Pretty Good Privacy Privacy Enhancing Technologies Leonardo A. - PowerPoint PPT Presentation

Pretty Good Privacy Privacy Enhancing Technologies Leonardo A. Martucci CC-BY-4.0

Part 2: Secure Communications • Why do we need secure communications? • PGP We are here! • TLS and Let's Encrypt • Secure messaging

Pretty Good Privacy (PGP) • Security tool for confidentiality integrity authentication

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random (symmetric) key

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random (symmetric) key hash( )

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key generate random Enc( ) using = (symmetric) key Sign( ) using = hash( )

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key Dec( ) using = Dec( ) using =

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key hash( ) equal?( ) Dec( ) using = Ver( ) using = Dec( ) using =

How does PGP work? • with public key and symmetric key encryption + hashing private key private key public key public key ???

Public Key Distribution: Web of Trust trust Sign( ) Sign( ) is trusted by is trusted by

Public Key Distribution: Web of Trust trust Sign( ) Sign( ) is trusted by is trusted by

Public Key Distribution: Web of Trust trust trust Web of Trust

PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) with ssh-keygen • 1st: generate a key pair e.g. ssh-keygen -t rsa -b 4096 • 2nd: upload to a public repository e.g. the MIT PGP Public Key Server

PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 3rd: Build your web of trust or look into the repository for keys

PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 4th: start encrypting and signing suggestion: with the support of an your emails! email client extension e.g. Enigmail enigmail toolbar

PGP in the Real World • Exchanging encrypted email with OpenPGP (RFC 4880) • 5th: receiving emails suggestion: with the support of an email client extension e.g. Enigmail

https://www.xkcd.com/1181/

The Caveats old (from the 90’s) not really usable • PGP is keys are really long no key management no forward secrecy * https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/

Part 2: Secure Communications • Why do we need secure communications? • PGP • TLS and Let's Encrypt next session • Secure messaging