Pretty Good Privacy Privacy Enhancing Technologies Leonardo A. Martucci CC-BY-4.0
Part 2: Secure Communications • Why do we need secure communications? • PGP We are here! • TLS and Let's Encrypt • Secure messaging
Pretty Good Privacy (PGP) • Security tool for confidentiality integrity authentication
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random (symmetric) key
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random (symmetric) key hash( )
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random Enc( ) using = (symmetric) key Sign( ) using = hash( )
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key Dec( ) using = Dec( ) using =
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key hash( ) equal?( ) Dec( ) using = Ver( ) using = Dec( ) using =
How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key ???
Public Key Distribution: Web of Trust trust Sign( ) Sign( ) is trusted by is trusted by
Public Key Distribution: Web of Trust trust Sign( ) Sign( ) is trusted by is trusted by
Public Key Distribution: Web of Trust trust trust Web of Trust
PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) with ssh-keygen • 1st: generate a key pair e.g. ssh-keygen -t rsa -b 4096 • 2nd: upload to a public repository e.g. the MIT PGP Public Key Server
PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 3rd: Build your web of trust or look into the repository for keys
PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 4th: start encrypting and signing suggestion: with the support of an your emails! email client extension e.g. Enigmail enigmail toolbar
PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 5th: receiving emails suggestion: with the support of an email client extension e.g. Enigmail
https://www.xkcd.com/1181/
The Caveats old (from the 90’s) not really usable • PGP is keys are really long no key management no forward secrecy * https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/
Part 2: Secure Communications • Why do we need secure communications? • PGP • TLS and Let's Encrypt next session • Secure messaging
Recommend
More recommend