The GNU Privacy Handbook
Copyright © 1999 by The Free Software Foundation
Permission is granted to copy, distribute and/or modify this document under the terms of the
GNU Free Documentation License, Version 1.1 or any later version published by the Free
Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
Texts. A copy of the license is included in the section entitled "GNU Free Documentation
License".
Please direct questions, bug reports, or suggestions concerning this manual to the
maintainer, Mike Ashley (<jashley@acm.org>). When referring to the manual please specify
which version of the manual you have by using this version string: $Name: v1_1 $.
Contributors to this manual include Matthew Copeland, Joergen Grahn, and David A. Wheeler. J
Horacio MG has translated the manual to Spanish.
Table of Contents
1. Getting Started
Generating a new keypair
Generating a revocation certificate
Exchanging keys
Exporting a public key
Importing a public key
Encrypting and decrypting documents
Making and verifying signatures
Clearsigned documents
Detached signatures
2. Concepts
Symmetric ciphers
Public-key ciphers
Hybrid ciphers
Digital signatures
3. Key Management
Managing your own keypair
Key integrity
Adding and deleting key components
Revoking key components
Updating a key’s expiration time
Validating other keys on your public keyring
Trust in a key’s owner
Using trust to validate keys
Distributing keys
4. Daily use of GnuPG
Defining your security needs
Choosing a key size
Protecting your private key
Selecting expiration dates and using subkeys
Managing your web of trust
Building your web of trust
Using GnuPG legally
5. Topics
Writing user interfaces
A. GNU Free Documentation License
0. PREAMBLE
1. APPLICABILITY AND DEFINITIONS
2. VERBATIM COPYING
3. COPYING IN QUANTITY
4. MODIFICATIONS
5. COMBINING DOCUMENTS
6. COLLECTIONS OF DOCUMENTS
7. AGGREGATION WITH INDEPENDENT WORKS
8. TRANSLATION
9. TERMINATION
10. FUTURE REVISIONS OF THIS LICENSE
Chapter 1. Getting Started
GnuPG is a tool for secure communication. This chapter is a quick-start guide that covers
the core functionality of GnuPG. This includes keypair creation, exchanging and verifying
keys, encrypting and decrypting documents, and authenticating documents with digital
signatures. It does not explain in detail the concepts behind public-key cryptography,
encryption, and digital signatures. This is covered in Chapter 2. It also does not explain
how to use GnuPG wisely. This is covered in Chapters 3 and 4.
GnuPG uses public-key cryptography so that users may communicate securely. In a public-key
system, each user has a pair of keys consisting of a private key and a public key. A user’s
private key is kept secret; it need never be revealed. The public key may be given to anyone
with whom the user wants to communicate. GnuPG uses a somewhat more sophisticated scheme in
which a user has a primary keypair and then zero or more additional subordinate keypairs.
The primary and subordinate keypairs are bundled to facilitate key management and the bundle
can often be considered simply as one keypair.
Generating a new keypair
The command-line option -gen-key is used to create a new primary keypair.
alice% gpg -gen-key
gpg (GnuPG) 0.9.4; Copyright (C) 1999 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) ElGamal (sign and encrypt)
Your selection?
GnuPG is able to create several different types of keypairs, but a primary key must be
capable of making signatures. There are therefore only three options. Option 1 actually
creates two keypairs. A DSA keypair is the primary keypair usable only for making
signatures. An ElGamal subordinate keypair is also created for encryption. Option 2 is
similar but creates only a DSA keypair. Option 41 creates a single ElGamal keypair usable
for both making signatures and performing encryption. In all cases it is possible to later
add additional subkeys for encryption and signing. For most users the default option is
fine.
You must also choose a key size. The size of a DSA key must be between 512 and 1024 bits,
and an ElGamal key may be of any size. GnuPG, however, requires that keys be no smaller than
768 bits. Therefore, if Option 1 was chosen and you choose a keysize larger than 1024 bits,
the ElGamal key will have the requested size, but the DSA key will be 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024)
The longer the key the more secure it is against brute-force attacks, but for almost all
purposes the default keysize is adequate since it would be cheaper to circumvent the
encryption than try to break it. Also, encryption and decryption will be slower as the key
size is increased, and a larger keysize may affect signature length. Once selected, the
keysize can never be changed.
Finally, you must choose an expiration date. If Option 1 was chosen, the expiration date
will be used for both the ElGamal and DSA keypairs.
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
For most users a key that does not expire is adequate. The expiration time should be chosen
with care, however, since although it is possible to change the expiration date after the
key is created, it may be difficult to communicate a change to users who have your public
key.
You must provide a user ID in addition to the key parameters. The user ID is used to
associate the key being created with a real person.
You need a User-ID to identify your key; the software constructs the user id
from Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name:
Only one user ID is created when a key is created, but it is possible to create additional
user IDs if you want to use the key in two or more contexts, e.g., as an employee at work
and a political activist on the side. A user ID should be created carefully since it cannot
be edited after it is created.
GnuPG needs a passphrase to protect the primary and subordinate private keys that you keep
in your possession.
You need a Passphrase to protect your private key.
Enter passphrase:
There is no limit on the length of a passphrase, and it should be carefully chosen. From the
perspective of security, the passphrase to unlock the private key is one of the weakest
points in GnuPG (and other public-key encryption systems as well) since it is the only
protection you have if another individual gets your private key. Ideally, the passphrase
should not use words from a dictionary and should mix the case of alphabetic characters as
well as use non-alphabetic characters. A good passphrase is crucial to the secure use of
GnuPG.
Generating a revocation certificate
After your keypair is created you should immediately generate a revocation certificate for
the primary public key using the option -gen-revoke. If you forget your passphrase or if
your private key is compromised or lost, this revocation certificate may be published to
notify others that the public key should no longer be used. A revoked public key can still
be used to verify signatures made by you in the past, but it cannot be used to encrypt
future messages to you. It also does not affect your ability to decrypt messages sent to you
in the past if you still do have access to the private key.
alice% gpg -output revoke.asc -gen-revoke mykey
[...]
The argument mykey must be a key specifier, either the key ID of your primary keypair or any
part of a user ID that identifies your keypair. The generated certificate will be left in
the file revoke.asc. If the –output option is omitted, the result will be placed on standard
output. Since the certificate is short, you may wish to print a hardcopy of the certificate
to store somewhere safe such as your safe deposit box. The certificate should not be stored
where others can access it since anybody can publish the revocation certificate and render
the corresponding public key useless.
Exchanging keys
To communicate with others you must exchange public keys. To list the keys on your public
keyring use the command-line option -list-keys.
alice% gpg -list-keys
/users/alice/.gnupg/pubring.gpg
--------------------------
pub 1024D/BB7576AC 1999-06-04 Alice (Judge) <alice@cyb.org>
sub 1024g/78E9A8FA 1999-06-04
Exporting a public key
To send your public key to a correspondent you must first export it. The command-line option
-export is used to do this. It takes an additional argument identifying the public key to
export. As with the -gen-revoke option, either the key ID or any part of the user ID may be
used to identify the key to export.
alice% gpg -output alice.gpg -export alice@cyb.org
The key is exported in a binary format, but this can be inconvenient when the key is to be
sent though email or published on a web page. GnuPG therefore supports a command-line option
-armor2 that causes output to be generated in an ASCII-armored format similar to uuencoded
documents. In general, any output from GnuPG, e.g., keys, encrypted documents, and
signatures, can be ASCII-armored by adding the -armor option.
alice% gpg -armor -export alice@cyb.org
---BEGIN PGP PUBLIC KEY BLOCK---
Version: GnuPG v0.9.7 (GNU/Linux)
Comment: For info see http://www.gnupg.org
[...]
---END PGP PUBLIC KEY BLOCK---
Importing a public key
A public key may be added to your public keyring with the -import option.
alice% gpg -import blake.gpg
gpg: key 9E98BC16: public key imported
gpg: Total number processed: 1
gpg: imported: 1
alice% gpg -list-keys
/users/alice/.gnupg/pubring.gpg
--------------------------
pub 1024D/BB7576AC 1999-06-04 Alice (Judge) <alice@cyb.org>
sub 1024g/78E9A8FA 1999-06-04
pub 1024D/9E98BC16 1999-06-04 Blake (Executioner) <blake@cyb.org>
sub 1024g/5C8CBD41 1999-06-04
Once a key is imported it should be validated. GnuPG uses a powerful and flexible trust
model that does not require you to personally validate each key you import. Some keys may
need to be personally validated, however. A key is validated by verifying the key’s
fingerprint and then signing the key to certify it as a valid key. A key’s fingerprint can
be quickly viewed with the -fingerprint command-line option, but in order to certify the key
you must edit it.
alice% gpg -edit-key blake@cyb.org
pub 1024D/9E98BC16 created: 1999-06-04 expires: never trust: -/q
sub 1024g/5C8CBD41 created: 1999-06-04 expires: never
Blake (Executioner) blake@cyb.org
Command> fpr
pub 1024D/9E98BC16 1999-06-04 Blake (Executioner) <blake@cyb.org>
Fingerprint: 268F 448F CCD7 AF34 183E 52D8 9BDE 1A08 9E98 BC16
A key’s fingerprint is verified with the key’s owner. This may be done in person or over the
phone or through any other means as long as you can guarantee that you are communicating
with the key’s true owner. If the fingerprint you get is the same as the fingerprint the
key’s owner gets, then you can be sure that you have a correct copy of the key.
After checking the fingerprint, you may sign the key to validate it. Since key verification
is a weak point in public-key cryptography, you should be extremely careful and always check
a key’s fingerprint with the owner before signing the key.
Command> sign
pub 1024D/9E98BC16 created: 1999-06-04 expires: never trust: -/q
Fingerprint: 268F 448F CCD7 AF34 183E 52D8 9BDE 1A08 9E98 BC16
Blake (Executioner) blake@cyb.org
Are you really sure that you want to sign this key
with your key: "Alice (Judge) <alice@cyb.org>"
Really sign?
Once signed you can check the key to list the signatures on it and see the signature that
you have added. Every user ID on the key will have one or more self-signatures as well as a
signature for each user that has validated the key.
