Below are the slides and the transcripts of my talk on PGP Install Fest in Yerevan, AM. The complete slides, based on reveal.js, are also available on github pages.

Hello, my name is Vahe. I work at Instigate CJSC and help a bit with some OWASP stuff. As you already may know today we will help you to start using PGP for encryption and digital signing. Well, this is probably is expected not to be an easy thing. The thing that we are going to study today is categorized as an extremely non user-friendly, and not because of its inconvenient UI, but all these cryptography things. Anyway, let’s roll back a bit and try to understand why we need this and how we can easily start using it without diving deep into its details.

Privacy? Who needs it? I don’t have anything to hide?

A common phrase that all are prepared to say in case you ask them don’t they worry about their privacy.

"I don’t have anything to hide…" is this a correct approach? PGP encryption may be likened to placing your letter inside an envelope, safe from prying eyes. You are not going to send anyone a mail without an envelope of corse. And if you receive one with disclosed envelope. Well, PGP is not only an envelope, but it provides a security equivalent to a metal safe.

A lot of lawyers and journalists are now using PGP to securely communicate with their clients or sources. There is also another approach why we should use this is to help our friends who already uses PGP not to easily become a suspect. When everyone uses secure communication - all are in equal state.

Only using PGP in your communication won’t help you much if you don’t know how to use it. Today we are going to give you some basic idea also in this aspect. If you are working in a field where your communication data can imprison you, you definitely need a more secure way to communicate - forget about email.

Encryption

The only way to communicate securely is to encrypt the data. So what is encryption? This is a term used in a cryptography and is the process of encoding messages or information in such a way that only authorized parties can read it [Wikipedia].

There are two types of encryption we are going to discuss today: symmetric and asymmetric encryptions. Let’s start from the easy one - symmetric encryption. In this case parties that exchange a message should have the same key which is used to encrypt it. So they somehow should meet in a private and pass the keys to each other. This makes everything very difficult, but there were cases when people almost successfully communicated based on symmetric encryption.

You all should have heard about Enigma, an encrypting machine used by Germans during World War II. The parties had printed sheets for each day of the month, where the key was written, so they were aware of the same key at the same time (we are not going into details how complicated these sheets were and what additional techniques were used in order to keep the keys private).

At some point two scientists Diffie and Hellman discovered a way that allowed to have two different keys in the encryption process. So basically this can be described in a following way. I have a a real key and a lock that can be opened only by that particular key. I duplicate the lock as many as I like and send them to my friends. They write a message, put it into the box and close the box by the lock I have sent them. Once the box is locked, only I can open it. The similar process can be implemented in the digital world and is called public encryption. Here we say we have public and private keys, where public key is an alternative of the lock I have mentioned before.

Later, three engineers discovered RSA algorithm, which is widely used in these days, and we will use it as well.

OpenPGP

OpenPGP is the open standardized specification of the PGP protocol. You will see people using PGP, GPG and OpenGPG interchangeably. These all almost refer to the same thing. The PGP is a proprietary software currently owned by Symantec, GPG - GNU Privacy Guard (play of words) free and open source implementation of OpenPGP protocol.

Now, when we at least have some idea about the basics of encryption. Let’s see what is PGP and how it is designed. It uses the combination of the above mentioned encryptions to achieve the following set of features:

Authentication

It allows to verify who is the sender. Using hashing algorithms, the sender hashes the content of the message and send the encrypted hash along with the message.

Integrity

Same hash can be used to check if the original message has been modified or not.

Encryption

You hide the message from others by encrypting it. Only the owner of the private key of the corresponding the public key can decrypt the message.

Certification

People use their private keys to sign others' public keys, thus confirming that the person owns this public key.

OpenPGP Encryption

The most important part of today’s presentation. As we know already about the two types of encryption, I should also mention that public encryption is about 1000 times slower than symmetric algorithm, so here we’ll see a trick which not only makes the whole system more secure, but also much faster.

First, we generate a random key, which we’ll call a "Session Key” (green key in the diagram). This key is generated each time we encrypt a message and it is used only once. We can use this key to encrypt the message using a symmetric algorithm. Here is the performance part: as symmetric algorithm is fast, we will get really good performance on encrypting large files.

Then we encrypt the session key by the public key of the receiver (the lock in the blue circle, presented similar to an idea that public keys are "locks”). We pack the encrypted session key with the encrypted message and send. Only one who have the private key corresponding to the public one we have used in the encryption can decrypt the message. Going back to the locks and keys example for the public encryption, we can say that only one who have the key to the blue lock can open the message.

The decryption is pretty straightforward. First the session key is decrypted using the private key, then data can be decrypted using the session key.

OpenPGP Signature

There are some algorithms in the cryptography called Hashes. These functions allow getting an almost unique short identifier for any kind of data. A significant property for these algorithms is that change of even one bit in the data will produce a completely different identifier. So this allows to check whether the message has been changed or not, i.e. integrity of the data.

So to sign the message, we first use hash function to get the unique hash of the message. Then the hash is being encrypted by the private key and sent along with the message.

Here is used another awesome property of the public encryption: when the data is encrypted by one of the keys, only another one can decrypt it. Considering that everyone knows the public key, they can decrypt the encrypted hash and running the same hash function on the message compare the received hash with their one. In case if one of them is different the data cannot be considered from the valid source.

Certification

Using the same methods, one can sign another user’s public key, thus verifying it’s identity.

How to install

As a result of this presentation Instigate Training Center recorded the following tutorial on how to install GPG tools on Windows and OSX machines.