Can anyone please give me a quick crash course on SSH and GPG?

What is the difference between public and private keys?
Should I back up my ~/.ssh/ directory, what are the security implications of doing so?

Again, difference between public and private keys.
What is an effective way to use GPG? Encrypt a text file containing information and then...what happens after that?
Is CAST5 (GPG default, I believe) secure?
If I don't use gpg -c file it starts asking for users. What is this? What do I enter here?

Are there any official security.stackexchange.com threads on learning security like this? Are there any one security in general, including not just this but maybe networking and cryptography and other things?


You should start off by reading carefully the Wikipedia article on asymmetric encryption. Public and private keys work together:

  • A third-party can encrypt data with your public key, and you will be able to use your private key to decrypt it. Nobody else will.
  • You can use your private key to encrypt data and anyone who has your public key will be able to decrypt it.
  • You can hash your data, and encrypt the hash with your private key to provide a digital signature -- a proof that the data originates from you.
  • Anybody who has your private key can impersonate you. Never back-up your private key in clear, always in an encrypted form.

In general, GPG is used to provide encryption and digital signatures to email, whilst SSH is used to remotely connect to servers. So, totally different technologies but based on the same encryption principle.

  • So, I only need one private key, right? But can have as many public keys as needed? How do I encrypt my private key before backing it up? – user50625 Jul 12 '14 at 21:09
  • @user50625, the private and public keys are linked. They go hand in hand. Asymmetric encryption relies on the principle that it's easy to do some mathematical operations in one direction but not in the other. For instance a classic school example is RSA, which relies on prime number multiplication (easy, whilst prime factorisation is very very costly). So, you create a pair of keys that are bound to each other, one public and one private. – Steve Dodier-Lazaro Jul 13 '14 at 11:16
  • @SteveDL Do you have any super-beginner-friendly guides that explain any of the following: GPG, SSH, or ecnryption? – user50625 Jul 14 '14 at 0:24
  • Not really... You should be allright reading the wikipedia pages and manual pages. Often your Linux distribution will have a nice wiki with usage tips (especially Ubuntu and Arch). It's fine not to understand everything, follow whatever leads you need when you don't understand a concept and then back to Wikipedia and manuals until it's clear. – Steve Dodier-Lazaro Jul 14 '14 at 9:40
  • GPG is a particularly hard concept for end users, to the point where it's been examined by researchers in this paper: usenix.org/legacy/events/sec99/whitten.html , which is an iconic paper in the field of usable security research. 15 years later nobody solved the problem but we're working on it ;) – Steve Dodier-Lazaro Jul 14 '14 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.