Public Key Encryption

Arne Hintz — Fri, 04 Mar 2016 09:08:48 +0000

Purpose:

The GNU Privacy Guard (GPG) logo.

Pretty Good Privacy (PGP) and GNU Privacy Guard (GPG) are both public key encryption cryptographic software used to authenticate the identity of people sending messages and to encrypt and decrypt email messages and documents. The key difference between the two is that PGP is paid-license software owned by Symantec. Whereas GPG uses a GNU General Public License, meaning that the code can be modified, used and distributed free of charge. PGP and GPG are both OpenPGP compliant [OPP01] implementing the Internet Engineering Task Force (IETF) approved standard for encryption technologies [IET01] thus ensuring that they are interoperable with each other so that a message sent by one can be read by the other.

Another implementation for email encryption includes S/MIME (Secure/Multipurpose Internet Mail Extensions). It is an alternative to PGP/GPG used mostly by businesses that use large corporate computing infrastructures such as IBM, Microsoft and other vendors that offer commercial email packages and web browser software. It differs from PGP/GPG in that it does not exchange personal keys but relies upon the use of a common certifier that they both use [DFB01].

The aim of all of these is to enhance privacy by enabling people to sign, encrypt and decrypt electronic data, protecting the content of emails to ensure that third parties cannot read email communications.

Software applications

Software that utilise public key encryption include:

TrueCrypt – a discontinued freeware utility used to create a hidden encrypted virtual disk within an operating system such as Windows, Mac OS, and Linux. In this way it is not a protocol for sending secure email over the network, rather, it is a method for encrypting documents on a computer that remain there or are then sent through email. It uses on-the-fly encryption (OTFE) where data is automatically encrypted as it is saved on a hard drive.
LEAP – a free, open source email encryption system that works by providing a local proxy that a standard email client connects to [FPF01]. Rather than people maintaining the own encryption keys, a proxy service provider automatically encrypts email sent through it. In addition, if people do have their own public keys these will automatically be discovered and validated so that only that person will be able to read the email [LAP01]. It is less secure than having one’s own key as the service provider has access to both the metadata and forwarding information [FPF01]. The system is meant to be usable, hence, with usability, comes a certain amount of insecurity in this case by allowing for encryption access in a ‘user-friendly’ manner using a BitMask application [LAP01]. It has created new protocols [LAP02]: Soledad (server daemon), Bonafide (secure user registration, authentication, and provider discovery), and Key Management (new rules for validation) [LAP03].
Mailpile – a front-end email client that uses a webmail interface to provide encryption by default [MPE01]. It downloads all email from an email server onto the computer with an option to run it on a cloud service. Even if the email server used is a commercial product like Gmail or Yahoo the contents of emails would still be stored there, however, it would be encrypted [MPE01].
Enigmail – an extension used in the email client Mozilla Thunderbird and SeaMonkey that uses OpenPGP public key e-mail encryption and digital signatures. It requires users to first set up their own GPG or PGP keys. After installation Enigmail integrates digital signing and encryption of email directly from the Thunderbird email client in a user-friendly manner.

Capabilities:

Public-key cryptography – used in PGP/GPG and S/MIME and is an asymmetric cryptographic protocol that requires two separate keys, one private for decrypting emails and one public used for encrypting or digitally signing messages.
Digital certificate – used by S/MIME these are issued to organisations and individuals by trusted certificate authorities. These are downloaded and then added to an email client. The certificate is then used to make secure connections [TRP01].
Digital signature – used by PGP/GPG it serves as a digital signature that authenticates the signer of a message as actually being that person or entity [GLO01].

Surveillance mitigation:

Privacy – enables private digital communications so that messages cannot be read by third parties. The difference between plaintext and ciphertext has been compared to the postcard and the letter, where plaintext is more like a postcard that anyone can read and ciphertext is akin to placing a message in a sealed envelope. This has been called the ‘analog gap’ [MPE02].

Vulnerabilities:

Usability – PGP/GPG has been criticized for its lack of general usability [CEB01] however there are tools currently available and under development (described above) that seek to address this issue.
Security – Public keys may be decoded allowing access to messages. For example, the GCHQ/NSA programme BULLRUN that aims to break encryption tools.
Attribution – a digital signature provides proof of authorship, which may be used to provide legal proof of a person’s communications and activities.

Layer of interaction:

Application layer: Simple Mail Transfer Protocol (SMTP)
Transport layer: Transport layer security (TLS)

Background:

Cryptography in its early days were managed and researched within government’s departments of defence in order to protect state secrets and to ensure secure communication across international borders. A non-secret technology known as public key encryption appeared in the 1970s using RSA [CAC01] and resulted in the emergence of the CryptoWars, an attempt by the U.S. government to limit the public and foreign countries from accessing cryptography strong enough to resist decryption by U.S. national intelligence agencies [OPN01].

The Snowden revelations have shown that the CryptoWars are not over [OPN01] in particular with the BULLRUN programme, which seeks to break encryption tools [EFF01].