pretty good privacy
play

Pretty Good Privacy Privacy Enhancing Technologies Leonardo A. - PowerPoint PPT Presentation

Pretty Good Privacy Privacy Enhancing Technologies Leonardo A. Martucci CC-BY-4.0 Part 2: Secure Communications Why do we need secure communications? PGP We are here! TLS and Let's Encrypt Secure messaging Pretty Good Privacy


  1. Pretty Good Privacy Privacy Enhancing Technologies Leonardo A. Martucci CC-BY-4.0

  2. Part 2: Secure Communications • Why do we need secure communications? • PGP We are here! • TLS and Let's Encrypt • Secure messaging

  3. Pretty Good Privacy (PGP) • Security tool for confidentiality integrity authentication

  4. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key

  5. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random (symmetric) key

  6. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random (symmetric) key hash( )

  7. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random Enc( ) using = (symmetric) key Sign( ) using = hash( )

  8. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key

  9. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key Dec( ) using = Dec( ) using =

  10. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key hash( ) equal?( ) Dec( ) using = Ver( ) using = Dec( ) using =

  11. How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key ???

  12. Public Key Distribution: Web of Trust trust Sign( ) Sign( ) is trusted by is trusted by

  13. Public Key Distribution: Web of Trust trust Sign( ) Sign( ) is trusted by is trusted by

  14. Public Key Distribution: Web of Trust trust trust Web of Trust

  15. PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) with ssh-keygen • 1st: generate a key pair e.g. ssh-keygen -t rsa -b 4096 • 2nd: upload to a public repository e.g. the MIT PGP Public Key Server

  16. PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 3rd: Build your web of trust or look into the repository for keys

  17. PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 4th: start encrypting and signing suggestion: with the support of an your emails! email client extension e.g. Enigmail enigmail toolbar

  18. PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 5th: receiving emails suggestion: with the support of an email client extension e.g. Enigmail

  19. https://www.xkcd.com/1181/

  20. The Caveats old (from the 90’s) not really usable • PGP is keys are really long no key management no forward secrecy * https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/

  21. Part 2: Secure Communications • Why do we need secure communications? • PGP • TLS and Let's Encrypt next session • Secure messaging

Recommend


More recommend