Command> check
uid Blake (Executioner) <blake@cyb.org>
sig! 9E98BC16 1999-06-04 [self-signature]
sig! BB7576AC 1999-06-04 Alice (Judge) alice@cyb.org
Encrypting and decrypting documents
A public and private key each have a specific role when encrypting and decrypting documents.
A public key may be thought of as an open safe. When a correspondent encrypts a document
using a public key, that document is put in the safe, the safe shut, and the combination
lock spun several times. The corresponding private key is the combination that can reopen
the safe and retrieve the document. In other words, only the person who holds the private
key can recover a document encrypted using the associated public key.
The procedure for encrypting and decrypting documents is straightforward with this mental
model. If you want to encrypt a message to Alice, you encrypt it using Alice’s public key,
and she decrypts it with her private key. If Alice wants to send you a message, she encrypts
it using your public key, and you decrypt it with your private key.
To encrypt a document the option -encrypt is used. You must have the public keys of the
intended recipients. The software expects the name of the document to encrypt as input; if
omitted, it reads standard input.
The encrypted result is placed on standard output or as specified using the option -output.
The document is compressed for additional security in addition to encrypting it.
alice% gpg -output doc.gpg -encrypt -recipient blake@cyb.org doc
The -recipient option is used once for each recipient and takes an extra argument specifying
the public key to which the document should be encrypted. The encrypted document can only be
decrypted by someone with a private key that complements one of the recipients’ public keys.
In particular, you cannot decrypt a document encrypted by you unless you included your own
public key in the recipient list.
To decrypt a message the option -decrypt is used. You need the private key to which the
message was encrypted. Similar to the encryption process, the document to decrypt is input,
and the decrypted result is output.
blake% gpg -output doc -decrypt doc.gpg
You need a passphrase to unlock the secret key for
user: "Blake (Executioner) <blake@cyb.org>"
1024-bit ELG-E key, ID 5C8CBD41, created 1999-06-04 (main key ID 9E98BC16)
Enter passphrase:
Documents may also be encrypted without using public-key cryptography. Instead, you use a
symmetric cipher to encrypt the document. The key used to drive the symmetric cipher is
derived from a passphrase supplied when the document is encrypted, and for good security, it
should not be the same passphrase that you use to protect your private key. Symmetric
encryption is useful for securing documents when the passphrase does not need to be
communicated to others. A document can be encrypted with a symmetric cipher by using the
-symmetric option.
alice% gpg -output doc.gpg -symmetric doc
Enter passphrase:
Making and verifying signatures
A digital signature certifies and timestamps a document. If the document is subsequently
modified in any way, a verification of the signature will fail. A digital signature can
serve the same purpose as a hand-written signature with the additional benefit of being
tamper-resistant. The GnuPG source distribution, for example, is signed so that users can
verify that the source code has not been modified since it was packaged.
Creating and verifying signatures uses the public/private keypair in an operation different
from encryption and decryption. A signature is created using the private key of the signer.
The signature is verified using the corresponding public key. For example, Alice would use
her own private key to digitally sign her latest submission to the Journal of Inorganic
Chemistry. The associate editor handling her submission would use Alice’s public key to
check the signature to verify that the submission indeed came from Alice and that it had not
been modified since Alice sent it. A consequence of using digital signatures is that it is
difficult to deny that you made a digital signature since that would imply your private key
had been compromised.
The command-line option -sign is used to make a digital signature. The document to sign is
input, and the signed document is output.
alice% gpg -output doc.sig -sign doc
You need a passphrase to unlock the private key for
user: "Alice (Judge) <alice@cyb.org>"
1024-bit DSA key, ID BB7576AC, created 1999-06-04
Enter passphrase:
The document is compressed before being signed, and the output is in binary format.
Given a signed document, you can either check the signature or check the signature and
recover the original document. To check the signature use the -verify option. To verify the
signature and extract the document use the -decrypt option. The signed document to verify
and recover is input and the recovered document is output.
blake% gpg -output doc -decrypt doc.sig
gpg: Signature made Fri Jun 4 12:02:38 1999 CDT using DSA key ID BB7576AC
gpg: Good signature from "Alice (Judge) <alice@cyb.org>"
Clearsigned documents
A common use of digital signatures is to sign usenet postings or email messages. In such
situations it is undesirable to compress the document while signing it. The option –
clearsign causes the document to be wrapped in an ASCII-armored signature but otherwise does
not modify the document.
alice% gpg -clearsign doc
You need a passphrase to unlock the secret key for
user: "Alice (Judge) <alice@cyb.org>"
1024-bit DSA key, ID BB7576AC, created 1999-06-04
---BEGIN PGP SIGNED MESSAGE---
Hash: SHA1
[...]
