mirror of
git://git.gnupg.org/gnupg.git
synced 2024-08-26 11:07:54 +02:00
434 lines
16 KiB
Plaintext
434 lines
16 KiB
Plaintext
<chapter id="wise" xreflabel="4">
|
|
<docinfo>
|
|
<date>
|
|
$Id$
|
|
</date>
|
|
</docinfo>
|
|
<title>
|
|
Daily use of &Gnupg;
|
|
</title>
|
|
|
|
<para>
|
|
&Gnupg; is a complex tool with technical, social, and legal issues
|
|
surrounding it.
|
|
Technically, it has been designed to be used in situations having
|
|
drastically different security needs.
|
|
This complicates key management.
|
|
Socially, using &gnupg; is not strictly a personal decision.
|
|
To use &gnupg effectively both parties communicating must use it.
|
|
Finally, as of 1999, laws regarding digital encryption, and in particular
|
|
whether or not using &gnupg; is legal, vary from country to country and
|
|
is currently being debated by many national governments.
|
|
</para>
|
|
|
|
<para>
|
|
This chapter addresses these issues.
|
|
It gives practical advice on how to use &gnupg; to meet your security needs.
|
|
It also suggests ways to promote the use of &gnupg; for secure
|
|
communication between yourself and your colleagues when your colleagues
|
|
are not currently using &gnupg;.
|
|
Finally, the legal status of &gnupg; is outlined given the current status
|
|
of encryption laws in the world.
|
|
</para>
|
|
|
|
<sect1>
|
|
<title>
|
|
Defining your security needs
|
|
</title>
|
|
|
|
<para>
|
|
&Gnupg; is a tool you use to protect your privacy.
|
|
Your privacy is protected if you can correspond with others without
|
|
eavesdroppers reading those messages.
|
|
</para>
|
|
|
|
<para>
|
|
How you should use &gnupg; depends on the determination and resourcefulness
|
|
of those who might want to read your encrypted messages.
|
|
An eavesdropper may be an unscrupulous system administrator casually
|
|
scanning your mail, it might be an industrial spy trying to collect
|
|
your company's secrets, or it might be a law enforcement agency trying
|
|
to prosecute you.
|
|
Using &gnupg; to protect against casual eavesdropping is going to be
|
|
different than using &gnupg; to protect against a determined adversary.
|
|
Your goal, ultimately, is to make it more expensive to recover the
|
|
unencrypted data than that data is worth.
|
|
</para>
|
|
|
|
<para>
|
|
Customizing your use of &gnupg; revolves around three issues:
|
|
<itemizedlist spacing="compact">
|
|
<listitem>
|
|
<para>
|
|
the key size of your public/private keypair,
|
|
</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>
|
|
protecting your private key, and
|
|
</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>
|
|
managing your web of trust.
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
A well-chosen key size protects you against brute-force attacks on
|
|
encrypted messages.
|
|
Protecting your private key prevents an attacker from simply using your
|
|
private key to decrypt encrypted messages and sign messages in your name.
|
|
Correctly managing your web of trust prevents attackers from masquarading
|
|
as people with whom you communicate.
|
|
Ultimately, addressing these issues with respect to your own security
|
|
needs is how you balance the extra work required to use &gnupg; with
|
|
the privacy it gives you.
|
|
</para>
|
|
|
|
<sect2>
|
|
<title>
|
|
Choosing a key size
|
|
</title>
|
|
|
|
<para>
|
|
Selecting a key size depends on the key.
|
|
In OpenPGP, a public/private keypair usually has multiple keys.
|
|
At the least it has a master signing key, and it probably has one or
|
|
more additional subkeys for encryption.
|
|
Using default key generation parameters with &gnupg;, the master
|
|
key will be a DSA key, and the subkeys will be ElGamal keys.
|
|
</para>
|
|
|
|
<para>
|
|
DSA allows a key size up to 1024 bits.
|
|
This is not especially good given today's factoring technology, but
|
|
that is what the standard specifies.
|
|
Without question, you should use 1024 bit DSA keys.
|
|
</para>
|
|
|
|
<para>
|
|
ElGamal keys, on the other hand, may be of any size.
|
|
Since &gnupg; is a hybrid public-key system, the public key is used
|
|
to encrypt a 128-bit session key, and the private key is used to
|
|
decrypt it.
|
|
Key size nevertheless affects encryption and decryption speed
|
|
since the cost of these algorithms is exponential in the size of
|
|
the key.
|
|
Larger keys also take more time to generate and take more space
|
|
to store.
|
|
Ultimately, there are diminishing returns on the extra security
|
|
a large key provides you.
|
|
After all, if the key is large enough to resist a brute-force
|
|
attack, an eavesdropper will merely switch to some other method for
|
|
obtaining your plaintext data.
|
|
Examples of other methods include robbing your home or office
|
|
and mugging you.
|
|
1024 bits is thus the recommended key size.
|
|
If you genuinely need a larger key size then you probably already
|
|
know this and should be consulting an expert in data security.
|
|
</para>
|
|
</sect2>
|
|
|
|
<sect2>
|
|
<title>
|
|
Protecting your private key
|
|
</title>
|
|
|
|
<para>
|
|
Protecting your private key is the most important job you have to
|
|
use &gnupg; correctly.
|
|
If someone obtains your private key, then all data encrypted to
|
|
the private key can be decrypted and signatures can be made in your name.
|
|
If you lose your private key, then you will no longer be able to
|
|
decrypt documents encrypted to you in the future or in the past,
|
|
and you will not be able to make signatures.
|
|
Losing sole possession of your private key is catastrophic.
|
|
</para>
|
|
|
|
<para>
|
|
Regardless of how you use &gnupg; you should store the public
|
|
key's <link linkend="revocation">revocation certificate</link>
|
|
and a backup of your private key on write-protected media in a safe place.
|
|
For example, you could burn them on a CD-ROM and store them in your
|
|
safe deposit box at the bank in a sealed envelope.
|
|
Alternatively, you could store them on a floppy and hide it in your
|
|
house.
|
|
Whatever you do, they should be put on media that is safe to store
|
|
for as long as you expect to keep the key, and you should store
|
|
them more carefully than the copy of your private key you use daily.
|
|
</para>
|
|
|
|
<para>
|
|
To help safeguard your key, &Gnupg; does not store your raw
|
|
private key on disk.
|
|
Instead it encrypts it using a symmetric encryption algorithm.
|
|
That is why you need a passphrase to access the key.
|
|
Thus there are two barriers an attacker must cross to access your private
|
|
key: (1) he must actually acquire the key, and (2) he must get past
|
|
the encryption.
|
|
</para>
|
|
|
|
<para>
|
|
Safely storing your private key is important, but there is a cost.
|
|
Ideally, you would keep the private key on a removable, write-protected disk
|
|
such as a floppy disk, and you would use it on a single-user machine
|
|
not connected to a network.
|
|
This may be inconvenient or impossible for you to do.
|
|
For example, you may not own your own machine and must use a computer
|
|
at work or school, or it may mean you have to physically disconnect
|
|
your computer from your cable modem every time you want to use &gnupg;
|
|
</para>
|
|
|
|
<para>
|
|
This does not mean you cannot or should not use &gnupg;.
|
|
It means only that you have decided that the data you are protecting is
|
|
important enough to encrypt but not so important as to take extra
|
|
steps to make the first barrier stronger.
|
|
It is your choice.
|
|
</para>
|
|
|
|
<para>
|
|
A good passphrase is absolutely critical when using &gnupg;.
|
|
Any attacker who gains access to your private key must bypass the
|
|
encryption on the private key.
|
|
Instead of brute-force guessing the key, an attacker will almost
|
|
certainly instead try to guess the passphrase.
|
|
</para>
|
|
|
|
<para>
|
|
The motivation for trying passphrases is that most people choose
|
|
a passphrase that is easier to guess than a random 128-bit key.
|
|
If the passphrase is a word, it is much cheaper to try all the
|
|
words in the dictionaries of the world's languages.
|
|
Even if the word is permuted, &eg, k3wldood, it is still easier
|
|
to try dictionary words with a catalog of permutations.
|
|
The same problem applies to quotations.
|
|
In general, passphrases based on natural-language utterances
|
|
are poor passphrases since there is little randomness and lots
|
|
of redundancy in natural language.
|
|
You should avoid natural language passphrases if you can.
|
|
</para>
|
|
|
|
<para>
|
|
A good passphrase is one that you can remember but is hard for
|
|
someone to guess.
|
|
It should include characters from the whole range of printable characters
|
|
on your keyboard.
|
|
This includes uppercase alphabetics characters, numbers, and special
|
|
characters such as <literal>}</literal> and <literal>|</literal>.
|
|
Be creative and spend a little time considering your passphrase; a
|
|
good choice is important to ensure your privacy.
|
|
</para>
|
|
</sect2>
|
|
|
|
<!--
|
|
<sect2>
|
|
<title>
|
|
Reacting to a compromised private key
|
|
</title>
|
|
|
|
<para>
|
|
Despite your precautions you may lose sole access to your private key.
|
|
For example, you may forget the passphrase, or someone who you think
|
|
can bypass the encryption gets access to it.
|
|
In that case then you need to spread the word that your key is no
|
|
longer valid.
|
|
To do that you use the key revocation certificate you should have generated
|
|
when you created the key.
|
|
Importing it onto your public keyring will revoke the public key
|
|
of the keypair you no longer wish to use.
|
|
It is then up to you to distribute the revoked public key to all
|
|
those who may encrypt documents to you.
|
|
</para>
|
|
|
|
<para>
|
|
A revoked public key only prevents future use of the private key.
|
|
Others will neither be able to encrypt documents to the key nor will
|
|
they be able to check signatures made with the private key.
|
|
Documents signed in the past can still be checked, however, and
|
|
documents encrypted in the past can still be decrypted.
|
|
</para>
|
|
|
|
<para>
|
|
It is important that you protect the revocation certificate carefully.
|
|
Anybody can add the certificate to your public key and distribute it,
|
|
and there is no way to revoke a revocation certificate.
|
|
Therefore, you should store the revocation certificate in a safe
|
|
place such as with the backup of your private key.
|
|
</para>
|
|
</sect2>
|
|
-->
|
|
|
|
<sect2>
|
|
<title>
|
|
Managing your web of trust
|
|
</title>
|
|
|
|
<para>
|
|
As with protecting your private key, managing your web of trust is
|
|
another aspect of using &gnupg; that requires balancing security against
|
|
ease of use.
|
|
If you are using &gnupg; to protect against casual eavesdropping and
|
|
forgeries then you can afford to be relatively trusting of other
|
|
people's signatures.
|
|
On the other hand, if you are concerned that there may be a determined
|
|
attacker interested in invading your privacy, then
|
|
you should be much less trusting of other signatures and spend more time
|
|
personally verifying signatures.
|
|
</para>
|
|
|
|
<para>
|
|
Regardless of your own security needs, through, you should
|
|
<emphasis>always be careful</emphasis> when signing other keys.
|
|
It is selfish to sign a key with just enough confidence in the key's
|
|
validity to satisfy your own security needs.
|
|
Others, with more stringent security needs, may want to depend on
|
|
your signature.
|
|
If they cannot depend on you then that weakens the web of trust
|
|
and makes it more difficult for all &gnupg; users to communicate.
|
|
Use the same care in signing keys that you would like others to use when
|
|
you depend on their signatures.
|
|
</para>
|
|
|
|
<para>
|
|
In practice, managing your web of trust reduces to assigning trust to
|
|
others and tuning the options
|
|
<link linkend="marginals-needed"><option>--marginals-needed</option></link>
|
|
and
|
|
<link linkend="completes-needed"><option>--completes-needed</option></link>.
|
|
Any key you personally sign will be considered valid, but except for small
|
|
groups, it will not be practical to personally sign the key of every person
|
|
with whom you communicate.
|
|
You will therefore have to assign trust to others.
|
|
</para>
|
|
|
|
<para>
|
|
It is probably wise to be accurate when assigning trust and then
|
|
use the options to tune how careful &gnupg; is with key validation.
|
|
As a concrete example, you may fully trust a few close friends that
|
|
you know are careful with key signing and then marginally
|
|
trust all others on your keyring.
|
|
From there, you may set <option>--completes-needed</option> to
|
|
<literal>1</literal> and <option>--marginals-needed</option> to
|
|
<literal>2</literal>.
|
|
If you are more concerned with security you might choose values of
|
|
<literal>1</literal> and <literal>3</literal> or <literal>2</literal>
|
|
and <literal>3</literal> respectively.
|
|
If you are less concerned with privacy attacks and just want some
|
|
reasonable confidence about validity, set the values to <literal>1</literal>
|
|
and <literal>1</literal>.
|
|
In general, higher numbers for these options imply that more people
|
|
would be needed to conspire against you in order to have a key validated
|
|
that does not actually belong to the person whom you think it does.
|
|
</para>
|
|
</sect2>
|
|
</sect1>
|
|
|
|
<sect1>
|
|
<title>
|
|
Building your web of trust
|
|
</title>
|
|
|
|
<para>
|
|
Wanting to use &gnupg; yourself is not enough.
|
|
In order to use to communicate securely with others you must have
|
|
a web of trust.
|
|
At first glance, however, building a web of trust is a daunting task.
|
|
The people with whom you communicate need to use
|
|
&gnupg;<footnote><para>In this section, &gnupg; refers to the
|
|
&gnupg; implementation of OpenPGP as well as other implementations
|
|
such as NAI's PGP product.</para></footnote>, and there needs to be enough
|
|
key signing so that keys can be considered valid.
|
|
These are not technical problems; they are social problems.
|
|
Nevertheless, you must overcome these problems if you want to
|
|
use &gnupg;.
|
|
</para>
|
|
|
|
<para>
|
|
When getting started using &gnupg; it is important to realize that you
|
|
need not securely communicate with every one of your correspondents.
|
|
Start with a small circle of people, perhaps just yourself and
|
|
one or two others who also want to exercise their right
|
|
to privacy.
|
|
Generate your keys and sign each other's public keys.
|
|
This is your initial web of trust.
|
|
By doing this you will appreciate the value of a small, robust
|
|
web of trust and will be more cautious as you grow your web
|
|
in the future.
|
|
</para>
|
|
|
|
<para>
|
|
In addition to those in your initial web of trust, you may want to
|
|
communicate securely with others who are also using &gnupg;.
|
|
Doing so, however, can be awkward for two reasons:
|
|
(1) you do not always know when someone uses or is willing to use
|
|
&gnupg;, and (2) if you do know of someone who uses it, you may still have
|
|
trouble validating their key.
|
|
The first reason occurs because people do not always advertise that
|
|
they use &gnupg;.
|
|
The way to change this behavior is to set the example and advertise
|
|
that you use &gnupg;.
|
|
There are at least three ways to do this: you can sign messages you mail
|
|
to others or post to message boards, you can put your public key on your
|
|
web page, or, if you put your key on a keyserver, you can put your key
|
|
ID in your email signature.
|
|
If you advertise your key then you make it that much more acceptable
|
|
for others to advertise their keys.
|
|
Furthermore, you make it easier for others to start communicating
|
|
with you securely since you have taken the initiative and made it clear
|
|
that you use &gnupg;.
|
|
</para>
|
|
|
|
<para>
|
|
Key validation is more difficult.
|
|
If you do not personally know the person whose key you want to sign,
|
|
then it is not possible to sign the key yourself.
|
|
You must rely on the signatures of others and hope to find a chain
|
|
of signatures leading from the key in question back to your own.
|
|
To have any chance of finding a chain, you must take the intitive
|
|
and get your key signed by others outside of your intitial web of trust.
|
|
An effective way to accomplish this is to participate in key
|
|
signing parties.
|
|
If you are going to a conference look ahead of time for a key
|
|
signing party, and if you do not see one being held, offer to
|
|
<ulink url="http://www.herrons.com/kb2nsx/keysign.html">hold one</ulink>.
|
|
You can also be more passive and carry your fingerprint with you
|
|
for impromptu key exchanges.
|
|
In such a situation the person to whom you gave the fingerprint
|
|
would verify it and sign your public key once he returned home.
|
|
</para>
|
|
|
|
<para>
|
|
Keep in mind, though, that this is optional.
|
|
You have no obligation to either publically advertise your key or
|
|
sign other people's keys.
|
|
The power of &gnupg; is that it is flexible enough to adapt to your
|
|
security needs whatever they may be.
|
|
The social reality, however, is that you will need to take the initiative
|
|
if you want to grow your web of trust and use &gnupg; for as much of
|
|
your communication as possible.
|
|
</para>
|
|
</sect1>
|
|
|
|
<sect1>
|
|
<title>
|
|
Using &Gnupg; legally
|
|
</title>
|
|
|
|
<para>
|
|
The legal status of encryption software varies from country to country,
|
|
and law regarding encryption software is rapidly evolving.
|
|
<ulink url="http://cwis.kub.nl/~frw/people/koops/bertjaap.htm">Bert-Japp
|
|
Koops</ulink> has an excellent
|
|
<ulink url="http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm">Crypto
|
|
Law Survey</ulink> to which you should refer for the legal status of
|
|
encryption software in your country.
|
|
</para>
|
|
|
|
</sect1>
|
|
</chapter>
|
|
|