Getting Started with GnuPG

This document:

• What is GnuPG/PGP?
• Why two keys?
• How do I generate a key for the first time?
• What protects my private key?
• What kind of passphrase is needed?
• What protects my public key?
• How should I publish my public key?
• What is key signing?
• What is the Web of Trust (WoT)?
• How do I manage and build my WoT?
• How should I manage my keypair?
• When, why and how would I revoke the key?
• About this document.

GNU/Linux documentation at DCGLUG.

• Using GnuPG at DCGLUG
• More on keysigning
• More information on GnuPG

What is GnuPG/PGP

GnuPG is an open source implementation of the proprietary Pretty Good Privacy (PGP), both act as tools for secure communication by providing each user with a pair of keys; a private key and a public key. A user's private key is kept secret; it need never be revealed. The public key may be given to anyone with whom the user wants to communicate. Unless specialised key functions are used, keys created with PGP are usually interchangeable with keys created with GnuPG and vice versa.

Why two keys?

A public and private key each have specific roles when signing, encrypting or decrypting documents.

• Signing: A digital signature can serve the same purpose as a hand-written signature on a document or email message with the additional benefit of being tamper-resistant. If the document is subsequently modified in any way, a verification of the signature will fail.
  • The private key is used to create the signature (e.g. on a credit card slip).
  • The public key is used to verify the signature (e.g. by comparing with the signature on the credit card).
• Encrypting:
  • A public key may be thought of as an open safe. When a correspondent encrypts a document using a public key, that document is put in the safe, the safe is shut and the combination lock spun several times.
  • The corresponding private key is the only combination that can reopen the safe and retrieve the document.
  In other words, only the person who holds the private key can recover a document encrypted using the associated public key.

How do I generate a key for the first time?

The normal way to create a key is:
gpg --gen-key
This asks some questions and then starts key generation. To create good random numbers for the key parameters, GnuPG needs to gather enough noise (entropy) from your system. If you see no progress during key generation you should start some other activities such as mouse moves or hitting on the CTRL and SHIFT keys.

Generate a key ONLY on a machine where you have direct physical access - don't do it over the network or on a machine used also by others - especially if you have no access to the root account.

Next, you should create a revocation certificate in case someone gets knowledge of your secret key or you forget your passphrase:
gpg --gen-revoke your_user_id

Run this command and store the revocation certificate away. The output is always ASCII armored, so that you can print it and (hopefully never) re-create it if your electronic media fails.

What protects my private key?

YOU! Protecting the private key is the most important job of the key owner.

• If you lose your private key, then you will no longer be able to decrypt documents encrypted to you in the future or in the past, and you will not be able to make signatures.
• If someone obtains your private key, then all data encrypted to the private key can be decrypted and signatures can be made in your name. Losing sole possession of your private key is catastrophic. If this happens, you need to revoke the key as soon as possible.

To help safeguard your key, GnuPG does not store your raw private key on disk. Instead it encrypts it using a symmetric encryption algorithm. That is why you need a passphrase to access the key. Thus there are two barriers an attacker must cross to access your private key:

• 1. he must actually acquire the key, and
  2. he must get past the encryption.

What kind of passphrase is needed?

A good passphrase is absolutely critical when using GnuPG. Any attacker who gains access to your private key must bypass the encryption on the private key. Instead of brute-force guessing the key, an attacker will almost certainly instead try to guess the passphrase. The security of the whole system relies on your secret key and the passphrase that protects it when someone gains access to your secret keyring.

The motivation for trying passphrases is that most people choose a passphrase that is easier to guess than a random 128-bit key. If the passphrase is a word, it is much cheaper / quicker / easier to try all the words in the dictionaries of the world's languages. Even if the word is permuted, e.g., k3wldood, it is still easier to try dictionary words with a catalog of permutations. The same problem applies to quotations. In general, passphrases based on natural-language utterances are poor passphrases since there is little randomness and lots of redundancy in natural language. You should avoid natural language passphrases if you can.

A good passphrase is one that you can remember but is hard for someone to guess. It should include characters from the whole range of printable characters on your keyboard. This includes uppercase and lowercase alphabet characters - A to Z and a to z, numbers 0 to 9, and special characters such as } and # and |. Be creative and spend a little time considering your passphrase; a good choice is important to ensure your privacy. You can change your passphrase at any time, without affecting your public key.

What protects my public key?

A public key can be protected from tampering by using self-singing to bind the components of the key together. When you generate a new keypair, the new private key is used to sign the new public key components and user IDs. A self-signed public key can not be modified by adding or substituting keys, or by adding or changing user IDs without the matching private key. When you distribute your public key, you are distributing the public components of your master and subordinate keys as well as the user IDs. Distributing this material without a self-signature would be a security risk since it would be possible for an attacker to tamper with the key. By default GnuPG creates self-signed public keys.

How should I publish my public key?

• To communicate with others using GnuPG encryption you must exchange public keys.
• To communicate with others using GnuPG signatures you must publicise your public key.

