2

Can anyone please give me a quick crash course on SSH and GPG?

SSH:
What is the difference between public and private keys?
Should I back up my ~/.ssh/ directory, what are the security implications of doing so?


GPG:
Again, difference between public and private keys.
What is an effective way to use GPG? Encrypt a text file containing information and then...what happens after that?
Is CAST5 (GPG default, I believe) secure?
If I don't use gpg -c file it starts asking for users. What is this? What do I enter here?


Are there any official security.stackexchange.com threads on learning security like this? Are there any one security in general, including not just this but maybe networking and cryptography and other things?

1 Answer 1

6

You should start off by reading carefully the Wikipedia article on asymmetric encryption. Public and private keys work together:

  • A third-party can encrypt data with your public key, and you will be able to use your private key to decrypt it. Nobody else will.
  • You can use your private key to encrypt data and anyone who has your public key will be able to decrypt it.
  • You can hash your data, and encrypt the hash with your private key to provide a digital signature -- a proof that the data originates from you.
  • Anybody who has your private key can impersonate you. Never back-up your private key in clear, always in an encrypted form.

In general, GPG is used to provide encryption and digital signatures to email, whilst SSH is used to remotely connect to servers. So, totally different technologies but based on the same encryption principle.

6
  • So, I only need one private key, right? But can have as many public keys as needed? How do I encrypt my private key before backing it up?
    – user50625
    Commented Jul 12, 2014 at 21:09
  • @user50625, the private and public keys are linked. They go hand in hand. Asymmetric encryption relies on the principle that it's easy to do some mathematical operations in one direction but not in the other. For instance a classic school example is RSA, which relies on prime number multiplication (easy, whilst prime factorisation is very very costly). So, you create a pair of keys that are bound to each other, one public and one private. Commented Jul 13, 2014 at 11:16
  • @SteveDL Do you have any super-beginner-friendly guides that explain any of the following: GPG, SSH, or ecnryption?
    – user50625
    Commented Jul 14, 2014 at 0:24
  • Not really... You should be allright reading the wikipedia pages and manual pages. Often your Linux distribution will have a nice wiki with usage tips (especially Ubuntu and Arch). It's fine not to understand everything, follow whatever leads you need when you don't understand a concept and then back to Wikipedia and manuals until it's clear. Commented Jul 14, 2014 at 9:40
  • GPG is a particularly hard concept for end users, to the point where it's been examined by researchers in this paper: usenix.org/legacy/events/sec99/whitten.html , which is an iconic paper in the field of usable security research. 15 years later nobody solved the problem but we're working on it ;) Commented Jul 14, 2014 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .