GNU Privacy Guard

Last Revision: Fri 06 Apr 2007 11:59:59 PM EDT By: Jeff Zagorac

GPG (or GNUPG) stands for GNU Privacy Guard. GPG is a application used for encryption of text, mainly e-mail or other communications, but it also can be extend to encrypt plaintext files. It is available freeware under the GNU General Public License license for personal use. Like its name suggests, GPG is a solution for protecting one's privacy. It facilitates this through e-mail encryption. On the Internet of today, there are malicious users out there that would seek to obtain information through methods such as cracking, Phishing , social engineering, sniffing or wire-tapping, and many other malicious means. To combat this threat, there are many security protocols and tools in place that work transparently however this is sometimes not enough to satisfy users demanding the highest level of security. GPG is a feasible technique that users demanding this level of security can use for added peace of mind.

Contents

History

GPG was developed from PGP, which uses the OpenPGP (RFC 2440) standard for public key encryption. OpenPGP was developed from PGP, or Pretty Good Privacy, which was developed by Phil Zimmerman. The application was developed to provide security-minded individuals a method for ensuring privacy among transmitted communications.

GPG is currently supporting two versions, 1.4.7, and 2.0.3, the latter of which is called "the enhanced and somewhat harder to build version." [1]

How it Works

GPG is used for increasing the level of privacy of communications between individuals and it does this by relying on hybrid public-key encryption (Symmetric for quick applications, and asymmetric for maximum security) implemented by OpenPGP. This standard specifies the two main uses of the implementing software: encryption and digital signing.

Encryption

With encryption, the user encrypts the message ensuring that the only person that is capable of reading the message is someone within that users web of trust. When using message encryption, a user will encrypt a message with the recipients public key. When the recipient retrieves the message, they can decrypt it using their private key. This ensures privacy and defends from the following potential attacks:

It is important to note that once the message has been decrypted, if the plaintext is saved, the security has dropped dramatically, therefore it is important to destroy plaintext copies of the message if they are not secured.

The OpenPGP standard outlines six steps in the encryption process: [3]

  1. A user composes a message,
  2. The user uses the software to create a random number which will represent the session key for the message,
  3. The session key is encrypted using the recipients public key,
  4. The user then encrypts the message using the session key, simultaneously compressing the message,
  5. The recipient decrypts the session key using their private key,
  6. The recipient decrypts the message key using the session key.

Message Signing

Message signing is a method of ensuring that a message comes from the user that is implied in the message header, or ensuring the integrity of the message. This is accomplished by creating a digital-signature from the senders private key which only they ought to know. During the signing process, the message body is also encoded, which ensures that the message is not changed along the way. Digital signing guards against the following potential threats:

The OpenPGP standard outlines six steps in the digital-signing process: [3]

  1. A user composes a message,
  2. The user uses the software to create a hash-code based on the message,
  3. The user uses their private key to generate an encrypted signature based on the hash-code,
  4. The user then attaches the signature to the message and sends it to the recipient,
  5. The recipient retrieves the message and using the software, creates a hash-code based on the message,
  6. The software decrypts the signature using the public key and verifies that the hash-codes match, implying authentication.

With signed messages, it is important to note that one must be certain that the user they are talking to is in fact who they say they are. Let us say that Bob is sending a message to Jeff and that prior, Bob has given Alan his public key. From this point, every message that Alan receives checks out to be from Bob, as the public key matches the digital signature of the message. However, if when the public key was exchanged, Bob was not Bob at all, and was in fact Jeff, and Jeff had simply given Alan his own public key, Alan would be concluding incorrectly that the messages received were from Bob. As the initial exchange of keys cannot be signed, it is important that the users ensure the key is from the true individual. To circumvent this problem, keys are often available through services such as Internet key servers.

Algorithms

GPG uses the following non-patented algorithms for encryption:

Web of Trust

The web of trust refers to individuals that are trusted because they are trustworthy individuals and also because they are using GPG software as well. These users share public keys, ensuring that the encrypted messages are decrypt-able, or that signed messages are verifiable. It is up to the user to ensure that the web of trust is legitimate, and that there are no corrupt public key-to-identity mappings.

Usage

GPG carries out its processes through the use of a command-line tool, which can be extended to be used in other applications or graphical tools.

See the official user manual for instructions to get started.

Application Support

GPG encryption is integrated into the following mail clients:

The following front-ends exists to function as graphical user interfaces with GPG:

Problems

GPG and OpenPGP are effective tools for ensuring privacy, however there are reasons why it is not commonplace to see users encrypting or signing messages. As GPG is only a command line tool, most users do not use a command line or are intimidated by it, and therefore they are put off by using GPG. As well, there is some learning involved with GPG. Many users are also put of by the notion of having to learn a new software package. Finally, it is also much more time consuming to not only encrypt and decrypt messages, but to circulate public keys and maintain a web of trust. For this reason, it may not be worth the overhead to increase security beyond the existing transparent methods. Finally, most users feel safe enough with the existing transparent methods.
[2] Because of this, it is up to the end-user's subjective judgement if GPG is suitable for them. See the GPG project page for any updates relating to security issues.

See Also

  1. Random Number Generation for Encryption
  2. Public Key Cryptography
  3. AES Encryption
  4. RSA Algorithm
  5. Computer Surveillance
  6. Phishing
  7. Computer Hijacking
  8. Social Engineering

External Links

  1. OpenPGP Standard (RFC 2440)
  2. Pretty Good Privacy
  3. Public Key Infrastructure (PKI)
  4. Key Server
  5. Mac GPG Project
  6. Seahorse
  7. KPGP
  8. gpg4win
  9. Enigmail

References

  1. GnuPG.org
  2. Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. - Alma Whitten and J. D. Tygar. In Security and Usability: Designing Secure Systems that People Can Use, eds. L. Cranor and G. Simson. O'Reilly, 2005, pp. 679-702
  3. RFC 2440