Ideally, you would distribute your public key by personally giving it to your correspondents. In practice, however, public keys are often distributed by email or some other electronic communication medium. Distribution by email is good practice when you have only a few correspondents, and even if you have many correspondents, you can use an alternative means such as posting your public key on your World Wide Web homepage. This is unacceptable, however, if people who need your public key do not know where to find it on the Web.

To solve this problem public key servers are used to collect and distribute public keys. A public key received by the server is either added to the server's database or merged with the existing key if already present. When a key request comes to the server, the server consults its database and returns the requested public key if found. A keyserver is also valuable when many people are frequently signing other people's keys because the server takes over all the hassle of keeping existing public keys updated with new signatures or user ID's.

Keep in mind, though, that this is optional. You have no obligation to either sign other people's keys or publicly advertise your public key (if you don't sign or encrypt email). The social reality, however, is that you will need to publicise your public key if you want to grow your web of trust and use GnuPG for as much of your communication as possible.

The power of GnuPG is that it is flexible enough to adapt to your security needs whatever they may be. You can use one keypair for email signing and email encryption and use a completely different, un-publicised, keypair for local encryption of personal data. How you should use GnuPG depends on the determination and resourcefulness of those who might want to read your encrypted messages or pretend to be you using signed documents. Using GnuPG to protect against casual eavesdropping is going to be different than using GnuPG to protect against a determined adversary. Your goal, ultimately, is to make it more expensive to recover the unencrypted data than that data is worth.

What is key signing?

The core of key management in GnuPG is the notion of signing keys. Key signing has two main purposes:

• it permits you to detect tampering on your keyring, and
• it allows you to certify that a key truly belongs to the person named by a user ID on the key.

A correspondent's key is validated by personally checking his key's fingerprint and then signing his public key with your private key. By personally checking the fingerprint you can be sure that the key really does belong to him, and since you have signed they key, you can be sure to detect any tampering with it in the future.

Unfortunately, this procedure is awkward when either you must validate a large number of keys or communicate with people whom you do not know personally. GnuPG addresses this problem with a mechanism popularly known as the web of trust. In the web of trust model, responsibility for validating public keys is delegated to people you trust.

For more information on what is needed before signing a key, see the D&C LUG Keysigning FAQ and the archives: Exeter area D&C LUG meeting Plymouth evening meeting Tue 20-5-03 or the GnuPG Keysigning Party HOWTO.

You should always be careful when signing other keys. It is selfish to sign a key with just enough confidence in the key's validity to satisfy your own security needs. Others, with more stringent security needs, may want to depend on your signature. If they cannot depend on you then that weakens the web of trust and makes it more difficult for all GnuPG users to communicate. Use the same care in signing keys that you would like others to use when you depend on their signatures.

What is the Web of Trust (WoT)?

The web of trust is used to extend certification to keys not directly signed by you but signed by other people you already trust. A key in the web of trust is considered valid if it meets two conditions:

• 1. It is signed by enough valid keys, meaning
     • you have signed it personally, or
     • it has been signed by one fully trusted key, or
     • it has been signed by three marginally trusted keys;
     and
  2. the path of signed keys leading from K back to your own key is five steps or shorter.

The path length, number of marginally trusted keys required, and number of fully trusted keys required may be adjusted. In general, higher numbers for these options imply that more people would be needed to conspire against you in order to have a key validated that does not actually belong to the person whom you think it does. The numbers given above are the default values used by GnuPG.

How do I manage and build my WoT?

As with protecting your private key, managing your web of trust is another aspect of using GnuPG that requires balancing security against ease of use. If you are using GnuPG to protect against casual eavesdropping and forgeries then you can afford to be relatively trusting of other people's signatures. On the other hand, if you are concerned that there may be a determined attacker interested in invading your privacy, then you should be much less trusting of other signatures and spend more time personally verifying signatures.

If you do not personally know the person whose key you want to sign, then it is not possible to sign the key yourself. You must rely on the signatures of others and hope to find a chain of signatures leading from the key in question back to your own. To have any chance of finding a chain, you must take the initiative and get your key signed by others outside of your initial web of trust. An effective way to accomplish this is to participate in key signing parties. If you are going to a conference look ahead of time for a key signing party, and if you do not see one being held, offer to hold one. You can also be more passive and carry your fingerprint with you for impromptu key exchanges. In such a situation the person to whom you gave the fingerprint would verify it and sign your public key once he returned home.

At first glance, building a web of trust is a daunting task. The people with whom you communicate need to use GnuPG, and there needs to be enough key signing so that keys can be considered valid. These are not technical problems; they are social problems. Nevertheless, you must overcome these problems if you want to use GnuPG.

When getting started using GnuPG it is important to realize that you need not securely communicate with every one of your correspondents. Start with a small circle of people, perhaps just yourself and one or two others who also want to exercise their right to privacy. Generate your keys and sign each other's public keys. This is your initial web of trust. By doing this you will appreciate the value of a small, robust web of trust and will be more cautious as you grow your web in the future.

In addition to those in your initial web of trust, you may want to communicate securely with others who are also using GnuPG. Doing so, however, can be awkward for two reasons:

• 1. you do not always know when someone uses or is willing to use GnuPG, and
  2. if you do know of someone who uses it, you may still have trouble validating their key.

The first reason occurs because people do not always advertise that they use GnuPG. The way to change this behavior is to set the example and advertise that you use GnuPG. There are at least three ways to do this:

• You can sign messages you mail to others or post to message boards,
• you can put your public key on your web page, or,
• if you put your key on a keyserver, you can put your key ID in your email signature.

If you advertise your key then you make it that much more acceptable for others to advertise their keys. Furthermore, you make it easier for others to start communicating with you securely since you have taken the initiative and made it clear that you use GnuPG.

How should I manage my keypair?

Good key management is crucial in order to ensure not just the integrity of your keyrings but the integrity of other users' keyrings as well. Responsible users who practice good key management can defeat key tampering as a practical attack on secure communication with GnuPG.

Regardless of how you use GnuPG you should store the public key's revocation certificate and a backup of your private key on write-protected media in a safe place. For example, you could burn them on a CD-ROM and store them in your safe deposit box at the bank in a sealed envelope. Alternatively, you could store them on a floppy and hide it in your house. Whatever you do, they should be put on media that is safe to store for as long as you expect to keep the key, and you should store them more carefully than the copy of your private key you use daily.

Safely storing your private key is important, but there is a cost. Ideally, you would keep the private key on a removable, write-protected disk such as a floppy disk, and you would use it on a single-user machine not connected to a network. This may be inconvenient or impossible for you to do. For example, you may not own your own machine and must use a computer at work or school, or it may mean you have to physically disconnect your computer from your cable modem every time you want to use GnuPG.

This does not mean you cannot or should not use GnuPG. It means only that you have decided that the data you are protecting is important enough to encrypt but not so important as to take extra steps to make the first barrier stronger. It is your choice.

When, why and how would I revoke the key?

When: There are two main circumstances where you would need to revoke the key.

1. If someone else obtains the secret key AND passphrase - the key is now termed compromised. Time is important here - revoke the key (see below for the commands) immediately you discover that it has been compromised. Send the revoked key to keyservers and then generate a new key. All keys that you signed with the old key can now be signed with the new key and then updated on keyservers using --send-keys. Notify all your regular correspondents of the compromised key and include the fingerprint of both keys, signing the encrypted emails with the new key (your email software will encrypt to the recipient key and optionally save a copy of the email locally, encrypted to your own key so make sure your email software is using the new key!). Ask each user to refresh their own key so that your signatures with your new key will show up. You will have to make individual arrangements to transfer each signature from the revoked key to the new key. Depending on how the key became compromised, some signatories may not wish to sign your new key.
2. If you forget the passphrase. Generate a new key and revoke the old key. Unfortunately, without the passphrase, you cannot easily arrange for signatures on your old key to be transferred to the new key. Identify all keys that you signed with the old key and sign them again with the new key. Now send encrypted emails to each signatory on the old key explaining your amnesia and include the fingerprint of both keys. Ask each signatory to refresh their own keys and then download your new key. Sign each email with the new key. As you can no longer decrypt messages sent to the old key because of your amnesia, you will have to verify the new key with each correspondent before they can sign your new key - try and arrange a meeting and follow the usual keysigning procedures.

Why revoke keys?

1. Compromised keys need to be revoked so that your correspondents can prevent encrypted data being sent to the attacker. You need to alert each correspondent because revoked keys only show up if the key is refreshed, usually using a keyserver, and people don't refresh known keys that often. Until each correspondent has been alerted, encrypted data will continue to be sent to the wrong key and is therefore readable by the attacker who compromised the key in the first place. Don't assume that the attacker will keep such data to themselves!
2. Forgotten keys need to be revoked so that your correspondents stop sending encrypted data that you can no longer read! You can notify all regular correspondents, but this doesn't prevent new correspondents from still using the key, until it is revoked.

How do I revoke a key? Have you successfully generated a revocation certificate?

1. Yes : You need to send it to the key servers. Most keyservers don't accept a 'bare' revocation certificate, so import the certificate into gpg first:
   gpg --import my-revocation.asc
   gpg adds the certificate to the public key and you can then send the revoked key to the keyservers:
   gpg --keyserver subkeys.pgp.net --send-keys mykeyid
2. No.
   1. Compromised keys can still be revoked by generating the revocation certificate at the time of the compromise. Create a revocation certificate using:
      gpg --output my-revocation.asc --gen-revoke your_user_id.
      Now import the certificate as above.
   2. Forgotten keys are more of a problem. You will have to make every effort to notify regular correspondents of your problem and acknowledge that you didn't take the precaution of generating the revocation certificate beforehand. The key cannot be revoked without the passphrase or a revocation certificate, so you should also put an explanation on your home page to help new correspondents to use the new key.

About this document: