I'd like to know how to implement forward secrecy using GnuPG, and I presume I need some kind of authenticated key exchange. Assuming that I have the following working already:
- Alice and Bob have both generated their own regular asymmetric keypairs
- Alice has Bob's public key, and Bob has Alice's public key
- Alice and Bob have verified that they have the correct keys and therefore trust each other
- Alice can send messages asymmetrically encrypted with Bob's public key, and Bob can decrypt them, read them and verify signatures (and vice versa)
The problem I'd like to solve is that if somebody had managed to intercept and store an encrypted message from last week, and subsequently managed to obtain the corresponding private key from either Alice or Bob, then they could decrypt and read the old message. It's my hope that with a temporary session key (negotiated but not sent) this would no longer be possible, as the message from last week would be symmetrically encrypted with a random session key, and this session key was never sent in any message.
I believe that what this needs is an Authenticated Key Exchange (AKE) like Diffie-Hellman, so can my program do this using GnuPG as a library?
- Generation of suitable random token
- Combination of this token with private key
- (program is then responsible for storage of temporary data in memory, and transmission of encrypted, signed message)
- Combination of received (token+key) from other party with own private key to give temporary session key
- Use of this agreed
kas a symmetric session key
Ideally this session key would not need to be added to any keyring, and creating it would be significantly faster than generating an asymmetric keypair.
According to the FAQ at https://gnupg.org/faq/gnupg-faq.html#compatible :
“Diffie-Hellman” is what PGP calls the Elgamal encryption algorithm. If your PGP-generated keypair uses a Diffie-Hellman encryption subkey, it will appear in GnuPG as an Elgamal subkey.
but according to the manual at https://gnupg.org/gph/en/manual.html#AEN26 the key generation for ElGamal produces a keypair:
Option 4 creates a single ElGamal keypair usable for both making signatures and performing encryption.
This makes it sound like an asymmetric keypair which is not what I want, and it also sounds like it would be added to the keyring, which sounds undesirable and inefficient. So I'm a little confused about what GnuPG means by "ElGamal", and I don't see how a key exchange protocol can be considered equivalent to an encryption algorithm.
Thanks to forest's answer below, I understand that this isn't possible, even though it seems that GnuPG is more than capable of doing the mathematics required. I left it open for a little longer just in case somebody else knew a way.
I will have to look further into OTR, which is obviously a separate question.
I also realized after asking this question that maybe I should have put it in crypto.stackexchange - my apologies if putting it there would have been more appropriate. Thanks for the comments!