Difference between revisions of "GnuPG"

Revision as of 15:32, 10 October 2013

French part was converted with HTML::WikiConverter::MediaWiki from my old phpwiki site

Intro

Un très bon point de départ: http://www.gnupg.org/gph/fr/manual.html

Une introduction a GnuPG(vulgaristation): http://www.vilya.org/gpg/

Mes clés

On peut les trouver un peu partout.

   gpg --keyserver wwwkeys.pgp.net --recv-key 0x7A135F579AD7E3DB

Serveurs publics

Key Signing Coordination

http://www.biglumber.com/

Distance entre clés

Par exemple
http://keyserver.kjsl.com/~jharris/gpgwww.cgi?from=135EA668&to=9AD7E3DB
http://keyserver.kjsl.com/~jharris/gpgwww.cgi?from=449FA3AB&to=9AD7E3DB
Remplacer les IDs des clés pour essayer d'autres chemins.

Update: les URLs précédentes ne fonctionnent apparemment plus, vous pouvez essayer avec celles-ci:
http://pgp.cs.uu.nl/mk_path.cgi?FROM=135EA668&TO=9AD7E3DB&PATHS=trust+paths
http://pgp.cs.uu.nl/mk_path.cgi?FROM=449FA3AB=9AD7E3DB&PATHS=trust+paths

http://www.cs.uu.nl/people/henkp/henkp/pgp/pathfinder/mk_path.cgi?STAT=9AD7E3DB&STATS=statistics

Strong Set

Une analyse globale est disponible ici: http://pgp.cs.uu.nl/plot/
J'y suis rentré en août 2002 avec une distance moyenne de 6.9916 (merci adulau ;-)
Des analyses mensuelles sont disponibles ici: http://keyserver.kjsl.com/~jharris/ka

Date	Mean dist	World class	From Set to ID	From ID to Set	Max hops	Strong set	Average mean
08-2002	6.9916	>1000	-	-	15	14159	6.5105
11-08-2002	5.7041	>1000	-	-	14	14353	6.5222
25-08-2002	5.6948	>1000	-	-	14	14586	6.5327
08-09-2002	5.6979	>1000	-	-	14	14797	6.5561
22-09-2002	5.6648	>1000	-	-	14	14973	6.5084
06-10-2002	5.6414	>1000	-	-	14	15169	6.5101
20-10-2002	5.6296	>1000	9	12	14	15370	6.5037
03-11-2002	5.5183	>1000	19	27	13	15575	6.5045
17-11-2002	5.4787	>1000	24	27	13	15787	6.5017
01-12-2002	5.4420	>1000	24	27	13	15949	6.4797
15-12-2002	5.4373	>1000	24	27	13	16174	6.4806
29-12-2002	5.3922	>1000	24	27	13	16305	6.4931
12-01-2003	5.3865	>1000	24	27	13	16474	6.4804
26-01-2003	5.2183	>1000	24	27	13	16673	6.4706
09-02-2003	5.2173	>1000	24	27	13	16951	6.4849
23-02-2003	4.7102	496	43	63	13	17338	6.4773
09-03-2003	4.7024	507	45	63	13	17620	6.4711
23-03-2003	4.6933	500	46	63	13	17861	6.4675
06-04-2003	4.6794	481	47	63	13	18197	6.6484
20-04-2003	4.6373	367	51	67	13	19075	6.6624
04-05-2003	4.6281	358	51	67	13	19372	6.6584
18-05-2003	4.6027	330	51	67	13	19641	6.6410
01-06-2003	4.6002	331	51	67	13	19833	6.6261
15-06-2003	4.5854	335	52	68	13	20095	6.6038
29-06-2003	4.5700	330	52	68	13	20305	6.5954
13-07-2003	4.5531	327	52	68	13	20602	6.5762
27-07-2003	4.5189	419	52	68	13	20814	6.5251
10-08-2003	4.4803	440	52	68	13	21025	6.4861
24-08-2003	4.4676	461	58	75	13	21333	6.4784
07-09-2003	4.4565	462	59	76	13	21487	6.4721
05-10-2003	4.4456	482	59	76	13	21843	6.4762
17-02-2008	4.4435	1761	16	91	14	40282	5.98?
--2008	4.	-	0	0	0	-	6.

#!/bin/bash
# gpg-setstats retrieves stats about the strongset & your key
REF="http://skylane.kjsl.com/~jharris/ka"
MYKEY=${1:-"9AD7E3DB"}
 
for URL in $(lynx -dump $REF|grep "$REF/200"|cut -c 7-53); do
  select q in "Stats for the ${URL#$REF}" "Skip" "Quit";do
  if [ "$q" == "Stats for the ${URL#$REF}" ]; then
    echo =======================================
    echo Retrieve infos for ${URL#$REF}:
    wget -O - -q ${URL}other.txt
    wget -O - -q ${URL}status.txt|grep "strongly connected"
    wget -O - -q $URL${MYKEY:0:2}/$MYKEY|grep "^KeyID\|^Total\|^Mean\|^Farthest"
    echo -n "World Class:"
    lynx -dump ${URL}top1000table.html|grep $MYKEY|grep -v kjsl
    echo =======================================
    break; fi
  if [ "$q" == "Skip"  ]; then
    break; fi
  if [ "$q" == "Quit" ]; then
    exit; fi
  echo test $URL
  done
done

Tips

Pour fetcher ttes les UIDs qui ont signé une clé

  for key in $(gpg --list-sigs $1|grep ^sig|cut -c 13-20|sort|uniq);
  do
   gpg --recv-key $key
  done

quintuple-agent

  eval `q-agent &`
  q-client put 9AD7E3DB -t 3600
  or directly use agpg instead of gpg

Support de OpenPGP dans KMail:

http://kmail.kde.org/kmail-pgpmime-howto.html

 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/libksba0_0.4.3-1_i386.deb
 dpkg -i libksba0_0.4.3-1_i386.deb
 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/pinentry-gtk_0.6.3-1_i386.deb
 dpkg -i pinentry-gtk_0.6.3-1_i386.deb
 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/gpgsm_0.3.9-1_i386.deb
 dpkg -i gpgsm_0.3.9-1_i386.deb
 gpg --rebuild-keydb-caches

Editer ~/.gnupg/gpg.conf -> use-agent
Dans KMail, Settings->Configure KMail->Security->Crypto Plugins et ajouter gpgme-openpgp.so plugin.
Laisser "update URL" vide et mettre un nom comme par ex. "OpenPGP", "location": /usr/lib/cryptplug/gpgme-opengpg.so

/usr/local/bin/gpg-kmail:

 
#!/bin/bash
launch_me(){
   eval "$(gpg-agent --pinentry-program /usr/bin/pinentry-gtk --no-grab --default-cache-ttl 1800 )"
   kmail $* --nofork
   echo $GPG_AGENT_INFO|cut -d: -f2|xargs kill
}
launch_me $* &
exit 0

Support of Enigmail in Firefox

A promising solution for webmails...
See http://www.camrdale.org/GoogleSoC.html

Paper backup of the secret keys

apt-get install paperkey
gpg --export-secret-key key_id | paperkey

Notes on signing-parties

Old notes

Pas mal d'infos sur http://skylane.kjsl.com/~jharris/keysigning.html
Ainsi que des exemples d'annonce par Adulau sur http://www.ael.be/action/gnupg/ et http://www.ael.be/action/gnupg/fosdem/
Mais un problème courant est la coordination physique des gens pour que chacun rencontre chacun.

Before the party

There are some useful tools in Debian:

apt-get install signing-party

Here is an example based on my participation to the keysigning-party of FOSDEM 2008

Importing keys: the organizer provided a file with all the keys exported

tar xzvf keys.tgz
for i in keys/*; do gpg --import $i;done

Preparing the given list of keys: the organizer provided a list such as in the examples provided here: /usr/share/doc/signing-party/gpgsigs/examples/. To prepare that file, compute its checksums and add the pictures when possible:

gpgsigs --latex 9ad7e3db ksp-fosdem2008.txt ksp-fosdem2008
latex ksp-fosdem2008
dvips ksp-fosdem2008.dvi
ps2pdf ksp-fosdem2008.ps > ksp-fosdem2008.pdf

Preparing a stock of our own fingerprints, in case of...

gpg-key2ps 9ad7e3db |ps2pdf - 9ad7e3db.pdf

But after all how was produced the list of fingerprints from the organizer? I created a script to generate such list: (proposed at Debian)

#!/bin/bash

# License: GPLv3
# Copyright Philippe Teuwen <phil a teuwen o org> 2008
if [[ $# -ne 5 ]]; then
    cat <<EOF
Usage: $0 input output datestring organizer title
Or:    $0 -     output datestring organizer title
       to read from STDIN
Example:
       echo 9AD7E3DB 54C12701 |\\
       $0 - ksp-file.txt "20080222 1100" "Philippe Teuwen <phil a teuwen o org>" "my party 08"
EOF
    exit 0
fi

input="$1"
[ "$input" == "-" ] && input="";
output="$2"
date="$3"
org="$4"
title=$(echo "$5"|tr a-z A-Z|sed 's/\(.\)/\1 /g')

exec > "$output"

# Date of event
LANG=C date --date="$date" +"%A, %B %e, %Y;  %H:%M"
# Organiser contact
printf "%80s\n\n\n" "$org"
# Title
printf "%*s\n\n" $(((72+$(echo "$title"|wc -c))/2)) "$title"
# Header
cat <<EOF
                     List of Participants  (v 1.0)


Here's what you have to do with this file:
(1) Print this file to paper.
(2) Compute this file's MD5 checksum and optionally also its SHA1 checksum.
   gpg --print-md md5  $output  (or use md5sum)
   gpg --print-md sha1 $output  (or use sha1sum)
(3) fill in the hash values on the printout.
(4) Bring the printout, a pen, and proof of identity to the keysigningparty (and be on time!).

MD5 Checksum:  __ __ __ __ __ __ __ __    __ __ __ __ __ __ __ __           [ ]



SHA1 Checksum: ____ ____ ____ ____ ____    ____ ____ ____ ____ ____         [ ]




EOF

k=0;
for i in $(cat $input); do 
    k=$(($k+1)); 
    printf "\n%03d  [ ] Fingerprint OK        [ ] ID OK\n" $k;
    gpg --fingerprint $i|grep -v "^sub";
done

At the party

Old notes...

Soient N personnes prêtes à signer
Ces personnes se numérotent de 0 à N-1

  for (i=0;i<N;i++)
  { x signe (N-x+i)%N }

Puisque l'on fait ça N fois et que chacun ne doit signer que N-1 personnes, chacun sera passif lors d'UNE des itérations, simplement celle pour laquelle l'algo lui dit: x signe x
Bref tout le monde est occupé (N-1/N) % du temps :-)

Physiquement on peut se disposer en double file comme ceci: (ceux mis sur les bords ne signent pas)

      |   i=0   |   i=1   |   i=2   |   i=3   |   i=4   |   i=5
  ----+---------+---------+---------+---------+---------+---------
      |   1 2   |   1 2   |   2 3   |   2 3   |   3 4   |
  N=5 | 0 | |   |   | | 3 | 1 | |   |   | | 4 | 2 | |   |
      |   4 3   |   0 4   |   0 4   |   1 0   |   1 0   |
  ----+---------+---------+---------+---------+---------+---------
      |   1 2   |  1 2 3  |   2 3   |  2 3 4  |   3 4   |  3 4 5
  N=6 | 0 | | 3 |  | | |  | 1 | | 4 |  | | |  | 2 | | 5 |  | | |
      |   5 4   |  0 5 4  |   0 5   |  1 0 5  |   1 0   |  2 1 0
  ----+---------+---------+---------+---------+---------+---------

