Public key cryptography or asymmetric cryptography is a cryptographic system that uses pairs of keys,
public keys which are made public and private keys which are known only to the owner; the public and
the private keys are related
and there isn't a known way to generate the private key from the public key. Data encrypted with the
private key can only be decrypted with the public key and vice versa.
In such a system any person can encrypt the message using the receiver's public key,
but that encrypted message can only be decrypted with the receiver's private key.
For example if I want to send you an encrypted message I need your public key to encrypt the message.
Being encrypted with your public key
the message can be decrypted only with the private key of the key pair and you are and you are the only person
that possesses the key.
Note that the length of keys of asymmetric encryption algorithms
are much larger than the length of the keys of symmetric algorithms
without being more secure; for example an AES key of 128 bits and a RSA
key of 3072 bits
both have a similar strength.
You cannot compare the key length of symmetric and asymmetric encryption algorithms easily.
Let's get started with a hands-on example! To make it crystal clear,
I'll started from scratch.
There are two users that want to exchange secret information or files and they will encrypt them
asymmetrically. Symmetric
encryption is not viable because there is no secure way to exchange a secret, a shared key. Each user
will generate a key pair, keep the secret key private and publish the public key on a public key
server. Let's generate the key pair for each user:
gpg --gen-key
I'll use the passphrase to lock the private key
Perfect!
And I am publishing the public key to pgp.mit.edu key server.
The last lecture was all about key servers and distributing the keys.
Take a look again if you feel the need! Let's see
the key id gpg --list-keys --keyid-format long
This is the key id.
I'll use it to publish the key on the key server so gpg--key server.
hkp
This is not mandatory!
:
// pgp.mit.edu --send
-keys and the key id
okay, sorry, it's pgp not gpg ! Pperfect.
The key was sent and I'll do the same for the second user.
Each user needs its own key pair.
Now I'm generating the key pair of the user and publish the public key on the key server
okay.
At this moment each user has a public and a private key.
The public key is on the server and the private key is kept secret locally.
The next step is to import the other users public key in the gpg keyring.
This is necessary if you want to send encrypted files to the other user.
Of course if only the first user will send encrypted message to the second user then only the first
user needs to import the public key of the second user.
In this example only the user on Kali will send encrypted message to the other user, to this one.
To import a public key you need either the public key in a text file or the key idea to download it
from the key server,
of course if it was published there; in this example the user on Kali will import the public key from
the key server; to do that the user needs the keyid. We suppose he has received it by email or
or by any other means.
This is the keyid; so gpg --keyserver
pgp.mit.edu --recv and
the keyid
Okay, the public key of the second user was imported.
Note that it needs some time for the server to synchronize after receiving the key.
So after sending the key you must wait a minute or two until you can import the key in another terminal,
or in another machine; if you don't have the keyid
you can search for a key by the owner's name or email address like this
--search-keys and a string to search.
Let's take the user's email address.
And it found the key; this command will print a list of matching results and you enter the number next
to the one
you want to import. I've already imported the key so I'll press on q from quit. Let's list the
public keys in the keyring: gpg --list-keys
Okay there are two public keys.
My own public key and the other users public key; let's move on and encrypt a file for the second user
asymmetrically using the public key of the second user.
Let's see
the keyid.
Okay.
And I'm writing gpg -e from encrypt;
you can write -e or -- encrypt,
it's the same
-r and the recipient's keyid,
in this case is the id of the second user's key;
and the file I want to encrypt.
I'll create a new file in another terminal, here.
in the gpg directory.
I'm creating a simple file let's say secret information and an output redirection.
For example message.txt
okay.
This is the file.
so message.txt
and it wants me to confirm that I want to use that key.
This warning is normal in this case. In the same directory a new binary file has appeared.
message.txt.gpg
This is a binary file,
it was asymmetrically encrypted.
If you want to encrypt and store in ASCII format you must add --armore or -a the option
like this:
-a from armore or --armor.
It's the same.
And the encrypted file resulted is a message.txt .asc from ASCII and is a text or ASCII
file.
This is the file! Note that the both binary and ASCII versions decrypt the same way.
Now the user will send the encrypted message to the other user on an unsecured channel like the public
Internet.
In this example I'll transfer the encrypted file to the second user using scp; scp uses ssh and it's
an encrypted connection but I could also use an unencrypted one like http or ftp; I'm using scp only because
it's already set up and it's working.
I don't want to set up an ftp server for that.
Let's see the IP address of the other Linux machine:
so scp the encrypted file or files; I'll copy both encrypted files
the name of the user on the other machine student and the IP address.
And the local path where to copy the files, home it's directory okay.
There is an extra zero.
It was a typo.
Okay.
This is the correct address and the user's password.
And the encrypted files were copied
these are the files.
The recipient has the encrypted files and wants to decrypt them using its own private key.
He is the only person in the world that has the private key so only he can decrypt the files and he
writes gpg- d or -- decrypt and the name of the encrypted file.
Let's take the binary one, this one.
It's asking for the passphrase that will unlock the private key and I'm entering the passphrase
and we see the contents of the file secret information.
This was the content of the file.
This command didn't create a new file.
It printed out the file contents at the terminal.
If you want to create a new file you can simply add -0 from output and the name of the file.
For example message.txt
The filie was decrypted and the new file was created.
The other file, the ASCII one, decryts the same way.
I'm overwriting the file.
That's all about asymmetric encryption.
Thank you!