Wednesday, March 13, 2013

How to Set Up Public Key Cryptography

Cryptography refers to the mathematical and technological techniques for keeping information secret. What’s wonderful is that we’re now at the point where very powerful cryptography is available to everyone, for free. But it still takes an investment to educate yourself and get set up. Why might you want to set up cryptography on your computer?

- For sending emails secure from snoopers enroute. Not only Google and the NSA but many other parties could potentially read your emails in transit or when stored on your computer - I have heard the level of security compared to that of a postcard.
- For transmitting files to other people that you don’t want intercepted or scanned en route.
- For keeping files secret on your own hard drive, in case of shared users of the computer.

There are a lot of approaches to cryptography that require sharing a secret password with another person, but that can be tough - obviously you can’t use email to exchange the passwords, and it’s not always possible to meet in person. Therefore I’m going to advocate an approach called public key cryptography, and show you how to set it up on the Mac, the PC, and an Android phone.

I suggest starting by reading a little background on public key cryptography on Wikipedia and on the PGP website.

But in a nutshell, public key cryptography involves the creation of two strings of data, called keys, one which you keep secret and one which doesn't have to be kept secret: you can give it to your friends, colleagues, post it publicly on the internet, etc. People use your "public key" to encrypt files or emails before they send them to you, and then you decrypt the files using your "secret key". The way I think about it is that it gives you a magical locked box, with a slot in the top that anyone can drop something into. But no one can get things out, except for you, who possesses the magic secret key.

You already use public key cryptography every day, every time you use a banking or email website which has a little picture of a lock in the corner of your browser beside the URL bar. But for a long time it was out of reach for personal use unless you were an expert. It turns out that it’s a little easier now, thanks to a set of software called Gnu Privacy Guard (GPG), which is available for both the Mac and the PC, and in fact produces encrypted files that are compatible between both. (you will also see the related terms PGP and OpenPGP thrown around - for my purposes it's good enough to call the technology GPG)

Besides the ease of use, why choose GPG? It is both open source and popular, which is a winning combination for security software. Open source means the guts of the program, the source code, are available for anyone to inspect. That creates a real disincentive for putting in sneaky code that could steal your data or compromise your privacy in other ways, because they're likely to get caught by people auditing the code. It should nearly always make you trust a program more. And, the fact that GPG open source allows security experts around the world to check the code make sure the authors haven't made any mistakes that would compromise security, and even contribute quick fixes themselves. Finally, the fact that it's popular means people actually care enough to do so. My understanding is that GPG is the strongest, most trustworthy cryptography available for any amount of money - and  it's free.

A note about passphrases. The passphrase is the string of characters that protects your secret key as it sits on your hard drive. Really it's exactly the same as a password, except it's supposed to be longer. The reason being, people with physical access to your hard drive and some time and computational resources can presently break passwords of 12 characters or more (according to wikipedia), and much more easily if it isn't truly random (i.e. if you use words that are in the dictionary, or even the slight variations that are often recommended online) And once your private key is cracked, it can be more serious than a password for an email account or the like: all the files you've encrypted in the past are now vulnerable to be read. The problem is that if you plan to decrypt files more than once in a long while, a long passphrase is hard to type, and very hard to remember. You'd probably end up writing it down physically, or using some kind of password manager (like the mac's built-in Keychain), which can pose its own security risks (for example there’s not much point if it’s shorter than the passphrase).

My take is that as long as you keep your secret key only on your hard drive, a medium-strength passphrase provides excellent protection against snooping on files and emails en-route. It unlocks the much, much longer and more random key that protects your file as it flies across the internet. Only someone with access to your hard drive can attack the passphrase, and as long as the choice of passphrase isn't completely dumb, it would take at least some expertise to crack it even then. So I suggest for this particular medium-to-low-security purpose, using the type of password you use for your regular accounts (though not the same one!).

I’m going to focus on how to get set up to exchange encrypted files - a later entry will talk about setting up email. On each platform I describe how to do the following steps:
1. Install the software.
2. Create your public and secret keys.
3. Send your public key to your friend (so they can encrypt things for you to open).
4. Install your friend’s public key (so you can encrypt things for your friend to open).

FOR THE MAC

1. Download the installer and install gpgtools.
2. Once installed, it will pop up the GPG keychain access application, and ask you to create a key. Enter the passphrase you came up with.
3. When the key is generated, select it from the list and choose File -> export. Binary or ascii should both be fine. Make sure "Allow secret key" is unchecked. Then email your friend the file that's created, which is your public key.
4. Import your friend’s public key. Go to File -> Import, and choose the file that they sent you, e.g. by email

FOR THE PC

1. Download and install Gpg4win. At the step where it says “Define trustable root certificates”, check “Root certificate defined or skip configuration”
2. Launch Kleopatra (the key manager). Choose File -> New Certificate... and choose "Create a personal OpenPGP key pair”. Enter your name and email address and click Next then click Create Key. Enter the passphrase you came up with.
3. Try Send Certificate By Email... to send me the public key. If that doesn't work (because there isn't an official email program set up), click Finish. Choose File -> Export certificates, and save the resulting .asc file somewhere. Email that .asc file to me as an attachment.
4. Import your friend’s public key, which they sent e.g. as an email attachment, which you have saved to your hard drive. Open Kleopatra (the GPG key management program) and go to File -> Import Certificate, and choose that file. More here: http://www.gpg4win.org/doc/en/gpg4win-compendium_15.html

FOR ANDROID

This one is trickier. The thing is that you can't directly create a public key/private key pair on an android, so you have to create it on a Mac or PC first and then import it to your android. (you probably  want to use the same key for your desktop computer and your phone)
1. Install the app APG, for Android Privacy Guard.
2. To add your own secret key to your android:
- Create your keys on the PC or Mac using step 2 described above.
- Export the keys, in such a way that you export the private key as well. On the mac, the option is called "Allow secret key export".
- Move this file to your Android phone. Take care with it! Don't email it anywhere! Delete it securely!
- Launch APG, and open the options menu (vertical ellipsis in the corner). Choose Manage Secret Keys.
- Hit options menu again, and choose Import Keys. Select the key file you moved onto the android, also checking the box Delete After Import.
3. Follow step 3 from the mac or PC versions to send the public key you created on your computer to your friend. This time, make sure “Allow secret key export” is unchecked!
4. To add your friend’s public key, first move it onto your phone as in step 2 launch APG, and open the options menu. Choose Manage Secret Keys, hit options menu again, and choose Import Keys, then find it on your hard drive.

To decrypt a file on the Android, go into APG, press the Decrypt File button, and choose the file to decrypt. You may need to have an app installed like File Manager if you can't type in the full path from memory. Click Decrypt. You’ll be asked to enter your secret key passphrase. This is where you find out how hard it is to type on an Android keyboard! Another wrinkle to the passphrase complexity tradeoff.

The result is that the decrypted file is saved to a directory of your choice, by default the APG directory.

Now you're ready to encryp files on your hard drive.

No comments: