If you need practice

Gpg4win help-en
1

I am happy to provide limited help for these starting out with openPGP and wanting some emailing practice. For my own practice I have two emails clients setup with two different email addresses so I can email myself.

Thunderbird can be tested with sw@GET-RID-OF-CAPSdrteeth.co.uk and Outlook 2010 with dr-simmons@GET-RID-OF-CAPSdrteeth.co.uk. You should be able to find my public keys on the key servers. You may find two to the second email addy, one has expired.

Pls encrypt all emails and send or point me to your public key.

2

Thanks dr teeth

I would like to take you up on your offer but I feel that I need to stumble about some more before I have the confidence to actually undertake an exchange of encrypted emails.

I stepped off into the deep end too soon and wound up sending my private key to “Adele”. I then had to figure out how to create a revocation certificate. It seems the only way, currently, to do that is through the command line interface which I haven’t used in quite a few years.

Nevertheless, after a good deal of research, I was able to actually do that successfully. So now I need to create a new certificate and key pair. One thing I found out when I created my revocation certificate is that my keys (public and private) were stored on a folder that I didn’t know about (users\appdata). That seems to be a security flaw in that anyone with access to my computer would have access to my keys. What would be the point in following the advice of always storing keys on a USB drive instead of the computer if they are on the computer anyway?

Those are the kinds of things I need to learn more about.

Thanks for your offer to help, as I move forward with my understanding I may call on you.

Sincerely, wmhanks

3

I seem to truly be lost in the woods. I am using gmail without any plugins. So I’m assuming I need to write the message in notepad, encrypt it. Then paste it into the email message along with my public key as an attachment. I just tried that with Adele. I got a response. So I copied that into notepade, saved it, and after selecting the file, chose decrypt in the right click menu. But the decryption failed. I do have Adele’s public key and it’s on my Gnu Privacy Assistant keychain as well as on Kleopatra. I don’t know and can’t imagine what else I can do.

Is there any way to get a simple step-by-step procedure for using gmail without plugins? It actually worked with my old certificate (the one that was compromised and I revoked) but it’s not working with this one. I’m beginning to see why someone would pay for Zimmerman’s current PGP implementation.

Does one really have to be a command line coder to use Gpg4Win?

Thanks. Mike

4

GPA has an easy-to-use GUI that lets you access your files and clipboard.

Kleopatra has the same features available, but you access them from the Windows taskbar.

No need to rely on the command-line for those encryption and decryption tasks.

5

I found the clipboard decrypt option in GPA. But I seem to be confused. I created my first certificate and exported it to the server. But that one which was compromised. I was able to use the email robot “Adele” with that one. But I set an expire date and created a revocation so now when I try to use the robot it doesn’t work. I tried attaching my new public key but when I try to decrypt the messages from “Adele” it says it’s not a valid PGP file or “decryption failed”. Is Adele still using the old certificate? I attached the new one to the new message. When you write someone an encrypted email do you attach the public key file or the one with both key pairs? I am trying to use this for secure journalistic purposes so I really need to figure it out. I used Adele to try to spare anyone any trouble trying to help me with it. But that doesn’t seem to be working now.

6

When you write someone an encrypted email do you attach the public key file or the one with both key pairs?

NEVER send your private key. Only send your public key if they can’t get it off of a keyserver.

If you simply sign a message someone with knowledge of PGP can lookup and obtain your public key from a keyserver.

7

Hi William,

I was watching these posts by e-mail with mild interest until I noticed the phrase “I am trying to use this for secure journalistic purposes…”, when alarm bells began to ring. I can appreciate that it is essential that you figure this out, and are able to help your correspondents do so as well, and that you are sure you’ve got it right.

So first, as “Nippon Bill” points out, the security of your e-mail depends absolutely on keeping your secret,or private, key exactly that - secret and private. Only your public key is to be sent out across the Web, uploaded to a keyserver, or otherwise distributed to your correspondents. When you eventually establish the key-pair that you will actually be using seriously, as opposed to the one you are experimenting with now, you need to back it up securely somewhere, i.e. on a disk/flash drive in a safe. Otherwise if your PC expires or crashes, you may finish up with an archive of e-mails that you can’t read any more. And if your computer is compromised, your keypair may be stolen from it, so the backup file should be securely erased from your computer once you have it safely stored elsewhere. (Ideally you should have two backups in separate places. Yes, OK, so I’m paranoid. If you’re a journalist, so should you be.)

To learn how to communicate securely, using secure e-mail, I used the combination of the Mozilla Thunderbird e-mail client and its add-on, Enigmail (with GPG4win installed beforehand, which I guess you’ve already done). I thoroughly recommend that you do the same. There is an excellent manual on Enigmail, written by one Daniele Raffo of the Enigmail team, which takes you through the whole process, including a short section on Adele the robot. It’s so good that I actually sent Daniele an (encrypted) e-mail congratulating him on it, and received a very modest (encrypted) reply. You can find it here: https://www.enigmail.net/documentation/handbook.php. I downloaded the PDF and put it on my tablet, and continually refer to it, as well as the GPG4win compendium PDF. If I were you I would read the two in conjunction.

For Gmail webmail, you can use Mailvelope, which also uses OpenPGP encryption, so your keys also work with it, although you may have to import them separately into Mailvelope’s keyring - not sure, I’ve only just started using it, but overall it is simple enough. See website here: http://www.mailvelope.com/. For the Chrome browser you can install the Mailvelope extension from the Chrome Webstore, but for Firefox you need to download the latest extension beta from the Github project website - don’t worry, it works fine.

After you have gone through Raffo’s manual and tried Enigmail, come back and ask if you have any further problems. There are one or two fine tweaks that you might want to know about, but they only become relevant later.

If you decide that you just want to send encrypted text via Gmail without using the more secure methods of fully-encrypted e-mail, there is a way of doing that, via Chrome, here:
http://refugeeks.com/secure-streak-a-chrome-extension-to-encrypt-your-gmail-emails/.
I made a comment on the site about the security of the encryption (which looks good - the encryption, not the comment).

For general encryption of sensitive documents on your computer, I recommend Truecrypt, here:
http://www.truecrypt.org/

And recommended reading on computer security is anything by Bruce (Trust the Math) Schneier. (https://www.schneier.com/)

8

Mr. Ward,

Your message is more enlightening than anything I have yet seen in my quest to master confidential and secure communication techniques using gpg4win. I will follow up on the references you provided and return when I have covered them all.

Thank you, W. M. Hanks

9

PMFJI, but why worry so much about sending a private key when it is of no use without the passphrase. I am not trying to be ‘funny’, I seriously want to know. I have my private key safe, I just wanted to know.

TIA

DrT

10

You’re right, the keypair is encrypted, and not immediately useful without the passphrase. The problem is that the passphrase is inherently much less secure than the key itself, otherwise we wouldn’t have to go through this entire procedure of generating a 2048-bit RSA key. The passphrase is only intended for reasonable security of the key on your PC. If an attacker gets access to the keypair file (e.g. to the contents of the .asc file), it is vulnerable to a “brute-force” attack, where the attacker systematically tries different combinations of possible characters and numbers to decode the keypair file, starting with a “dictionary” attack trying the entire dictionary of words and word variants, such as 1fFyP1a2s3s4wOrd. Now the keypair and its encryption are only as secure as the passphrase, whereas the encrypted message is as secure as the RSA key, which at 2048 bits is currently regarded as safe from a major attacker until some time between the year 2030 and 2040 (A K Lenstra [Technische Universiteit Eindhoven], “Key Lengths” - Contribution to The Handbook of Information Security).

If we use a 10-character password/passphrase, using any of the commonly-available 62 characters (including upper and lower case) on the keyboard, the number of combinations is 62 to the power 10 (since at every character position you can choose from 62 characters). This gives about 8.4 x 1017 combinations, which seems a lot, until you realise that a 2.5 GHz processor with 8 cores may be able to try around 1010 combinations per second. It will take around 106 - 107 seconds to find the passphrase. This is 116 days. The information you are encrypting may not be worth that much expenditure of time on a PC. However, a supercomputer employing parallel calculating techniques could find the passphrase in a matter of seconds or less, and most passphrases would break sooner than that under a dictionary attack.

But you’re right in that most people would not have the resources or incentive to break your passphrase and get your key - although they might try “password” or “12345” or “letmein” or “qwerty” (which amazingly are still among the most common passwords used), or the name of your wife, or child, or dog… you get the idea.

The bottom line is that if you’re using encryption in the first place, you don’t want to let your secret key out so that your message security is only dependent on the strength of your passphrase, otherwise what’s the point of using RSA and AES?

11

Thank you very much for that clear explanation.

Printed and saved for future use.

Regards

DrT

12

Just a comment on the calculation of ‘time to crack’ versus password length and total population of characters - This is the calculation typically used to show that whatever password would take 116 days or 4 billion years depending on computer power available.

As far as I can see, the total time quoted would be to go through all the possible combinations. The password might of course be cracked on the first attempt but it would be unlikely that in each case it would only fall at the last iteration.

We’re never as safe as the optimists would have us believe.

13

Maybe I didn’t make it sufficiently clear that I was trying to differentiate between the security of the key-file, which depends on the strength of the password, and the security of the key itself and the resulting ciphertext, which doesn’t.

The explanation was meant to be illustrative, based on the security of a basic passphrase. To be rather more precise, the passphrase will be found on average after a number of attempts approximately equal to the square root of the number of possible character combinations. I said there were 8.4 x 1017 combinations for a 10-character passphrase and worked from there, but you are right, the attacker will probably not have to try them all. In fact he has a 50% probability of finding it after trying 9.17 x 108, which is a lot less than the maximum number of tries, and therefore he has a 1 in 2 chance of finding it in a tenth of a second. So the key file needs to be kept safe (and a longer passphrase would be a good idea).

But the key itself, and the message protected by it, is on a different scale. Keys are produced using a combination of random number generation and hashing, to obtain an apparently random combination of bits. Typically, cryptographic levels of security for symmetric ciphers are assessed around the basis of 256-bit keys. The number of such keys is therefore 2256 = 1077 approximately. A brute-force attack on an N-bit key can be expected to find it with 50% probability after a number of attempts approximately equal to the square root of the number of keys, 2**(N/2). In this case, this is 2128 = 3 x 1038, approximately. To put it in context, the chance of finding the right key on the first attempt, or any single attempt, is 1 in 1077. Getting this probability up to 50% requires 300,000,000,000,000,000,000,000,000,000,000,000,000 tries. Your chance of winning the National Lottery at any one attempt is 1 in 14,000,000. Won the Lottery lately? If you work out the sort of computing speed needed to do 1038 attempts in any reasonable time, to get to within a 50% chance of finding the key, you will find it is well beyond any projected estimate of increase in computer power for the foreseeable future.

To paraphrase Ferguson, Schneier, and Kohno (Cryptographic Engineering): “The chance that you will be killed by a meteorite while you read this sentence is far larger [e.g. than finding the key on the first attempt]. Still alive? Okay, so don’t worry about it.”

To summarise: the security of the passphrase used to protect your keyfile is low, so don’t let the file out of your control. The security of the key itself (for AES) is enormous. This isn’t a matter of optimism and pessimism, it’s a matter of maths. You can trust the maths.

14

What would you call that number? 300 thousand Hendecillions? I want the compter that can crack that in less than a year!

15

Hello,

Being completely new to PGP4Win, I started sending practice messages to ‘Adele’. After a couple of failed attempts it became clear that Adele cannot find my public key in an email attachment. It/she replied that I had sent no keys or encrypted message.

When I send my public key block in the body of an email message, Adele does respond.

Regards
Frits

16

Well, if you want to putz about with a robot instead of the real thing…

I tried Adele and immediately decide to practice using several of my email addresses sending myself encrypted mails. I learn much more that way.

The offer is still open…