Avantage de l'algo: lorsqu'on prépare les feuilles avec les fingerprints, on peut aussi préparer pour chacun l'ordre dans lequel il doit signer les autres:

#!/bin/bash
# argument: nbre total de personnes
N=$1
for ((x=0;x<N;x++)); do
   echo -n "$x signera dans l'ordre: "
   for ((i=0;i<N;i++)); do
      echo -n "$((($N-$x+$i)%$N)) "
   done
   echo ""
done

UPDATE: intéressant, lors du FOSDEM 2008 c'est en double-rang que l'on a effectivement progressé, avec 200 personnes sur la liste il y avait intéret à optimiser en effet ;-)

After the signing party

I clean the list ksp-fosdem2008.txt to keep only those I met.
I extract the fingerprints

cat ksp-fosdem2008-ok.txt |grep fingerprint|sed 's/^.*= //;s/ //g'> ksp-fosdem2008-finger.txt

I configure caff, the first time it creates a template in ~/.caffrc which was nearly ok, I let only my usual public key, told to encrypt also for that key, activated the default email template, chose agpg as signing gpg program and finally chose a public keyserver:

$CONFIG{'local-user'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'also-encrypt-to'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'gpg-sign'} = '/usr/bin/agpg';
$CONFIG{'keyserver'} = 'wwwkeys.pgp.net';

I could not get caff working until I finally copied ~/.gnupg/pubring.gpg and ~/.gnupg/trustdb.gpg to ~/.caff/gnupghome/ then everything worked including import of new keys from the keyserver.
Signing only:

caff --no-download --no-export-old --no-mail $(cat ksp-fosdem2008-finger.txt)
yes / save (check twice the uids as you could have forgotten to remove it in ksp-fosdem2008-ok.txt)

Sending emails:

caff --no-download --no-sign --no-export-old $(cat ksp-fosdem2008-finger.txt)

I got some undeliverable emails, some obviously being jabber ids, so I recovered the email content from ~/.caff/keys/2008-02-24 and sent it over jabber.

Short way for a professional signing-party using an internal keyserver:

#!/bin/bash

for i in $(cat <<EOF
98851B2B8B5B43104A25ECA1A6F4CF46E9A11073
56CFE246BB33A42F1142646EE9E8031D67147274
...
EOF) ; do
    gpg --recv-key $i;
    agpg -u nxp --sign-key $i;
    gpg --send-key $i;
done

In case you mistype your passphrase with quintuple-agent (agpg), you've to delete the stored passphrase before trying again:

q-client list
q-client delete 54C12701

You'll receive also the signatures of (some of) your peers by mail. If you use Enigmail, you can simply right-click on the attachment and choose "Import OpenPGP key", that's it!
Don't forget to retrieve also your key from the keyservers as some people push directly their signature instead of sending you a mail.

Check who has signed your key:

gpglist 9AD7E3DB

Later after the signing-party

A post of Philip on his blog highlighted the fact that a certain amount of people don't do their homework.

So I wrote a small script to see my own status:

#!/bin/bash

# Copyright: Philippe Teuwen <phil a teuwen o org>
# License:   GPLv2 or later
# This requires the gpglist and caff tools provided with signing-party package

##########################################################

# DATE is a globbing pattern for the folders in ~/.caff/keys
# Leave * to consider all mails you've sent through caff
DATE="2008*"

KEYID=

##########################################################

# If no keyid given, let's take the first one we find:
if [ "$KEYID" == "" ]; then
    KEYID=$(gpg --list-secret-keys|\
		awk '/^sec/{sub(/.*\//,"",$2);print $2;exit}')
fi
WHODIDSIGN=/tmp/who-did-sign-$$
WHODIDUPLOAD=/tmp/who-did-upload-$$

# Generating a temp list of those who signed my key
gpglist $KEYID |\
    sed '1,/^1/d;s/^[x ]\+//;s/ .*$//' \
    > $WHODIDSIGN

# Getting a list of those we've only unidirectional signatures on the keyservers
wget -q -O - "http://pgp.cs.uu.nl/mk_path.cgi?STAT=$KEYID&STATS=statistics"|\
    awk '
	/<\/UL>/ {b=0}
	/<LI>/ && b==1 {
	    match($0,/.*SMALL>(.*)<\/SMALL.*/,a);
	    print a[1]
	}
	/by this key/ {b=1}' \
    > $WHODIDUPLOAD

# Print some stats of nr I signed (via caff):
echo -n "==== Nr of people I signed: "
find ~/.caff/keys/$DATE/*.mail.1.* -type f|wc -l

echo "==== Those who didn't sign me in turn: (in red the leechers)"
# Generating list of those I signed (via caff) and substracting the first list
# Displaying results, in red those leechers who uploaded your sig on their key
# but were too lazy to do their homework to sign your key
find ~/.caff/keys/$DATE/*.mail.1.* -type f -exec basename {} \;|\
    grep -v -f $WHODIDSIGN|\
    sed 's/\.mail\.1\./ /'|\
    sort -k 2 |\
    grep --color=auto -C1000 -f $WHODIDUPLOAD

rm -f $WHODIDSIGN $WHODIDUPLOAD

Note that the script does not take into account the fact that some people came with several keys and already signed my key with one of their keys.

Here is a (cleaned) output, replacing the red flags by !! after Fosdem 2008:

==== Nr of people I signed: 85
==== Those who didn't sign me in turn: (in !! the leechers)
   99CBF9FDF4516C2D Adam Boardman
!! 28B5F4DD948F646C Adrien Kunysz (Krunch)
!! B7511409FC15DBEC Alexios Zavras (zvr)
!! 152865FB627CCF95 Bas Wijnen
!! 8F70629AC718D347 Bradley John Smith
!! 6FD13DDCD7CDE9E6 Bram Van Dam
   37E950505B625015 David Vuorio
!! 103CAA693891CD0B Guido Serra (GNU_Linux sysadmin, developer)
!! 9C19DB3C039ACDF0 Jose Maria Casanova Crespo (Chema)
   269CC0A1EEE120A2 Katharina Peter
   8D3867D89DDB992B Luca Capello
   C87C13316AA2C883 Machteld de Kok
!! 3C4DE8C0E4B48C48 Nanaea Geyer (Privat)
!! 85E7F6EC89789A18 Sebastian Noack
   3048C78B7984A4FD Toni Timonen
   9D9D7CE70BF3708E Xavier Lagorce

Short GnuPG reference card

Note on commands syntax:

keywords are written between <> and are supposed to be replaced by something meaningful...
optional items are written between []
some options have an alternative short notation, proposed behind a |, e.g. --decrypt|-d (choose only one syntax)

Setting a keyserver as default

Edit ~/.gnupg/gpg.conf:

keyserver  hkp://<my.best.keyserver.org>

If you do so you won't need to specify the keyserver manually anymore as option in the commands given in the next sections.

WinPT: "Keyserver" menu -> right-click somewhere in the white area -> "Add" -> HKP Keyserver, Hostname: <my.best.keyserver.org>, Port: 11371 -> "Add" -> Select your keyserver and press "Set default".

encrypting (and signing) a file

gpg [[--local-user|-u <yourself@foo.com>] --sign|-s]  # if you want to sign (opt with another key than your main key)
   [--armor|-a]                                      # if you want to armor (ASCII) the output, else it's binary
   --encrypt|-e 
   --recipient|-r <someone@foo.com> 
   [--encrypt-to <second_recipient@foo.com>]         # if you want other people to be able to decrypt as well
   [--encrypt-to <yourself@foo.com>]                 # if you want yourself to be able to decrypt as well
   [--output|-o <file.asc>]
   <file>

decrypting (and verifying) a file

gpg [--decrypt|-d]
   [--output|-o <file>]
   <file.asc>

So, yes, without any option gpg will decrypt/verify

searching a key on the keyserver

gpg --keyserver <my.best.keyserver.org>
   --search <someone>                              # search only on full words

From here you can directly import a key by providing its numeral (1, 2, 3...)

importing a key from the keyserver

gpg --keyserver <my.best.keyserver.org>
   --recv-key <key_id>                             # key-id is the last 8 bytes of the fingerprint

exporting a key to the keyserver

gpg --keyserver <my.best.keyserver.org>
   --send-key <key_id>                             # key-id is the last 8 bytes of the fingerprint

importing a key from a file

gpg  --import <pubkey.asc>

exporting your publickey to a file

gpg  --armor|-a --output|-o <yourpubkey.asc> --export <yourself@foo.com>

printing your fingerprint

(e.g. to put in your mails footers)

gpg --fingerprint <yourself>|grep -i fingerprint

printing the fingerprint of an exported keyfile

gpg --with-fingerprint <exported_keyfile>|grep -i fingerprint

signing a key

(see also below)

gpg --sign-key <someone>

Then you can upload it to the keyserver
WinPT: When signing, don't forget to un-check the "Sign local only" box otherwise your signature cannot be exported to the server.

trusting a key owner

How far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.)

gpg --edit-key <someone>
Command> trust

=> Choose the proper trust level

Command> quit

=> save changes Remember that trust is not exported and purely local

revoking a subkey or a UID

(old email address,...)

gpg --edit-key <yourself>

=> select UID(s) or subkey(s) by its numeral: 1, 2, 3...

Command> uid/key <n>
Command> revuid/revkey
Command> quit

=> save changes

Then you can upload it to the keyserver

extracting a session key

If you're forced to by a decryption order...

gpg --show-session-key --output|-o /dev/null <encrypted_file>

This will give you a long string: the session key
It can be used to decrypt that file

gpg --override-session-key <9:0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF>  <encrypted_file>

Creating fresh keys

Preferably RSA keys >= 2048 bits
E.g. create first a RSA key for signing only then add a RSA encryption key:

gpg --expert --gen-key
=> (5) RSA (sign only)
=> 2048 or bigger
=> validity: forever is ok
=> your name & email
=> choose a strong passphrase and be sure not to forget it!

gpg --edit-key <yourself>
Command> addkey
=> re-type your passphrase
=> (6) RSA (encrypt only)
=> 2048 or bigger
=> validity: forever is ok
Command> quit
=> save changes

Importing a secret key from PGP

If you've already a PGP key you can import it into GnuPG:
Under PGP, choose to export your key and ack to export also the secret key, tell where to put your ascii file, e.g. mykey.asc
With GnuPG, import the ascii file with the following command:

gpg --import --allow-secret-key-import < <mykey.asc>

Recovering a public key from a secret key

In case you destroyed your public key and cannot fetch it from the keyserver, you can reconstruct it:

gpg --export-secret-key <myname> | gpgsplit --no-split --secret-to-public |gpg import

Generating a revocation certificate

just in case...

Print it and keep it safe in case your key is compromised or you definitively forgot your passphrase:

gpg --gen-revoke <yourself>

Signing keys the right way

Signing keys involve more than a few GPG commands as it implies trust.
Get the public key of someone, either via keyserver or import file
Get the owner of the key in contact with you
Verify his identity (authenticate the owner)
Show him the fingerprint of his key from your computer (when you want to sign the soft will show you the fingerprint)
He must verify his fingerprint and make sure you are about to sign *his* key (the owner authenticates his key)
Sign the key, in an exportable way
Send the signed key to the server
Skipping the social aspect, a signature via gpg will look like:

gpg --keyserver <my.best.keyserver.org> --search <someone>
# either import interactively the key or find the key_id and get it:
gpg --keyserver <my.best.keyserver.org> --recv-key <key_id>
gpg --sign-key <key_id>
gpg --keyserver <my.best.keyserver.org> --send-key <key_id>

@@ Line 711: / Line 711: @@
 D9D7CE70BF3708E Xavier Lagorce
 </pre>
-==Short gpg reference card==
+==[[Short GnuPG reference card]]==
 Note on commands syntax: