PGP Encryption for Beginners. PART I - introduction.
Version 1.0 | author: the saint - sainty@euroseek.com
http://blacksun.box.sk


 ###########         #                   ###             #########      ##     # 
 ############       ###                 #####           ###  #####     ###     ##
 #####    ####     #####               #######         ###    ###     ####    ###
 #####    #####   #######             #########       ###      #      ####  ####
  ####   #####    #######            ###########     ###               ### ####
   #########      #######           ####     ####    ###               #######  
    ###########    #####           #####     #####    ###     ##      ####### 
   #############    ###   ##      ######  #########    ###   ####     #########
  ######     ####    #   ####      ########  #####      ##  ######     ###   ###
 ######     ####     ##########     ####     ####        #########     ###  #####
 #####     ####       ##########     ###     ###          #######     ####  ######
 #############         ##########     ##     ##            #####      ####   ####
 ###########            ########      ##     ##             ###        ###    ##

   #######       #     #        #     #
  ##########    ##     ##      ##     ##            
 ###    ###     ##     ##     ###     ###                                         
  ###    #     ###     ###   #####    ####           Black Sun Research Facility  
    ###         ##     ##    ######   ####             http://blacksun.box.sk     
      ###       ##     ##    #######  ####                 ASCII By : cyRu5       
   #   ###     ###     ###   ####  #######         
  ###  ####   ####     ####   ###   #####               
 ###########   ###########     ##    ###
  #########      #######        #     #


This tutorial covers the following subjects: what is pgp? Introduction to cryptography. Main types of cryptography. How does cryptography work? Conventional cryptography. Public Key Cryptography (First Look).
What is PGP?

But first, let's start with this: why the hell would you want to encrypt your data anyway?
Well, duh!! Suppose someone breaks into your computer. Instead of being able to grab all of your credit card numbers, passwords etc', he will only get encrypted garbage, which will mean nothing to him, and will be quite hard to break.
Suppose you're not the only one using your computer. Would you risk putting your private information wide-open to strangers and maybe even malicious users? I wouldn't.
I hope you get my drift. Now, let's move on.

PGP (Pretty Good Privacy) - is a system, which combines features of both conventional and public key cryptography. (The keys we will discuss later in this topic) and is sometimes called hybrid cryptosystem.
Introduction to Cryptography

At first, I would like to introduce you to some new words, which will be widely used in this tutorial:
1. Plain text/clear text - it is data, which can be read and easily understood, without any special measures. (In example - this tutorial is written in plain text).
2. Encryption - the way of changing plain text so it would change the form of it, without losing data and it is intended to "hide data" from "evil ones". 
3. Ciphertext - is the result of encryption - some garbage at first sight. (One of the meanings is "an obsolete name for zero).
4. Decryption - it is a method to convert readable data from Ciphertext.
5. Cryptography - a science to encrypt / decrypt data.
6. Cryptanalysis - a science to break encrypted data, using various tools and techniques.
7. Attackers - widely spread meaning of cryptanalysists.
8. Cryptology -  combines both cryptography and Cryptanalysis
9. Cipher - cryptographic algorithm, mathematical function used in cryptographic processes. 

Here is logical chain of all this process:

PLAINTEXT --> ENCRYPTION --> CIPHERTEXT --> DECRYPTION --> PLAINTEXT

Cryptography actually is a mathematical science. It uses mathematics to encrypt / decrypt data to store it or transfer via non secure networks (internet for example, but it could be any other time of network, even not electronic type) to assure that information reaches only dedicated persons / individuals. 

Main types of Cryptography

The main types of cryptography are weak and strong. The strength of cryptography is measured in the time and resources you need to get plain text. To the moment this tutorial was written all computers in the world, even if they were just breaking a strong key, wouldn't accomplish such task. But you never know - tomorrow can bring much more computer power and actually somebody may have find mathematical solution to decryption without knowing the right key. 
How does Cryptography work?

