/usr/share/doc/gnupg-doc/GNU_Privacy_Handbook/html/c488.htm is in gnupg-doc 2003.04.06+dak1-1ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Daily use of GnuPG</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The GNU Privacy Handbook"
HREF="book1.htm"><LINK
REL="PREVIOUS"
TITLE="Distributing keys"
HREF="x464.htm"><LINK
REL="NEXT"
TITLE="Building your web of trust"
HREF="x554.htm"></HEAD
><BODY
CLASS="CHAPTER"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The GNU Privacy Handbook</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="x464.htm"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="x554.htm"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="CHAPTER"
><H1
><A
NAME="WISE"
></A
>Chapter 4. Daily use of GnuPG</H1
><DIV
CLASS="TOC"
><DL
><DT
><B
>Table of Contents</B
></DT
><DT
><A
HREF="c488.htm#AEN494"
>Defining your security needs</A
></DT
><DT
><A
HREF="x554.htm"
>Building your web of trust</A
></DT
><DT
><A
HREF="x564.htm"
>Using GnuPG legally</A
></DT
></DL
></DIV
><P
>GnuPG is a complex tool with technical, social, and legal issues
surrounding it.
Technically, it has been designed to be used in situations having
drastically different security needs.
This complicates key management.
Socially, using GnuPG is not strictly a personal decision.
To use GnuPG effectively both parties communicating must use it.
Finally, as of 1999, laws regarding digital encryption, and in particular
whether or not using GnuPG is legal, vary from country to country and
is currently being debated by many national governments.</P
><P
>This chapter addresses these issues.
It gives practical advice on how to use GnuPG to meet your security needs.
It also suggests ways to promote the use of GnuPG for secure
communication between yourself and your colleagues when your colleagues
are not currently using GnuPG.
Finally, the legal status of GnuPG is outlined given the current status
of encryption laws in the world.</P
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN494"
>Defining your security needs</A
></H1
><P
>GnuPG is a tool you use to protect your privacy.
Your privacy is protected if you can correspond with others without
eavesdroppers reading those messages.</P
><P
>How you should use GnuPG depends on the determination and resourcefulness
of those who might want to read your encrypted messages.
An eavesdropper may be an unscrupulous system administrator casually
scanning your mail, it might be an industrial spy trying to collect
your company's secrets, or it might be a law enforcement agency trying
to prosecute you.
Using GnuPG to protect against casual eavesdropping is going to be
different than using GnuPG to protect against a determined adversary.
Your goal, ultimately, is to make it more expensive to recover the
unencrypted data than that data is worth.</P
><P
>Customizing your use of GnuPG revolves around four issues:
<P
></P
><UL
COMPACT="COMPACT"
><LI
><P
>choosing the key size of your public/private keypair,</P
></LI
><LI
><P
>protecting your private key, </P
></LI
><LI
><P
>selecting expiration dates and using subkeys, and</P
></LI
><LI
><P
>managing your web of trust.</P
></LI
></UL
>
A well-chosen key size protects you against brute-force attacks on
encrypted messages.
Protecting your private key prevents an attacker from simply using your
private key to decrypt encrypted messages and sign messages in your name.
Correctly managing your web of trust prevents attackers from masquerading
as people with whom you communicate.
Ultimately, addressing these issues with respect to your own security
needs is how you balance the extra work required to use GnuPG with
the privacy it gives you.</P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN508"
>Choosing a key size</A
></H2
><P
>Selecting a key size depends on the key.
In OpenPGP, a public/private keypair usually has multiple keys.
At the least it has a master signing key, and it probably has one or
more additional subkeys for encryption.
Using default key generation parameters with GnuPG, the master
key will be a DSA key, and the subkeys will be ElGamal keys.</P
><P
>DSA allows a key size up to 1024 bits.
This is not especially good given today's factoring technology, but
that is what the standard specifies.
Without question, you should use 1024 bit DSA keys.</P
><P
>ElGamal keys, on the other hand, may be of any size.
Since GnuPG is a hybrid public-key system, the public key is used
to encrypt a 128-bit session key, and the private key is used to
decrypt it.
Key size nevertheless affects encryption and decryption speed
since the cost of these algorithms is exponential in the size of
the key.
Larger keys also take more time to generate and take more space
to store.
Ultimately, there are diminishing returns on the extra security
a large key provides you.
After all, if the key is large enough to resist a brute-force
attack, an eavesdropper will merely switch to some other method for
obtaining your plaintext data.
Examples of other methods include robbing your home or office
and mugging you.
1024 bits is thus the recommended key size.
If you genuinely need a larger key size then you probably already
know this and should be consulting an expert in data security.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN513"
>Protecting your private key</A
></H2
><P
>Protecting your private key is the most important job you have to
use GnuPG correctly.
If someone obtains your private key, then all data encrypted to
the private key can be decrypted and signatures can be made in your name.
If you lose your private key, then you will no longer be able to
decrypt documents encrypted to you in the future or in the past,
and you will not be able to make signatures.
Losing sole possession of your private key is catastrophic.</P
><P
>Regardless of how you use GnuPG you should store the public
key's <A
HREF="c15.htm#REVOCATION"
>revocation certificate</A
>
and a backup of your private key on write-protected media in a safe place.
For example, you could burn them on a CD-ROM and store them in your
safe deposit box at the bank in a sealed envelope.
Alternatively, you could store them on a floppy and hide it in your
house.
Whatever you do, they should be put on media that is safe to store
for as long as you expect to keep the key, and you should store
them more carefully than the copy of your private key you use daily.</P
><P
>To help safeguard your key, GnuPG does not store your raw
private key on disk.
Instead it encrypts it using a symmetric encryption algorithm.
That is why you need a passphrase to access the key.
Thus there are two barriers an attacker must cross to access your private
key: (1) he must actually acquire the key, and (2) he must get past
the encryption.</P
><P
>Safely storing your private key is important, but there is a cost.
Ideally, you would keep the private key on a removable, write-protected disk
such as a floppy disk, and you would use it on a single-user machine
not connected to a network.
This may be inconvenient or impossible for you to do.
For example, you may not own your own machine and must use a computer
at work or school, or it may mean you have to physically disconnect
your computer from your cable modem every time you want to use GnuPG.</P
><P
>This does not mean you cannot or should not use GnuPG.
It means only that you have decided that the data you are protecting is
important enough to encrypt but not so important as to take extra
steps to make the first barrier stronger.
It is your choice.</P
><P
>A good passphrase is absolutely critical when using GnuPG.
Any attacker who gains access to your private key must bypass the
encryption on the private key.
Instead of brute-force guessing the key, an attacker will almost
certainly instead try to guess the passphrase.</P
><P
>The motivation for trying passphrases is that most people choose
a passphrase that is easier to guess than a random 128-bit key.
If the passphrase is a word, it is much cheaper to try all the
words in the dictionaries of the world's languages.
Even if the word is permuted, e.g., k3wldood, it is still easier
to try dictionary words with a catalog of permutations.
The same problem applies to quotations.
In general, passphrases based on natural-language utterances
are poor passphrases since there is little randomness and lots
of redundancy in natural language.
You should avoid natural language passphrases if you can.</P
><P
>A good passphrase is one that you can remember but is hard for
someone to guess.
It should include characters from the whole range of printable characters
on your keyboard.
This includes uppercase alphabetics characters, numbers, and special
characters such as <TT
CLASS="LITERAL"
>}</TT
> and <TT
CLASS="LITERAL"
>|</TT
>.
Be creative and spend a little time considering your passphrase; a
good choice is important to ensure your privacy.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN526"
>Selecting expiration dates and using subkeys</A
></H2
><P
>By default, a DSA master signing key and an ElGamal encryption subkey
are generated when you create a new keypair.
This is convenient, because the roles of the two keys are different,
and you may therefore want the keys to have different lifetimes.
The master signing key is used to make digital signatures, and it
also collects the signatures of others who have confirmed your
identity.
The encryption key is used only for decrypting encrypted documents
sent to you.
Typically, a digital signature has a long lifetime, e.g., forever, and
you also do not want to lose the signatures on your key that you worked
hard to collect.
On the other hand, the encryption subkey may be changed periodically
for extra security, since if an encryption key is broken, the
attacker can read all documents encrypted to that key both in the
future and from the past.</P
><P
>It is almost always the case that you will not want the master
key to expire.
