I sometimes send email that includes an attachment named "signature.asc". This attachment contains a digital signature created by the GNU Privacy Guard (GPG).
The GNU Privacy Guard (GPG) is a software suite implementing public-key encryption and verification services. This kind of system is often (confusingly) called a PGP system. "PGP" stands for "Pretty Good Privacy". The letters still occur at the beginning of the standard format for a public key:
-----BEGIN PGP PUBLIC KEY BLOCK-----There was at one time a fairly famous free software program called PGP, created by Phillip Zimmerman. It is no longer maintained. GPG is a successor, also free, which implements the same functionality and is (at least for now) being maintained. It is also distributed with a number of free Unix/Linux systems, including Red Hat/Fedora.
The official GPG Website has an excellent introduction to what this means. Here is a brief summary.
If you already know what GPG is, skip directly to my GPG key info.
What does it do?
GPG provides the following basic functions:- Encrypt messages between two parties without the need to agree on external data such as a password.
- Verify that a message was sent by the person who claims to have sent it.
How does it work?
In a public-key system such as that implemented by GPG, each person has a special file they keep on their computer known as their "private key". This file is password-protected and should not be accessible to or known to anyone but the person who owns it. Each private key has associated with it a "public key", which can be distributed to anyone with whom the key's owner wants to communicate.
To illustrate the process, we will use Bob and Alice as examples.
Encrypting a Message
To send an encrypted message (such as an email) to Bob, Alice needs to obtain his public key, which she gets by visting his web site or a punlic key server such as the MIT public key server. She then encodes his message using his public key, and sends it to him by email. Only someone with Bob's privatye key can decode the message. Since Bob is the only person who has access to this key on his computer, he is the only person who will be able to read the message.
Verifying/Authenticating a Message
Now suppose Alice is sending Bob an unencrypted message but she wishes him to be able to verify that the message is truly from her and was not tampered with in transit. Perhaps it contains binary code for a computer program and it is important that there be no viruses stowing away in this code. To do this Alice produces what is known as a "hash" or a "digest" of the message - basically, a large number calculated from the message contents. The crucial property of the hashing algorithm is that the slightest change in the message contents produces a very different numerical result. Alice then encrypts the hash number using her private key. This is the signature, sent along with the message, for example, in a separate file called something like "signature.asc".
Messages encoded with Alice's public key can only be decoded with her private key. Symmetrically, messages encoded with her private key can only be decoded with with her public key. So when Bob receives Alice's signed message he decodes the signature file using Alice's public key and gets a numerical result that should be the hash of the email message's contents. He then checks that hash by running the same hashing algorithm on the message to see if he gets the same result. Only a signature file produced with Alice's private key -- which only Alice has --- using EXACTLY the same email message will create this match. [That's oversimplifying a little: Better to say: It is wildly improbable that anything but Alice's key and THIS message produced this match.]
My GPG Info
- PGP Public key
- PGP key + photo (Same key and fingerprint but with photo incorporated into the ASCII)
- Key Fingerprint: 1330 DA57 C420 D3FD 3457 5795 CE91 4E0F 5F79 1E7A
The GPG handbook recommends you verify the authenticity of every key you receive with its owner. Of course, the whole system breaks down if the key Bob thinks belongs to Alice is actually a fake planted on the internet by evil eavesdropping Eve. Call me or email me, and ask me to verify the key you have downloaded. I will confirm the "fingerprint" on the key you have is correct. Needless to say, the mere fact that you know that the picture on your picture version of the key is a picture of me is not much of a guarantee of authenticity.