A GPG primer - Part II - Encrypting files

In part I I showed you how to configure your Solaris box to run GPG. Now, it's time to use it!

GPG lets you encrypt a file so that only the owner of the key the file was encrypted with can decrypt the message. I warn you once more: as you see, storing your key in a secure place is extremely important. If you think your key might have been compromised, revoke it and create another one.

Encrypting a file

Let's suppose you don't want anybody but you to be able to read a file. As you know, you could store your file in a safe place but safe is never good enough. There could be some use cases for which you'd better have your file encrypted. Imagine you're copying important files on a FAT32 USB drive: FAT32 filesystems has not been built with security in mind! If you encrypt the file(s) with your own key, only you will be able to decrypt them. To encrypt such files, the only command you need is (the two syntaxes are equivalent):

$ gpg --encrypt --recipient 'your-id' filename
$ gpg -er 'your-id' filename

In both cases the encrypted file would be named filename.gpg. If you prefer specifying the output file name, --output is your friend:

$ gpg --er 'your-id' --output outfile filename

The same applies if you're encrypting a file for a friend of yours: just use their key id or their recipient address.

Searching a key in a keyserver

Well, there might have times you don't have your friend's key and maybe is out there, stored in a key server. You can have GPG search the keyserver with just one command:

$ gpg --search-keys 'recipient-id' --keyserver keyserver-address

The keyserver option is optional, otherwise gpg will use its default keyserver.

Decrypting a file
Now you've stored or received a file encrypted with your key. To decrypt it is just as easy:

$ gpg --dr 'your-id' encrypted-file

You'll be asked for your password and then the file will be piped to standard output. As in the case of file encryption, you can specify an output file with the --output option.

A GPG primer - Part I - Setting up Solaris, creating and distributing a key

I think this is due. I'm a GPG user since a long time and today, still, there are people asking me what are those strange characters out there or why am I doing this.

An encryption key such as GPG's may be used to sign and encrypt communication from and to a sender, the key owner. The key owner, the only one who's got the secret key and its passphrase, can sign and decrypt a message encrypted with such key. Another person who wanted to send me encrypted information could use my public key to encrypt a message and I, and only I, could be able to decrypt the message. That's just the basics and, if you're interested, you could read the GPG User Guide to dig into this subject.

There also exist software which can ease you life with these keys:

• Some desktop systems come with an integrated key manager that lets you create, sign, encrypt and decrypt files and mail with a bunch of clicks.
• Some mail client come with similar functionality built-in or via some plugins, such as Evolution or the Enigmail plugin for Thunderbird.

They're so many I'm not even trying to enumerate them. I just focus on man's best friend: good ole command line.

Setting up Solaris

Depending on the Solaris version you're running, maybe you'll need some extra step to set up GPG:

• Solaris up to version 10: GPG isn't bundled with the OS nor is available in the Companion Software. To install GPG, follow Blastwave's instructions to set up your system and, optionally, follow my instructions to set up a special Blastwave zone. During the recommended Blastwave configuration you'll install GPG (CSWgnupg), too.
• Solaris Express Community Edition and OpenSolaris-based distros: GPG is (should be) bundled with the OS.

Creating your key

As we said, the first thing you need is a key. You can make one with gpg:

$ gpg --gen-key

and after answering a bunch of questions you'll get your shiny little key

Distribute your key

Unless you're going to encrypt files for yourself, the next thing you've got to do to use your key at full power is distributing it (only the public part of it) to whoever may be interested in:

• Reading something you signed.
• Sending you encrypted information.

There are plenty of ways to distribute it but the most effective will be publishing it into a public keyserver:

$ gpg --send-keys key-id --keyserver hkp://subkeys.pgp.net/

Please note the following:

• Instead of your key-id you could use your name, which was provided to GPG during the key creation phase. If you prefer to know and learn your key-id, you can ask gpg with the --list-keys option.
• There are many keyserver out there, use the one you like most!

Now, you're ready to tell the world and begin to use your key.

TrueCrypt Tutorial: Truly Portable Data Encryption

TrueCrypt is one of the many disk encryption tools available in Linux and other Unices. Some of the features of truecrypt are as follows (and I quote):

• Creates a virtual encrypted disk within a file and mounts it as a real disk.
• Encrypts an entire hard disk partition or a storage device such as USB flash drive.
• Encryption is automatic, real-time (on-the-fly) and transparent.
• Provides two levels of plausible deniability, in case an adversary forces you to reveal the password:
  
  1. Hidden volume (steganography).
  2. No TrueCrypt volume can be identified (volumes cannot be distinguished from random data).
• Encryption algorithms: AES-256, Serpent, and Twofish. Mode of operation: LRW.
  

Lipiec at Polishlinux.org has written a very good tutorial which explains how to setup and use truecrypt in Linux. He explains right from the start which is - download the code, compile, and install it to creating encryption volumes. Just so you know, truecrypt has been made available in deb and rpm formats as well. So if you are using one of the major Linux distributions such as Debian, Ubuntu or Fedora, you can skip the compilation from source step.

Truecrypt is available for Linux and Windows but the developers have provided a easy to use GUI only for Windows platform. Linux users are still made to depend on the command line to setup and manage encrypted volumes using truecrypt.

Email encryption tools for Gmail galore

One of the most useful email encryption programs you can use is PGP (Pretty Good Privacy) or if you are like myself, a Free software supporter then you can use its GPLed counterpart called GnuPG (GPG). But with web mail gaining popularity, most people will find the use of these programs to encrypt or even sign their outgoing emails a chore.

Here is where browser plugins come into the picture. Dimitri Popov at linux.com has written a very useful article where he explains how to use the email encryption Firefox plugin called FireGPG to encrypt all your mails in your Gmail account. While KDE users will be aware of and have used KGPG - the front end tool for GnuPG, FireGPG is different in that, as a plugin, it is well integrated with your Firefox web browser and so you need not go outside your Gmail web interface to encrypt, decrypt or sign your mail. It can be done on the fly.

While on this topic of email encryption, I also came across a couple of projects which allow encryption of messages - not preferably emails. They are as follows :

Pidgin-Encryption - It transparently encrypts your instant messages with RSA encryption. It is Easy-to-use, but very secure. Pidgin (aka Gaim) is an instant messenger client for Linux which is used to connect to Yahoo messenger, Microsoft Messenger, AOL talk and many other instant messaging protocols.

OTR - Short for Off The Record messaging allows you to have private messaging using instant messaging and provides the following features - encryption of messages, authentication and deniability. It is also a pidgin plugin.

Gmail S/MIME is another project which provides Firefox users with S/MIME support for Gmail. S/MIME stands for Secure Multi purpose Internet Mail Extensions. S/MIME support is integrated directly into Google's Gmail web interface. It supports reading and sending of encrypted mail.

Lastly, check out this online javascript solution which encrypts and de-crypts your messages using a uniquely generated RSA private key. This project has been developed by the students of Stanford University.