There are two reasons why you may choose an expiration date.
First, you may intend for the key to have a limited lifetime.
For example, it is being used for an event such as a political campaign
and will no longer be useful after the campaign is over.
Another reason is that if you lose control of the key and do not have a
revocation certificate with which to revoke the key, having an expiration
date on the master key ensures that the key will eventually fall into
disuse.</P
><P
>Changing encryption subkeys is straightforward but can
be inconvenient.
If you generate a new keypair with an expiration date on the
subkey, that subkey will eventually expire.
Shortly before the expiration you will add a new subkey and
publish your updated public key.
Once the subkey expires, those who wish to correspond with you
must find your updated key since they will no longer be able
to encrypt to the expired key.
This may be inconvenient depending on how you distribute the key.
Fortunately, however, no extra signatures are necessary since
the new subkey will have been signed with your master signing
key, which presumably has already been validated by your
correspondents.</P
><P
>The inconvenience may or may not be worth the extra security.
Just as you can, an attacker can still read all documents encrypted to
an expired subkey.
Changing subkeys only protects future documents.
In order to read documents encrypted to the new subkey, the
attacker would need to mount a new attack using whatever
techniques he used against you the first time.</P
><P
>Finally, it only makes sense to have one valid encryption subkey on a
keyring.
There is no additional security gained by having two or more
active subkeys.
There may of course be any number of expired keys on a keyring
so that documents encrypted in the past may still be decrypted,
but only one subkey needs to be active at any given time.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN533"
>Managing your web of trust</A
></H2
><P
>As with protecting your private key, managing your web of trust is
another aspect of using GnuPG that requires balancing security against
ease of use.
If you are using GnuPG to protect against casual eavesdropping and
forgeries then you can afford to be relatively trusting of other
people's signatures.
On the other hand, if you are concerned that there may be a determined
attacker interested in invading your privacy, then
you should be much less trusting of other signatures and spend more time
personally verifying signatures.</P
><P
>Regardless of your own security needs, though, you should
<I
CLASS="EMPHASIS"
>always be careful</I
> when signing other keys.
It is selfish to sign a key with just enough confidence in the key's
validity to satisfy your own security needs.
Others, with more stringent security needs, may want to depend on
your signature.
If they cannot depend on you then that weakens the web of trust
and makes it more difficult for all GnuPG users to communicate.
Use the same care in signing keys that you would like others to use when
you depend on their signatures.</P
><P
>In practice, managing your web of trust reduces to assigning trust to
others and tuning the options
<CODE
CLASS="OPTION"
>--marginals-needed</CODE
>
and
<CODE
CLASS="OPTION"
>--completes-needed</CODE
>.
Any key you personally sign will be considered valid, but except for small
groups, it will not be practical to personally sign the key of every person
with whom you communicate.
You will therefore have to assign trust to others.</P
><P
>It is probably wise to be accurate when assigning trust and then
use the options to tune how careful GnuPG is with key validation.
As a concrete example, you may fully trust a few close friends that
you know are careful with key signing and then marginally
trust all others on your keyring.
From there, you may set <CODE
CLASS="OPTION"
>--completes-needed</CODE
> to
<TT
CLASS="LITERAL"
>1</TT
> and <CODE
CLASS="OPTION"
>--marginals-needed</CODE
> to
<TT
CLASS="LITERAL"
>2</TT
>.
If you are more concerned with security you might choose values of
<TT
CLASS="LITERAL"
>1</TT
> and <TT
CLASS="LITERAL"
>3</TT
> or <TT
CLASS="LITERAL"
>2</TT
>
and <TT
CLASS="LITERAL"
>3</TT
> respectively.
If you are less concerned with privacy attacks and just want some
reasonable confidence about validity, set the values to <TT
CLASS="LITERAL"
>1</TT
>
and <TT
CLASS="LITERAL"
>1</TT
>.
In general, higher numbers for these options imply that more people
would be needed to conspire against you in order to have a key validated
that does not actually belong to the person whom you think it does.</P
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="x464.htm"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="book1.htm"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="x554.htm"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Distributing keys</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
> </TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Building your web of trust</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>
|