---BEGIN PGP SIGNATURE---
Version: GnuPG v0.9.7 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjdYCQoACgkQJ9S6ULt1dqz6IwCfQ7wP6i/i8HhbcOSKF4ELyQB1
oCoAoOuqpRqEzr4kOkQqHRLE/b8/Rw2k
=y6kj
---END PGP SIGNATURE---
Detached signatures
A signed document has limited usefulness. Other users must recover the original document
from the signed version, and even with clearsigned documents, the signed document must be
edited to recover the original. Therefore, there is a third method for signing a document
that creates a detached signature, which is a separate file. A detached signature is created
using the -detach-sig option.
alice% gpg -output doc.sig -detach-sig doc
You need a passphrase to unlock the secret key for
user: "Alice (Judge) <alice@cyb.org>"
1024-bit DSA key, ID BB7576AC, created 1999-06-04
Enter passphrase:
Both the document and detached signature are needed to verify the signature. The -verify
option can be to check the signature.
blake% gpg -verify doc.sig doc
gpg: Signature made Fri Jun 4 12:38:46 1999 CDT using DSA key ID BB7576AC
gpg: Good signature from "Alice (Judge) <alice@cyb.org>"
Chapter 2. Concepts
GnuPG makes uses of several cryptographic concepts including symmetric ciphers, public-key
ciphers, and oneway hashing. You can make basic use GnuPG without fully understanding these
concepts, but in order to use it wisely some understanding of them is necessary.
This chapter introduces the basic cryptographic concepts used in GnuPG. Other books cover
these topics in much more detail. A good book with which to pursue further study is Bruce
Schneier (http://www.counterpane.com/schneier.html)’“Applied Cryptography”
(http://www.counterpane.com/applied.html).
Symmetric ciphers
A symmetric cipher is a cipher that uses the same key for both encryption and decryption.
Two parties communicating using a symmetric cipher must agree on the key beforehand. Once
they agree, the sender encrypts a message using the key, sends it to the receiver, and the
receiver decrypts the message using the key. As an example, the German Enigma is a symmetric
cipher, and daily keys were distributed as code books. Each day, a sending or receiving
radio operator would consult his copy of the code book to find the day’s key. Radio traffic
for that day was then encrypted and decrypted using the day’s key. Modern examples of
symmetric ciphers include 3DES, Blowfish, and IDEA.
A good cipher puts all the security in the key and none in the algorithm. In other words, it
should be no help to an attacker if he knows which cipher is being used. Only if he obtains
the key would knowledge of the algorithm be needed. The ciphers used in GnuPG have this
property.
Since all the security is in the key, then it is important that it be very difficult to
guess the key. In other words, the set of possible keys, i.e., the key space, needs to be
large. While at Los Alamos, Richard Feynman was famous for his ability to crack safes. To
encourage the mystique he even carried around a set of tools including an old stethoscope.
In reality, he used a variety of tricks to reduce the number of combinations he had to try
to a small number and then simply guessed until he found the right combination. In other
words, he reduced the size of the key space.
Britain used machines to guess keys during World War 2. The German Enigma had a very large
key space, but the British built specialized computing engines, the Bombes, to mechanically
try keys until the day’s key was found. This meant that sometimes they found the day’s key
within hours of the new key’s use, but it also meant that on some days they never did find
the right key. The Bombes were not general-purpose computers but were precursors to modern-
day computers.
Today, computers can guess keys very quickly, and this is why key size is important in
modern cryptosystems. The cipher DES uses a 56-bit key, which means that there are 256
possible keys. 256 is 72,057,594,037,927,936 keys. This is a lot of keys, but a general-
purpose computer can check the entire key space in a matter of days. A specialized computer
can check it in hours. On the other hand, more recently designed ciphers such as 3DES,
Blowfish, and IDEA all use 128-bit keys, which means there are 2128 possible keys. This is
many, many more keys, and even if all the computers on the planet cooperated, it could still
take more time than the age of the universe to find the key.
Public-key ciphers
The primary problem with symmetric ciphers is not their security but with key exchange. Once
the sender and receiver have exchanged keys, that key can be used to securely communicate,
but what secure communication channel was used to communicate the key itself? In particular,
it would probably be much easier for an attacker to work to intercept the key than it is to
try all the keys in the key space. Another problem is the number of keys needed. If there
are n people who need to communicate, then n(n-1)/2 keys are needed for each pair of people
to communicate privately. This may be OK for a small number of people but quickly becomes
unwieldy for large groups of people.
Public-key ciphers were invented to avoid the key-exchange problem entirely. A public-key
cipher uses a pair of keys for sending messages. The two keys belong to the person receiving
the message. One key is a public key and may be given to anybody. The other key is a private
key and is kept secret by the owner. A sender encrypts a message using the public key and
once encrypted, only the private key may be used to decrypt it. This protocol solves the
key-exchange problem inherent with symmetric ciphers. There is no need for the sender and
receiver to agree upon a key. All that is required is that some time before secret
communication the sender gets a copy of the receiver’s public key. Furthermore, the one
public key can be used by anybody wishing to communicate with the receiver. So only n
keypairs are needed for n people to communicate secretly with one another.
Public-key ciphers are based on one-way trapdoor functions. A one-way function is a function
that is easy to compute, but the inverse is hard to compute. For example, it is easy to
multiply two prime numbers together to get a composite, but it is difficult to factor a
composite into its prime components. A one-way trapdoor function is similar, but it has a
trapdoor. That is, if some piece of information is known, it becomes easy to compute the
inverse. For example, if you have a number made of two prime factors, then knowing one of
the factors makes it easy to compute the second. Given a public-key cipher based on prime
factorization, the public key contains a composite number made from two large prime factors,
and the encryption algorithm uses that composite to encrypt the message. The algorithm to
decrypt the message requires knowing the prime factors, so decryption is easy if you have
the private key containing one of the factors but extremely difficult if you do not have it.
As with good symmetric ciphers, with a good public-key cipher all of the security rests with
the key.
Therefore, key size is a measure of the system’s security, but one cannot compare the size
of a symmetric cipher key and a public-key cipher key as a measure of their relative
security. In a brute-force attack on a symmetric cipher with a key size of 80 bits, the
attacker must enumerate up to 280 keys to find the right key. In a brute-force attack on a
public-key cipher with a key size of 512 bits, the attacker must factor a composite number
encoded in 512 bits (up to 155 decimal digits). The workload for the attacker is
fundamentally different depending on the cipher he is attacking. While 128 bits is
sufficient for symmetric ciphers, given today’s factoring technology public keys with 1024
bits are recommended for most purposes.
Hybrid ciphers
Public-key ciphers are no panacea. Many symmetric ciphers are stronger from a security
standpoint, and publickey encryption and decryption are more expensive than the
corresponding operations in symmetric systems. Public-key ciphers are nevertheless an
effective tool for distributing symmetric cipher keys, and that is how they are used in
hybrid cipher systems.
A hybrid cipher uses both a symmetric cipher and a public-key cipher. It works by using a
public-key cipher to share a key for the symmetric cipher. The actual message being sent is
then encrypted using the key and sent to the recipient. Since symmetric key sharing is
secure, the symmetric key used is different for each message sent. Hence it is sometimes
called a session key.
Both PGP and GnuPG use hybrid ciphers. The session key, encrypted using the public-key
cipher, and the message being sent, encrypted with the symmetric cipher, are automatically
combined in one package. The recipient uses his private-key to decrypt the session key and
the session key is then used to decrypt the message. A hybrid cipher is no stronger than the
public-key cipher or symmetric cipher it uses, whichever is weaker. In PGP and GnuPG, the
public-key cipher is probably the weaker of the pair. Fortunately, however, if an attacker
could decrypt a session key it would only be useful for reading the one message encrypted
with that session key. The attacker would have to start over and decrypt another session key
in order to read any other message.
Digital signatures
A hash function is a many-to-one function that maps its input to a value in a finite set.
Typically this set is a range of natural numbers. A simple hash function is f (x) = 0 for
all integers x. A more interesting hash function is f (x) = x mod 37, which maps x to the
remainder of dividing x by 37.
A document’s digital signature is the result of applying a hash function to the document. To
be useful, however, the hash function needs to satisfy two important properties. First, it
should be hard to find two documents that hash to the same value. Second, given a hash value
it should be hard to recover the document that produced that value.
Some public-key ciphers1 could be used to sign documents. The signer encrypts the document
with his private key. Anybody wishing to check the signature and see the document simply
uses the signer’s public key to decrypt the document. This algorithm does satisfy the two
properties needed from a good hash function, but in practice, this algorithm is too slow to
be useful.
An alternative is to use hash functions designed to satisfy these two important properties.
SHA and MD5 are examples of such algorithms. Using such an algorithm, a document is signed
by hashing it, and the hash value is the signature. Another person can check the signature
by also hashing their copy of the document and comparing the hash value they get with the
hash value of the original document. If they match, it is almost certain that the documents
are identical.
Of course, the problem now is using a hash function for digital signatures without
permitting an attacker to interfere with signature checking. If the document and signature
are sent unencrypted, an attacker could modify the document and generate a corresponding
signature without the recipient’s knowledge. If only the document is encrypted, an attacker
could tamper with the signature and cause a signature check to fail. A third option is to
use a hybrid public-key encryption to encrypt both the signature and document. The signer
uses his private key, and anybody can use his public key to check the signature and
document. This sounds good but is actually nonsense. If this algorithm truly secured the
document it would also secure it from tampering and there would be no need for the
signature. The more serious problem, however, is that this does not protect either the
signature or document from tampering. With this algorithm, only the session key for the
symmetric cipher is encrypted using the signer’s private key. Anybody can use the public key
to recover the session key. Therefore, it is straightforward for an attacker to recover the
session key and use it to encrypt substitute documents and signatures to send to others in
the sender’s name.
An algorithm that does work is to use a public key algorithm to encrypt only the signature.
In particular, the hash value is encrypted using the signer’s private key, and anybody can
check the signature using the public key. The signed document can be sent using any other
encryption algorithm including none if it is a public document. If the document is modified
the signature check will fail, but this is precisely what the signature check is supposed to
catch. The Digital Signature Standard (DSA) is a public key signature algorithm that works
as just described. DSA is the primary signing algorithm used in GnuPG.
Chapter 3. Key Management
Key tampering is a major security weakness with public-key cryptography. An eavesdropper may
tamper with a user’s keyrings or forge a user’s public key and post it for others to
download and use. For example, suppose Chloe wants to monitor the messages that Alice sends
to Blake. She could mount what is called a man in the middle attack. In this attack, Chloe
creates a new public/private keypair. She replaces Alice’s copy of Blake’s public key with
the new public key. She then intercepts the messages that Alice sends to Blake. For each
intercept, she decrypts it using the new private key, reencrypts it using Blake’s true
public key, and forwards the reencrypted message to Blake. All messages sent from Alice to
Blake can now be read by Chloe.
Good key management is crucial in order to ensure not just the integrity of your keyrings
but the integrity of other users’ keyrings as well. The core of key management in GnuPG is
the notion of signing keys. Key signing has two main purposes: it permits you to detect
tampering on your keyring, and it allows you to certify that a key truly belongs to the
person named by a user ID on the key. Key signatures are also used in a scheme known as the
web of trust to extend certification to keys not directly signed by you but signed by others
you trust. Responsible users who practice good key management can defeat key tampering as a
practical attack on secure communication with GnuPG.
Managing your own keypair
A keypair has a public key and a private key. A public key consists of the public portion of
the master signing key, the public portions of the subordinate signing and encryption
subkeys, and a set of user IDs used to associate the public key with a real person. Each
piece has data about itself. For a key, this data includes its ID, when it was created, when
it will expire, etc. For a user ID, this data includes the name of the real person it
identifies, an optional comment, and an email address. The structure of the private key is
similar, except that it contains only the private portions of the keys, and there is no user
ID information.
The command-line option -edit-key may be used to view a keypair. For example,
chloe% gpg -edit-key chloe@cyb.org
Secret key is available.
pub 1024D/26B6AAE1 created: 1999-06-15 expires: never trust: -/u
sub 2048g/0CF8CB7A created: 1999-06-15 expires: never
sub 1792G/08224617 created: 1999-06-15 expires: 2002-06-14
sub 960D/B1F423E7 created: 1999-06-15 expires: 2002-06-14
(1) Chloe (Jester) <chloe@cyb.org>
(2) Chloe (Plebian) <chloe@tel.net>
Command>
The public key is displayed along with an indication of whether or not the private key is
available. Information about each component of the public key is then listed. The first
column indicates the type of the key. The keyword pub identifies the public master signing
key, and the keyword sub identifies a public subordinate key. The second column indicates
the key’s bit length, type, and ID. The type is D for a DSA key, g for an encryption-only
ElGamal key, and G for an ElGamal key that may be used for both encryption and signing. The
creation date and expiration date are given in columns three and four. The user IDs are
listed following the keys.
More information about the key can be obtained with interactive commands. The command toggle
switches between the public and private components of a keypair if indeed both components
are available.
Command> toggle
sec 1024D/26B6AAE1 created: 1999-06-15 expires: never
sbb 2048g/0CF8CB7A created: 1999-06-15 expires: never
sbb 1792G/08224617 created: 1999-06-15 expires: 2002-06-14
sbb 960D/B1F423E7 created: 1999-06-15 expires: 2002-06-14
(1) Chloe (Jester) <chloe@cyb.org>
(2) Chloe (Plebian) chloe@tel.net
The information provided is similar to the listing for the public-key component. The keyword
sec identifies the private master signing key, and the keyword sbb identifies the private
subordinates keys. The user IDs from the public key are also listed for convenience.
Key integrity
When you distribute your public key, you are distributing the public components of your
master and subordinate keys as well as the user IDs. Distributing this material alone,
however, is a security risk since it is possible for an attacker to tamper with the key. The
public key can be modified by adding or substituting keys, or by adding or changing user
IDs. By tampering with a user ID, the attacker could change the user ID’s email address to
have email redirected to himself. By changing one of the encryption keys, the attacker would
also be able to decrypt the messages redirected to him.
Using digital signatures is a solution to this problem. When data is signed by a private
key, the corresponding public key is bound to the signed data. In other words, only the
corresponding public key can be used to verify the signature and ensure that the data has
not been modified. A public key can be protected from tampering by using its corresponding
private master key to sign the public key components and user IDs, thus binding the
components to the public master key. Signing public key components with the corresponding
private master signing key is called self-signing, and a public key that has self-signed
user IDs bound to it is called a certificate. As an example, Chloe has two user IDs and
three subkeys. The signatures on the user IDs can be checked with the command check from the
key edit menu.
chloe% gpg -edit-key chloe
Secret key is available.
pub 1024D/26B6AAE1 created: 1999-06-15 expires: never trust: -/u
sub 2048g/0CF8CB7A created: 1999-06-15 expires: never
sub 1792G/08224617 created: 1999-06-15 expires: 2002-06-14
sub 960D/B1F423E7 created: 1999-06-15 expires: 2002-06-14
(1) Chloe (Jester) <chloe@cyb.org>
(2) Chloe (Plebian) chloe@tel.net
Command> check
uid Chloe (Jester) <chloe@cyb.org>
sig! 26B6AAE1 1999-06-15 [self-signature]
uid Chloe (Plebian) <chloe@tel.net>
sig! 26B6AAE1 1999-06-15 [self-signature]
As expected, the signing key for each signature is the master signing key with key ID
0x26B6AAE1. The self-signatures on the subkeys are present in the public key, but they are
not shown by the GnuPG interface.
Adding and deleting key components
Both new subkeys and new user IDs may be added to your keypair after it has been created. A
user ID is added using the command adduid. You are prompted for a real name, email address,
and comment just as when you create an initial keypair. A subkey is added using the command
addkey. The interface is similar to the interface used when creating an initial keypair. The
subkey may be a DSA signing key, and encrypt-only ElGamal key, or a sign-and-encrypt ElGamal
key. When a subkey or user ID is generated it is self-signed using your master signing key,
which is why you must supply your passphrase when the key is generated.
Additional user IDs are useful when you need multiple identities. For example, you may have
an identity for your job and an identity for your work as a political activist. Coworkers
will know you by your work user ID. Coactivists will know you by your activist user ID.
Since those groups of people may not overlap, though, each group may not trust the other
user ID. Both user IDs are therefore necessary.
Additional subkeys are also useful. The user IDs associated with your public master key are
validated by the people with whom you communicate, and changing the master key therefore
requires recertification. This may be difficult and time consuming if you communicate with
many people. On the other hand, it is good to periodically change encryption subkeys. If a
key is broken, all the data encrypted with that key will be vulnerable. By changing keys,
however, only the data encrypted with the one broken key will be revealed. Subkeys and user
IDs may also be deleted. To delete a subkey or user ID you must first select it using the
key or uid commands respectively. These commands are toggles. For example, the command key 2
selects the second subkey, and invoking key 2 again deselects it. If no extra argument is
given, all subkeys or user IDs are deselected. Once the user IDs to be deleted are selected,
the command deluid actually deletes the user IDs from your key. Similarly, the command
delkey deletes all selected subkeys from both your public and private keys.
For local keyring management, deleting key components is a good way to trim other people’s
public keys of unnecessary material. Deleting user IDs and subkeys on your own key, however,
is not always wise since it complicates key distribution. By default, when a user imports
your updated public key it will be merged with the old copy of your public key on his ring
if it exists. The components from both keys are combined in the merge, and this effectively
restores any components you deleted. To properly update the key, the user must first delete
the old version of your key and then import the new version. This puts an extra burden on
the people with whom you communicate. Furthermore, if you send your key to a keyserver, the
merge will happen regardless, and anybody who downloads your key from a keyserver will never
see your key with components deleted. Consequently, for updating your own key it is better
to revoke key components instead of deleting them.
Revoking key components
To revoke a subkey it must be selected. Once selected it may be revoked with the revkey
command. The key is revoked by adding a revocation self-signature to the key. Unlike the
command-line option -gen-revoke, the effect of revoking a subkey is immediate.
Command> revkey
Do you really want to revoke this key? Y
You need a passphrase to unlock the secret key for
user: "Chloe (Jester) <chloe@cyb.org>"
1024-bit DSA key, ID B87DBA93, created 1999-06-28
pub 1024D/B87DBA93 created: 1999-06-28 expires: never trust: -/u
sub 2048g/B7934539 created: 1999-06-28 expires: never
sub 1792G/4E3160AD created: 1999-06-29 expires: 2000-06-28
rev! subkey has been revoked: 1999-06-29
sub 960D/E1F56448 created: 1999-06-29 expires: 2000-06-28
(1) Chloe (Jester) <chloe@cyb.org>
(2) Chloe (Plebian) chloe@tel.net
A user ID is revoked differently. Normally, a user ID collects signatures that attest that
the user ID describes the person who actually owns the associated key. In theory, a user ID
describes a person forever, since that person will never change. In practice, though,
elements of the user ID such as the email address and comment may change over time, thus
invalidating the user ID.
The OpenPGP specification does not support user ID revocation, but a user ID can effectively
be revoked by revoking the self-signature on the user ID. For the security reasons described
previously, correspondents will not trust a user ID with no valid self-signature.
A signature is revoked by using the command revsig. Since you may have signed any number of
user IDs, the user interface prompts you to decide for each signature whether or not to
revoke it.
Command> revsig
You have signed these user IDs:
Chloe (Jester) <chloe@cyb.org>
signed by B87DBA93 at 1999-06-28
Chloe (Plebian) <chloe@tel.net>
signed by B87DBA93 at 1999-06-28
user ID: "Chloe (Jester) <chloe@cyb.org>"
signed with your key B87DBA93 at 1999-06-28
Create a revocation certificate for this signature? (y/N)n
user ID: "Chloe (Plebian) <chloe@tel.net>"
signed with your key B87DBA93 at 1999-06-28
Create a revocation certificate for this signature? (y/N)y
You are about to revoke these signatures:
Chloe (Plebian) <chloe@tel.net>
signed by B87DBA93 at 1999-06-28
Really create the revocation certificates? (y/N)y
You need a passphrase to unlock the secret key for
user: "Chloe (Jester) <chloe@cyb.org>"
1024-bit DSA key, ID B87DBA93, created 1999-06-28
pub 1024D/B87DBA93 created: 1999-06-28 expires: never trust: -/u
sub 2048g/B7934539 created: 1999-06-28 expires: never
sub 1792G/4E3160AD created: 1999-06-29 expires: 2000-06-28
rev! subkey has been revoked: 1999-06-29
sub 960D/E1F56448 created: 1999-06-29 expires: 2000-06-28
(1) Chloe (Jester) <chloe@cyb.org>
(2) Chloe (Plebian) chloe@tel.net
A revoked user ID is indicated by the revocation signature on the ID when the signatures on
the key’s user IDs are listed.
