PGP & GPG: Email for the Practical Paranoid

216 Pages·2006·3.367 MB·English

by  Michael W Lucas

HHSSOEOECWCWUU RTRTOEOEL L CYCYO O IIMMNN M MaAUUnNNNIICCAATTEE “ … T H EU NW LOESRSL DY'OS U F'IRRES TA UCSR EYRP-TFORIGERN ADPLHYE BRO, OO KR ONNE VEEMR A UILS EP REMIV AA —ICLY,L …EYNO US ASSHSOAUMLADN R, ECAODD ETCHOISN BFOOOUKN.D”ER
iInNsSeEcCuUrReE wWoOrRlLdD
PPGGPP &&
PP
“Today, most email is sent like a postcard. Anybody Inside PGP & GPG, you’ll learn:
on the path can read it, ranging from oppressive govern- • How to integrate OpenPGP with the most common GG GGPPGG
ments to teenagers able to break into networks with far
email clients (like Outlook and Thunderbird)
too many security holes. We all should want to put our
mail back into secure envelopes again. PGP and GPG • How to use the tricky command-line versions of PP
are two of the leading tools to make that happen.” these programs
— Brad Templeton, Chairman of the Board,
• How to join and use the Web of Trust
Electronic Frontier Foundation
&&
• What to do at a keysigning party (besides drink)
Governments around the world, major industrial manu-
facturers, medical facilities, and the best computer PGP & GPG allows anyone to protect his or her E M A I L F O R T H E P R A C T I C A L P A R A N O I D
security practitioners trust their secure communications personal data with free tools. If you’re not using PGP
to PGP (Pretty Good Privacy). But, while PGP works yet, this book will get you started without making you GG
amazingly when all is in order, it isn’t always easy feel like a deer in headlights. If you’re already using
to configure, and problems can be very tricky to PGP, it will show you how to use these tools more
troubleshoot. And email security is hardly the sort of easily and effectively to protect your communication. PP
thing you want to leave to trial and error.
About the author
PGP & GPG: Email for the Practical Paranoid is for GG
moderately skilled geeks who may be unfamiliar with Michael W. Lucas is a network and security engineer
public-key cryptography but would like to protect their with extensive experience working with high-availability
communications on the cheap. Author Michael Lucas systems, as well as intra-office and nationwide networks.
offers an easy-to-read, informal tutorial for communicat- He is the author of the critically acclaimed Absolute BSD,
ing securely with PGP, so you can dive in right away. Absolute OpenBSD, and Cisco Routers for the Desperate
(all No Starch Press).
L
U
C
A
$24.95 ($32.95 CDN) S
wTHwE wF.InNoEsStTa rIcNh G.cEoEmK ENTERTAINMENT™ ISBN: 1-59327-071-2 52495 SHELVE IN:MPUTERS/SECURITY Michael W. Lucas
O
C
“I lay flat.”
9 781593 270711 6 89145 70712 0
This book uses RepKover—a durable binding that won’t snap shut.