A cipher uses some phrase/ word/ numbers and other data bits to encrypt data (plain text). Different keys produce different Ciphertext, of course. So the strength of encrypted data relies on two factors - the strength of cipher and a key. Therefore it is very advisable to choose the key very carefully and to keep it secure (best solution is to put it into a brain-cell, if possible:)). All those components mentioned above build a cryptosystem (like PGP).
Conventional Cryptography

This type of encryption uses only one to encrypt and decrypt data (plaintext). The example of it could be DES (The Data Encryption Standard) which is widely used Federal Government. Conventional Cryptography has both pluses and minuses. At first - it is very fast and suitable for data, which won't be used by anyone except the person, who encrypted it. That is - the secure key distribution is very difficult task to accomplish: you need to agree with a key beforehand, which is very impractical nowadays, because you cannot trust phone companies, couriers, e-mail and internet services. Here arises a question: how do you get the key to the recipient without someone intercepting it? The answer for that today might be:

Public Key Cryptography (first look).

Which solves the secure key distribution problem. Whitefield Diffie and Martin Helman introduced the concept of Public Key Cryptography in 1975. Also there are some rumours that British Secret Service it invented few years before, but kept in secret and did nothing with it. 
Public key Cryptography is asymmetric system and uses two keys (a pair): a public key, used for encryption and a private key, used for decryption. The public key is published worldwide and the personal is kept in secret. Anyone and everyone can encrypt data with your public key, but only you (or to be more exact the person who has your public key) can decrypt Ciphertext. 


PART II  - Second look...
..to PGP

One of the most popular cryptosystems is PGP  - Pretty Good Privacy. As it was mentioned above - PGP is mixed cryptosystem - that is - it combines both conventional and public key cryptography. PGP operates in such way:

A) Encryption:


1) First, PGP compresses plaintext. It is useful for several reasons: you need less space on hard disk. smaller message means saving time (and money), when sending it via internet, and increases the strength of encryption, because in compressed data there is less patterns than in plaintext and the patterns are used widely by various cryptanalisists to break cipher..
2) PGP then generated one-time-only secret key, which is sometimes called - session key. It is random number, generated from the random data, based on the movements of the mouse and the keystrokes and/or data, based on the noise of the CPU. Very fast and secure symmetric encryption algorithm uses this one-time-only secret key to encrypt data and that produces Ciphertext. 
3) After encryption of the data, the session key is then encrypted to the recipient's public key and both public key - encrypted session key and Ciphertext are transmitted.

A) Decryption:

1) PGP uses recipient's private key to recover the session key.
2) The session key is used to decrypt conventionally encrypted Ciphertext.
3) Extracting compressed data, of course.

The combinations of conventional and public keys provide cryptography with very fast and secure encryption system. This is achieved by the speed of conventional algorithms and safety of public key.

A few words about the keys...

A key is some value, which is used by cryptographic algorithm to produce cyphertext. In fact - keys are huge numbers. The size of the key is measured in bits, the bigger the key, the more secure the Ciphertext. The comparison of conventional and public key sizes is rather puzzling - conventional 128-bit key is the same strength as 3000-bit public key. The thing is, that you can't compare those types of the key, because of the specific algorithms, used for each type of cryptography. (you can't compare trains and brains, can you?). 
To gain as much security as you can - always pick the biggest-size keys, for that reason, that given enough time and resources - it is always possibility to get private key exploited. 
Keys are stored in encrypted form. Typically you use two keyrings (files on hard disk) - one for public keys and other for private. Don't lose private key ring, because all information, which was encrypted to keys on that ring , will never be used (if you won't compromise the cipher, of course). 

..And about digital signatures

As written signatures - digital signatures provide authentication of the information's origin. Usually this feature of cryptography is much more widely used than encryption. The digital signature is 'impossible' to fake. In short - when you are dealing with this type of signature - you can mostly always be sure you are dealing with the right person (in the sense of authentication, of course). 
The digital signature works this way: 
1) The plaintext gets encrypted with your private key.
2) If the information can be decrypted with the public key of the yours - then that information comes from you.

This process of signing is slow and produces a to of data, which is not required to verify you signature. Here comes the -
Hash function

Which increases the performance of signing. This function takes message of any text and produces fixed - length output. The mathematical side of this function ensures that even if the data differs very slightly - you get entirely different output.(known as message digest). The private key and the digest are used to generated signature, which is then transmitted along with plaintext. The hash function ensures, that no one can take signature and use it as his own, because in such a case fails verification.
The digital signatures are the main way to verify the validation of the public key.

Digital certificates

Of course, when you use public key crytposystem you want to be sure you are encrypting to the right person' key. So here comes the problem of the trust. Let's say - someone posts a fake key with a name of the person, whom you are writing to. When you encrypt the data and send it to "recipient" - data goes to the wrong person. In a public key environment, it is very important that you are assured you are using the public key of the intended recipient. One way out is to encrypt only to those keys, the owner of which has handed them to you personally (in a floppy disk, for example). But this way is very inconvenient - first, sometimes you even don't know the recipient and the second, but not the last - what would you do if you need to send some data to a person, who is not available physically - in the plane or anywhere else this moment? Send a pigeon with a note?
Certs - digital certificates simplify this task of finding the correct key. Cert. is data that you can use in such way like a normal physical certificate. This information is included with a person's public key to provide help to verifying the validity of the key. Certs are used to prevent people substituting one person's key for another. 
A digital certificate consists of:
1) a public key;
2) certificate information (some information about the user: name, ID and so on);
3) not less than one digital signatures.

The digital signature on a certificate shows that some person approves certificate information. The digital signature does  not attest to the authenticity of the certificate as a whole; it vouches only that the signed identity goes along with the public key. In short - a certificate is a public key with several  forms o ID attached, and approval from some other trusted individual. Most of digital certificate benefits you get, when it is necessary to exchange public keys with someone else and it is impossible to do manually. Manual public key distribution has its  advantages, but is useful only to a point. sometimes it is necessary to put everything in one place - storage, exchange of public key for anyone, who needs it. Systems, who store such data are called Certificate Servers and systems, which provide some additional key management features are called Public Key Infrastructures.
Certificate server (aka cert. server / key server) - it's nothing more than a database that allows users to submit and retrieve digital certificates. Such server can and usually does provide some administrative features. These features enable a company to maintain its security policies and so on.
A Public Key Infrastructure contains the same the certificate storage facilities of a certificate server, but also provides certificate management facilities - the ability to issue, revoke, store, retrieve and trust certificates. PKI introduces Certification Authority  (CA), which is human entity, which has authorisation to issue certificates for some company's computer  users. A CA creates certificates and digitally signs them, using CA's private key. If you trust CA, you  can almost always trust the holder of their certificate.

Certificate formats

A digital certificate is a collection of some identifying information imbedded together with a public key and sign by someone you can trust to prove its  authenticity. If we talk about PGP - it recognises two different certificate formats:
1) PGP certificates;
2) X.509 certificates.

A PGP certificate consists of:
1) the PGP version number, which identifies the version of PGP program, which was used to create the associated key.
2) The certificate holder's public key together with the algorithm of the key, which can be: RSA, DH or DSA
3) The certificate validity period , which indicated when the certificate will expire;
4) The symmetric encryption algorithm for the key. This information indicates encryption algorithm to which the certificate owner prefers to have information encrypted. These algorithms are: CAST, IDEA or Triple-DES.

Validity and trust

Validity is confidence that something belongs to its real owner. Like public key, or certificate, for example. Validity is very important in public key systems where you must know if the certificate is authentic or not. 
When you are sure that some certificate belongs to someone, you can sign the copy on your key ring to attest to the fact that you've checked the certificate and that it is an authentic one. If you export the signature to a certificate server - others will know that you approved it. To believe someone, who has signed approval of any certificate - you need trust him.
You can check validity by meeting the to be recipient and taking the key from him physically. The other way is to use fingerprints. Pgp fingerprint is a hash of certificate, all fingerprints are unique. It can appear as hexadecimal number or a series of biometrics words, which a phonetically distinct. When you have fingerprints and know the voice of the owner - you can just call him and ask to read his. But sometimes, you don't know the voice - on such occurrences you need to trust some third party, like a CA.
But don't forget that - unless the owner of the key handles you it - you must trust on some third party that this key is valid. And know we'll cover a few more topics in this part:

Passwords and passphrases 

Almost everyday, when you are using computers you need to enter a secret combination of characters - a password, to access some information. so you should be familiar with it. if not - oops, but you have been reading the wrong tutorial. 
A passphrase is a longer version of a password, it is supposed to be more secure one. Passphrase helps you to be more secured against dictionary attacks (compromising the PGP will be covered in Part III - compromising the PGP). The best passphrases are relatively long and complex, contains various characters. PGP uses a passphrase to encrypt your private key on your disk using a hash of you passphrase as the secret key. You use the passphrase to decrypt and use your private key. A
passphrase should be hard for you to forget and difficult for others to guess. It
should be something already firmly embedded in your long-term memory,
rather than something you make up from scratch. Because if you forget it your private key is totally useless without your passphrase and nothing can be done about it. (if you won't break it, who knows?)