1

Forgive me the newbie questions.

I'm going through the Gpg documentation and other related websites. Unfortunately they assume I am already familiar with some terms and allthough I am re-searching them it is gets hard to apply what I have learned or even abstract to understand what is going on.

The questions here is: under GPG subject what is the difference between a key and certificate (It sounds like it is the same). Also, what is the goal of signing a encrypted file?

What is the flow of using gpg to securely transfer a file?

Assuming that my boss wants me to send a .doc to him securely using gpg:

  • Does he have to install gpg on his end and send me his key(or certificate if they meaning are the same)?
  • With this information should I encrypt and sign it (why?) with his certificate that I am assuming is the same as public key (because I am encrypting)?
  • Once I encrypt and sent it to him, how does he decrypt it? how can he see his private key on gpg?

as you can see, I am all over the place

please help

thanks

  • I think you're starting a little to deep, look into some more basic concepts first, like asymmetric encryption. This website, though, gives a good explanation of the process. Quick and dirty: Public key is used to encrypt, Private key used to decrypt. The certificate advertises your Public key (among other things) and a signed Certificate authenticates that you are who you say you are. My apologies if I am assuming incorrectly that you're not familiar with these concepts. – INV3NT3D Aug 9 '16 at 17:42
7

In public key cryptography, the key is usually a key pair, consisting of a public key and a private key, and it is what you do encryption, decryption, signing, and verification with.

"A key certificate is an assertion that a certain key belongs to a certain entity" PGP lecture.

To illustrate what each key does, and to see an example of why one would both encrypt and sign, consider Snowden (S) and Greenwald (G):

  • Each of them creates their own key pair, and they publish their respective public keys.

  • Assume (for now) that the public keys are trustworthy.

  • Say S wants to send a message to G. To do that:

    • S looks for G's public key.
    • S encrypts the message using G's public key.
    • S signs the encrypted message with his own private key.
  • G receives an encrypted signed message. The untrusted email header says it is from S.

    • G looks for S's public key.
    • G verifies the signature using S's public key. Now, G is convinced message is from S.
    • G decrypts message using his own private key.

Note that signature and encryption are performed using different keys (by S). Without the signature, G would still be able to decrypt it, but he would not be convinced the message is really from S.

The whole scheme relies on the assumption that public keys are trustworthy. Otherwise, for instance, the spook K might publish a key with G's name and intercept G's email, so that when S sends the message, K decrypts it instead of G. This is where key certificates come into play.

However-however-however! This whole public key cryptography is only useful to implement secure communication between a trusted and an untrusted party. E.g., from G's pov, he does not trust S at the time when S wants to send him a message. Then: public key crypto enables G to receive encrypted messages meant only for him from an untrusted sender S.

If there are no untrusted parties in your scheme, there is no need for all this stuff. Instead, you and your boss should agree on a strong key/passphrase. Then, you could encrypt the message with traditional symmetric encryption using that shared key with gpg --symmetric --armor, and he could decrypt it with gpg --decrypt. This is how the command lines would look like. GUI and integration of GPG in email clients would be another topic.

  • amazing explanation – RollRoll Aug 9 '16 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.