PGP & GPG
Email for the Practical
Paranoid
by Michael W. Lucas
San Francisco
PGP & GPG. Copyright © 2006 by Michael W. Lucas.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by
any means, electronic or mechanical, including photocopying, recording, or by any informa-
tion storage or retrieval system, without the prior written permission of the copyright owner
and the publisher.
Printed on recycled paper in the United States of America
1 2 3 4 5 6 7 8 9 10 – 09 08 07 06
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc.
Other product and company names mentioned herein may be the trademarks of their respec-
tive owners. Rather than use a trademark symbol with every occurrence of a trademarked name,
we are using the names only in an editorial fashion and to the benefit of the trademark owner,
with no intention of infringement of the trademark.
Publisher: William Pollock
Managing Editor: Elizabeth Campbell
Associate Production Editor: Christina Samuell
Cover and Interior Design: Octopod Studios
Developmental Editor: William Pollock
Technical Reviewers: Henry Hertz Hobbit, J. Wren Hunt, Thomas Jones, Srijith Krishnan Nair,
Len Sassaman, David Shaw, and Thomas Sjorgeren
Copyeditor: Nancy Sixsmith
Compositor: Riley Hoffman
Proofreader: Nancy Riddiough
Indexer: Nancy Guenther
For information on book distributors or translations, please contact No Starch Press, Inc.
directly:
No Starch Press, Inc.
555 De Haro Street, Suite 250, San Francisco, CA 94107
phone: [phone]; fax: [phone]; [email protected]; www.nostarch.com
The information in this book is distributed on an “As Is” basis, without warranty. While every
precaution has been taken in the preparation of this work, neither the author nor No Starch
Press, Inc. shall have any liability to any person or entity with respect to any loss or damage
caused or alleged to be caused directly or indirectly by the information contained in it.
Library of Congress Cataloging-in-Publication Data
Lucas, Michael, 1967-
PGP & GPG : email for the practical paranoid / Michael W. Lucas.-- 1st ed.
p. cm.
Includes index.
ISBN 1-59327-071-2
1. Electronic mail systems--Security measures. 2. PGP (Computer file) I. Title:
PGP and GPG. II. Title: Pretty good privacy & GnuPG. III. Title: Pretty good pri-
vacy & GNU Privacy Guard. IV. Title: Email for the practical paranoid. V. Title.
TK5102.85.L83 2006
004.692--dc22
2005028824
Liz:
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.0 (FreeBSD)
hQIOA9o0ykGmcZmnEAf9Ed8ari4zo+6MZPLRMQ022AqbeNxuNsPKwvAeNGlDfDu7
iKYvFh3TtmBfeTK0RrvtU+nsaOlbOi4PrLLHLYSBZMPau0BIKKGPcG9162mqun4T
6R/qgwN7rzO6hqLqS+2knwA/U7KbjRJdwSMlyhU+wrmQI7RZFGutL7SOD2vQToUy
sT3fuZX+qnhTdz3zA9DktIyjoz7q9N/MlicJa1SVhn42LR+DL2A7ruJXnNN2hi7g
XbTFx9GaNMaDP1kbiXhm+rVByMHf4LTmteS4bavhGCbvY/dc4QKssinbgTvxzTlt
7CsdclLwvG8N+kOZXl/EHRXEC8B7R5l0p4x9mCI7zgf/Y3yPI85ZLCq79sN4/BCZ
+Ycuz8YX14iLQD/hV2lGLwdkNzc3vQIvuBkwv6yq1zeKTVdgF/Yak6JqBnfVmH9q
8glbNZh3cpbuWk1xI4F/WDNqo8x0n0hsfiHtToICa2UvskqJWxDFhwTbb0UDiPbJ
PJ2fgeOWFodASLVLolraaC6H2eR+k0lrbhYAIPsxMhGbYa13xZ0QVTOZ/KbVHBsP
h27GXlq6SMwV6I4P69zVcFGueWQ7/dTfI3P+GvGm5zduivlmA8cM3Scbb/zW3ZIO
4eSdyxL9NaE03iBR0Fv9K8sKDttYDoZTsy6GQreFZPlcjfACn72s1Q6/QJmg8x1J
SdJRAaPtzpBPCE85pK1a3qTgGuqAfDOHSYY2SgOEO7Er3w0XxGgWqtpZSDLEHDY+
9MMJ0UEAhaOjqrBLiyP0cKmbqZHxJz1JbE1AcHw6A8F05cwW
=zr4l
-----END PGP MESSAGE-----

BRIEF CONTENTS
Acknowledgments ..........................................................................................xv
Introduction .....................................................................................................1
Chapter 1: Cryptography Kindergarten ............................................................13
Chapter 2: Understanding OpenPGP ...............................................................27
Chapter 3: Installing PGP ................................................................................39
Chapter 4: Installing GnuPG ...........................................................................53
Chapter 5: The Web of Trust ...........................................................................81
Chapter 6: PGP Key Management ...................................................................91
Chapter 7: Managing GnuPG Keys ..................................................................99
Chapter 8: OpenPGP and Email ....................................................................115
Chapter 9: PGP and Email ............................................................................125
Chapter 10: GnuPG and Email ......................................................................137
Chapter 11: Other OpenPGP Considerations ..................................................155
Appendix A: Introduction to PGP Command Line .............................................167
Appendix B: GnuPG Command Line Summary ................................................177
Index ..........................................................................................................183

CONTENTS IN DETAIL
ACKNOWLEDGMENTS xv
INTRODUCTION 1
The Story of PGP .............................................................................................2
OpenPGP ...............................................................................................4
How Secure Is OpenPGP? ........................................................................5
Today’s PGP Corporation ..................................................................................6
What Is GnuPG? .....................................................................................7
PGP Versus GnuPG ..........................................................................................7
Ease of Use ............................................................................................7
Support ..................................................................................................8
Transparency ..........................................................................................9
Algorithm Support ...................................................................................9
OpenPGP and the Law ...................................................................................10
What This Book Contains ................................................................................10
Stop Wasting My Precious Time. What Do I Need to Read? ...............................11
1
CRYPTOGRAPHY KINDERGARTEN 13
What OpenPGP Can Do ................................................................................13
Terminology ..................................................................................................14
Plaintext and Ciphertext .........................................................................15
Codes ..................................................................................................15
Ciphers ................................................................................................16
Hashes .................................................................................................16
Cryptanalysis ........................................................................................17
Goals of PGP’s Cryptography .........................................................................17
Confidentiality ......................................................................................17
Integrity ...............................................................................................17
Nonrepudiation ....................................................................................18
Authenticity ..........................................................................................18
Encryption Algorithms ....................................................................................19
Symmetric Algorithms ............................................................................20
Asymmetric Algorithms ...........................................................................21
Public-Key Encryption .....................................................................................22
Digital Signatures ...........................................................................................22
Combining Signatures and Asymmetric Cryptography ........................................23
Passphrases and Private Keys ..........................................................................24
Choosing a Passphrase ..........................................................................25
2
UNDERSTANDING OPENPGP 27
Security and OpenPGP ..................................................................................28
Web of Trust ..................................................................................................29
Trust in OpenPGP ...........................................................................................30
Where to Install ............................................................................................31
Your Keypair .................................................................................................32
Key Length ............................................................................................32
Key Expiration Date ...............................................................................33
Name, Email, and Comment ...................................................................34
Revocation Certificates ...................................................................................35
Storing Your Keypair ......................................................................................35
Storing Your Revocation Certificate ..........................................................36
Photo IDs and OpenPGP Keys .........................................................................36
Key Distribution .............................................................................................36
Keyservers ............................................................................................37
3
INSTALLING PGP 39
Downloading PGP .........................................................................................40
Installing PGP ................................................................................................40
Key Type ..............................................................................................42
Key Size ...............................................................................................42
Expiration .............................................................................................42
Ciphers ................................................................................................42
Hashes .................................................................................................43
PGP Key Backups ...........................................................................................45
Important Installation Locations ...............................................................46
Revocation Certificates and PGP ......................................................................46
Disabling Keyserver Updates ..................................................................47
Revoke the Key ......................................................................................48
Re-import Your Private Key ......................................................................49
Key Properties .......................................................................................50
Using the Revocation Certificate ..............................................................51
Keyservers and PGP .......................................................................................51
4
INSTALLING GNUPG 53
Downloading GnuPG .....................................................................................54
Checking Checksums ......................................................................................54
Calculating Checksums Under Windows ..................................................55
Calculating Checksums Under Unix .........................................................55
GnuPG Home Directory ..................................................................................56
gpg.conf ..............................................................................................57
x Contents in Detail