sharing Public Keys

← Older revision		Revision as of 21:40, 12 August 2017
Line 318:		Line 318:
	==Sharing Public Keys==		==Sharing Public Keys==

	~~Because someone can potentially decrypt things intended only for you by sharing their~~ public ~~key with someone and claiming it is yours~~, the ~~transfer method for~~ public ~~keys should be trusted. That means '''NOT EMAIL'''! Email is not secure and can easily be read and tampered with by other people~~.		Be careful about public keys - yes, they are nominally public, but you have to be careful that you have the CORRECT public key.

	~~For~~ this ~~reason~~, public keys should either be shared in person via jumpdrive or local network transfer, via a trusted intermediate (who can sign a public key to confirm it is trusted by that person), or via a public key server.		The reason is this - when you encrypt something, you use your own private key, and someone else's public key. To decrypt it, they need your public key and the private key that corresponds to the public key that you used.

			The problem is this: if you inadvertently use the ''wrong'' public key, say a public key provided by a malicious man-in-the-middle, then whatever you encrypt can now be decrypted using nothing but your (publicly-available) public key. In other words, you don't need to keep the public key ''secret'', but you do need to ensure you have the ''right'' public key corresponding to the ''right'' person, who you want to be able to decrypt it.

			Here's what all of this means, in practice: '''DO NOT USE AN UNTRUSTED MEDIUM TO OBTAIN A PUBLIC KEY.''' That means, '''no email'''. The transfer method for public keys should be trusted. A file on a physical USB drive, a crossover ethernet cable between two computers, an SSH tunnel, an encrypted connection - these are all acceptable modes of transferring public keys, because a malicious person cannot tamper with the public key while it is in transit.

			Public keys should either be shared in person via jumpdrive or local network transfer, via a trusted intermediate (who can sign a public key to confirm it is trusted by that person), or via a public key server.

	Remember that GPG is all about trust. When you receive a public key, whoever owns the corresponding private key can decrypt everything that you encrypt using that public key, so you should be absolutely sure that you trust any public key that you receive and use to encrypt something.		Remember that GPG is all about trust. When you receive a public key, whoever owns the corresponding private key can decrypt everything that you encrypt using that public key, so you should be absolutely sure that you trust any public key that you receive and use to encrypt something.
Line 326:		Line 332:
	===Export ASCII Public Key===		===Export ASCII Public Key===

	If you want to share your public key with others, you can output your public key in ASCII format, ~~and~~ share it:		If you want to share your public key with others, you can output your public key in ASCII format, to share as a text file:

	<pre>		<pre>
Line 337:		Line 343:
	gpg -a -o my_pubkey.txt --export 'Your Name'		gpg -a -o my_pubkey.txt --export 'Your Name'
	</pre>		</pre>

			Remember, this is public, so you don't have to keep it a secret, but you want to make sure that anyone using your public key actually gets YOUR public key, and not a malicious man-in-the-middle's public key.

	===Import ASCII Public Key===		===Import ASCII Public Key===

Admin: /* Encrypting With Passphrases Instead of Keys */

2013-06-26T21:03:31Z

Encrypting With Passphrases Instead of Keys

← Older revision		Revision as of 21:03, 26 June 2013
Line 442:		Line 442:
	The result of this command is a binary file, <code>filename.gpg</code>.		The result of this command is a binary file, <code>filename.gpg</code>.

	To make an armored ascii output file, use the --armor option:		To make an armored ascii output file (if you're wondering what an ASCII armored file is, visit http://en.wikipedia.org/wiki/Binary-to-text_encoding), use the --armor option:

	<pre>		<pre>