The are four cornerstones of modern data security, they are:
Modern cryptography is based on discoveries made in the late 60's and 70's. These principles have been implemented into software that has not changed substantially since then. The algorithms are well know by now, and on principle they must be. The element that makes ciphers har to crack are the keys involved. The longer the safer. The idea is that if it takes so long to crack the code, so to speak, that the result is no longer relevant, we have won.
In latter years there has been discussions about the effects of the upcoming quantom computing on the cryptographical security. There are indications that we might eventually have to think again, but hard facts remain to be seen. On that background let us dive in.
The basis of this walk through is an implementation of the principles called GnuPG, standing on the shoulders of Phil Zimmermann's PGP, Pretty Good Privacy.
$ gpg --gen-key
gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Note: Use "gpg --full-generate-key" for a full featured key generation dialog.
GnuPG needs to construct a user ID to identify your key.
Real name: Niels Muller Larsen
Email address: nmla@iba.dk
You selected this USER-ID:
"Niels Muller Larsen <nmla@iba.dk>"
Change (N)ame, (E)mail, or (O)kay/(Q)uit? o
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key D7934BAF4C8C5C29 marked as ultimately trusted
gpg: directory '/home/nml/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/home/nml/.gnupg/openpgp-revocs.d/74FD33B06163105D652EAC84D7934BAF4C8C5C29.rev'
public and secret key created and signed.
pub rsa3072 2022-03-26 [SC] [expires: 2024-03-25]
74FD33B06163105D652EAC84D7934BAF4C8C5C29
uid Niels Muller Larsen <nmla@iba.dk>
sub rsa3072 2022-03-26 [E] [expires: 2024-03-25]Along the way you will be required to make a password for the protection of the key. Goes without saying, but do not forget it.
A revocation certificate seems to be automatically generated, but might have been made as follows:
$ cd .gnupg
┌──(nml㉿kali)-[~/.gnupg]
└─$ gpg --output revoke.asc --gen-revoke D7934BAF4C8C5C29
sec rsa3072/D7934BAF4C8C5C29 2022-03-26 Niels Muller Larsen <nmla@iba.dk>
Create a revocation certificate for this key? (y/N) y
Please select the reason for the revocation:
0 = No reason specified
1 = Key has been compromised
2 = Key is superseded
3 = Key is no longer used
Q = Cancel
(Probably you want to select 1 here)
Your decision? 1
Enter an optional description; end it with an empty line:
> just in case
>
Reason for revocation: Key has been compromised
so just in case
Is this okay? (y/N) y
ASCII armored output forced.
Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory gets
access to this certificate he can use it to make your key unusable.
It is smart to print this certificate and store it away, just in case
your media become unreadable. But have some caution: The print system of
your machine might store the data and make it available to others!$ gpg --output public_key.asc --armor--export nmla@iba.dk
Prerequisite is, of course, that someone send you their
public key, in casu the file tester_pub.asc.
$ gpg --import ~/tester_pub.asc gpg: key 27178E21A246F579: public key "Test Account <tester12@localhost>" imported gpg: Total number processed: 1 gpg: imported: 1
After importing a key, you should confirm it by editing the key:
gpg --edit-key tester12@localhost
gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub rsa3072/27178E21A246F579
created: 2022-03-27 expires: 2024-03-26 usage: SC
trust: unknown validity: unknown
sub rsa3072/8FEDEED4948DE586
created: 2022-03-27 expires: 2024-03-26 usage: E
[ unknown] (1). Test Account <tester12@localhost>
gpg> fpr
pub rsa3072/27178E21A246F579 2022-03-27 Test Account <tester12@localhost>
Primary key fingerprint: 70CF 6E3B 5AFB 4D37 BB02 4F2C 2717 8E21 A246 F579The fingerprint you see, must be verified with the fingerprint the owner sees. This may be done by phone if you trust the partner is the true owner. Then you do:
gpg> sign
pub rsa3072/27178E21A246F579
created: 2022-03-27 expires: 2024-03-26 usage: SC
trust: unknown validity: unknown
Primary key fingerprint: 70CF 6E3B 5AFB 4D37 BB02 4F2C 2717 8E21 A246 F579
Test Account <tester12@localhost>
This key is due to expire on 2024-03-26.
Are you sure that you want to sign this key with your
key "Niels Muller Larsen <nmla@iba.dk>" (D7934BAF4C8C5C29)
Really sign? (y/N) y
gpg> quit
Save changes? (y/N) y
You may encrypt documents for somebody by using their public key in the encryption process. The public key must of course be imported first. If it hasn't been signed you will get the extra question of whether you really trust it.
gpg --encrypt --recipient tester12@localhost --output totester12.gpg totester12.txt
The file totester12.gpg is the encrypted
output which may subsequently be sent to
tester12.
When we receive a document encrypted with out public key, we may decrypt it with our private key:
$ gpg --decrypt tester.txt.gpg
gpg: encrypted with 3072-bit RSA key, ID BA2EB35CA7F22B8E, created 2022-03-26
"Niels Muller Larsen <nmla@iba.dk>"
Hallo, hallo, dette er en prøve.
Blåbærgrød, kød og pålæg
Wally sent thhisDo you want the output stored in a file, do
$ gpg --output tester.plain.txt --decrypt tester.txt.gpg
My contact signs a document:
# gpg --output tester.txt.signed --sign tester.txt
The output document is now signed, ie encrypted with the owners private key. The owners public key, which is obtainable by anyone is now the only key in the world that can make plaintext out of the signed document.
The recipient may verify:
$ gpg --verify tester.txt.signed gpg: Signature made Sun 27 Mar 2022 02:02:00 PM CEST gpg: using RSA key 70CF6E3B5AFB4D37BB024F2C27178E21A246F579 gpg: Good signature from "Test Account <tester12@localhost>" [full]
or decrypt
$ gpg --output tester.txt.checked --decrypt tester.txt.signed gpg: Signature made Sun 27 Mar 2022 02:02:00 PM CEST gpg: using RSA key 70CF6E3B5AFB4D37BB024F2C27178E21A246F579 gpg: Good signature from "Test Account <tester12@localhost>" [full]
To highlight the differences between encryption and signing:
This ensures confidentiality.
This ensures authenticity, integrity, and non repudiation.