Command> check
uid Chloe (Jester) <chloe@cyb.org>
sig! B87DBA93 1999-06-28 [self-signature]
uid Chloe (Plebian) <chloe@tel.net>
rev! B87DBA93 1999-06-29 [revocation]
sig! B87DBA93 1999-06-28 [self-signature]
Revoking both subkeys and self-signatures on user IDs adds revocation self-signatures to the
key. Since signatures are being added and no material is deleted, a revocation will always
be visible to others when your updated public key is distributed and merged with older
copies of it. Revocation therefore guarantees that everybody has a consistent copy of your
public key.
Updating a key’s expiration time
The expiration time of a key may be updated with the command expire from the key edit menu.
If no key is selected the expiration time of the primary key is updated. Otherwise the
expiration time of the selected subordinate key is updated.
A key’s expiration time is associated with the key’s self-signature. The expiration time is
updated by deleting the old self-signature and adding a new self-signature. Since
correspondents will not have deleted the old self-signature, they will see an additional
self-signature on the key when they update their copy of your key. The latest self-signature
takes precedence, however, so all correspondents will unambiguously know the expiration
times of your keys.
Validating other keys on your public keyring
In Chapter 1 a procedure was given to validate your correspondents’ public keys: a
correspondent’s key is validated by personally checking his key’s fingerprint and then
signing his public key with your private key. By personally checking the fingerprint you can
be sure that the key really does belong to him, and since you have signed they key, you can
be sure to detect any tampering with it in the future. Unfortunately, this procedure is
awkward when either you must validate a large number of keys or communicate with people whom
you do not know personally.
GnuPG addresses this problem with a mechanism popularly known as the web of trust. In the
web of trust model, responsibility for validating public keys is delegated to people you
trust. For example, suppose • Alice has signed Blake’s key, and • Blake has signed Chloe’s
key and Dharma’s key.
If Alice trusts Blake to properly validate keys that he signs, then Alice can infer that
Chloe’s and Dharma’s keys are valid without having to personally check them. She simply uses
her validated copy of Blake’s public key to check that Blake’s signatures on Chloe’s and
Dharma’s are good. In general, assuming that Alice fully trusts everybody to properly
validate keys they sign, then any key signed by a valid key is also considered valid. The
root is Alice’s key, which is axiomatically assumed to be valid.
Trust in a key’s owner
In practice trust is subjective. For example, Blake’s key is valid to Alice since she signed
it, but she may not trust Blake to properly validate keys that he signs. In that case, she
would not take Chloe’s and Dharma’s key as valid based on Blake’s signatures alone. The web
of trust model accounts for this by associating with each public key on your keyring an
indication of how much you trust the key’s owner. There are four trust levels.
unknown
Nothing is known about the owner’s judgment in key signing. Keys on your public keyring that
you do not own initially have this trust level.
none
The owner is known to improperly sign other keys.
marginal
The owner understands the implications of key signing and properly validates keys before
signing them.
full
The owner has an excellent understanding of key signing, and his signature on a key would be
as good as your own.
A key’s trust level is something that you alone assign to the key, and it is considered
private information. It is not packaged with the key when it is exported; it is even stored
separately from your keyrings in a separate database.
The GnuPG key editor may be used to adjust your trust in a key’s owner. The command is
trust. In this example Alice edits her trust in Blake and then updates the trust database to
recompute which keys are valid based on her new trust in Blake.
alice% gpg -edit-key blake
pub 1024D/8B927C8A created: 1999-07-02 expires: never trust: q/f
sub 1024g/C19EA233 created: 1999-07-02 expires: never
(1) Blake (Executioner) <blake@cyb.org>
Command> trust
pub 1024D/8B927C8A created: 1999-07-02 expires: never trust: q/f
sub 1024g/C19EA233 created: 1999-07-02 expires: never
(1) Blake (Executioner) <blake@cyb.org>
Please decide how far you trust this user to correctly
verify other users’ keys (by looking at passports,
checking fingerprints from different sources...)?
1 = Don’t know
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
s = please show me more information
m = back to the main menu
Your decision? 3
pub 1024D/8B927C8A created: 1999-07-02 expires: never trust: m/f
sub 1024g/C19EA233 created: 1999-07-02 expires: never
(1) Blake (Executioner) <blake@cyb.org>
Command> quit
[...]
Trust in the key’s owner and the key’s validity are indicated to the right when the key is
displayed. Trust in the owner is displayed first and the key’s validity is second1. The four
trust/validity levels are abbreviated:
unknown (q), none (n), marginal (m), and full (f). In this case, Blake’s key is fully valid
since Alice signed it herself. She initially has an unknown trust in Blake to properly sign
other keys but decides to trust him marginally.
Next To :: Gnu Privacy Handbook - Part 2
Credits
-- UnKnown --
|