[How to] GPG and Signing Data

GNU Privacy Guard (GPG) uses public and private keys to secure communications (public-key cryptography). Many people use it to encrypt their email or other documents. An email encrypted with a user's public key can then only be decrypted with the same user's private key. This provides end-to-end encryption of the message, meaning that it is impractical for anyone that is listening in on the conversation to get the message in transit.

This is, of course, good and bad. For example, Google and other email providers use email text to gain intelligence about the user, sell user information and do better ad targeting. This revenue stream keeps these services free, but users pay for it in terms of 'sold' privacy. Email using end-to-end encryption cannot be analyzed for useful marketing information. Because of this, these providers don't want to make it easy for mass encryption.

On the other hand, criminals also use Cloud-based email services. Making encryption somewhat difficult means that sloppy criminals are less likely to use encryption. If so, they may be easier to detect and catch.

Related Book: Lucas, Michael. PGP & GPG: Email for the Practical Paranoid. No Starch Press. 2006.

Whether you are paranoid and want all your emails encrypted (good luck), or you are trying to implement a personal or business data classification policy, GPG can help with encryption requirements.

Beyond encryption, GPG is useful for signing data. This is not exactly a signature that you would put on a document. Instead it is a signature that verifies that the data is correct. The video below describes how to sign data.

Signing data lets your contacts know that the data has not been modified from the time it left your possession. Signing is NOT encryption. Everyone could see the contents. Singing just allows your contact to know the data came from you, and it is in it's original state.

Read More

[How-To] Using GnuPG to verify data using detached signatures

Many software downloads come with a signature file. You normally need to download this signature file separately. Signatures are a great way to let people know that you are the person / company that is making the software available, and that no one else has changed the data since its release.

Fig 1: Tails ISO and signature file download

We are going to use Tails Linux as an example. On their download page, you will find a link to download the Tails ISO image. This is the data we are interested in running. Think of it like the main program that we want to install / use.

Next, we are given a link to the "Tails 1.4 signature". This is signature file that the distributor created. With this signature we can verify that the Tails ISO Image has not been modified by anyone else.

Tails also provides a "SHA256 Checksum". This is a less-rigorous way than signatures to verify the data has not changed.

First, download the ISO file AND the signature file. The signature file will almost always end with ".sig". Make sure both files are in the same directory.

Once you had both files, open the command line / terminal and navigate to that directory. Next we need to use gpg to verify the signature. If we try to verify now, we may get the following results:

gpg2 --verify tails-i386-1.4.iso.sig gpg: assuming signed data in 'tails-i386-1.4.iso'
gpg: Signature made Tue 12 May 2015 02:56:27 AM KST using RSA key ID 752A3DB6
gpg: Can't check signature: No public key

In this case, we also need to get the public key of the person that created the signature. From the tails website, I find the ID of their signing key, so now we need to import.

gpg2 --recv-keys A490D0F4D311A4153E2BB7CADBB802B258ACD84F
gpg: key 58ACD84F: public key "Tails developers (offline long-term identity key) " imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: next trustdb check due at 2017-01-09
gpg: Total number processed: 1
gpg:               imported: 1

Make sure we have the right key:

gpg2 --list-keys
pub   rsa4096/58ACD84F 2015-01-18 [expires: 2016-01-11]
uid       [ unknown] Tails developers (offline long-term identity key) 
sub   rsa4096/752A3DB6 2015-01-18 [expires: 2016-01-11]
sub   rsa4096/2F699C56 2015-01-18 [expires: 2016-01-11]

Now verify the signature again:

gpg2 --verify tails-i386-1.4.iso.sig gpg: assuming signed data in 'tails-i386-1.4.iso'
gpg: Signature made Tue 12 May 2015 02:56:27 AM KST using RSA key ID 752A3DB6
gpg: Good signature from "Tails developers (offline long-term identity key) " [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F
     Subkey fingerprint: BA2C 222F 44AC 00ED 9899  3893 98FE C6BC 752A 3DB6

Here we can see when the signature was made, and the ID of that key. Next we see "Good signature" which means that the signature does verify the data.

Remember, we were given the SHA256 value of the ISO file. Get the SHA256 hash with the following command (linux):

sha256sum tails-i386-1.4.iso
339c8712768c831e59c4b1523002b83ccb98a4fe62f6a221fee3a15e779ca65d  tails-i386-1.4.iso

Now can can compare this hash value to the one on the website, and we see that they are the same.

If I can just check the hash value, why verify with a signature?

Hash values do allow you to make sure that the data has not changed, however, there are a number of weaknesses. For example, someone intercepting your network traffic could deliver the web page to you with an altered ISO link AND an altered hash value on the page. This means that the hash value will be valid, but the source of the information cannot be trusted.

Signatures help this in a number of ways. Because the signature is generated by a developer's private key, and we are verifying it with their public key, it is nearly impossible for someone to pretend to be the developer. Also, since we did not download the public key from the webpage, but looked it up on a different server, it is slightly more difficult for someone to trick us into download the wrong key. Further, we can try to use the Web of Trust to make sure we are getting the right key. In our case, we can see who has signed this key by going to a keyserver checking.

Read More

GPG Key Signing Party in Seoul 2015/06/24

Seoul Tech Society is having an introduction to Public Key Infrastructure (PKI) Wednesday, June 24th at D.CAMP in Seoul. We will give an introduction to PKI, followed by a tutorial for generating your own keys with GPG. We will cover electronically signing documents and software distributions, verifying signatures, basic encryption and authentication using your keys.

After, we will talk about - and play with - paranoid.email, which allows you to force partial encrypted email transmission, even when others are not using PKI.

Once all that has been covered, and everyone has their own GPG keys, we will have a GPG Key-signing PaRtY!~ Help improve the Web of Trust and have free drinks and light snacks at the same time!

Please RSVP at Meetup.com

If you are thinking about running a key-signing party, please check out this guide.

Read More