Public Key Encryption in a nutshell
I have been noticed lot of people lately who are using storing or transferring sensitive data (such as bank information) with no encryption or security what so ever. Anyone with a simple packet sniffer can catch the data when being transferred or if they have any sort of access to your physical machine they can read it. No wonder why so many people are getting their identity stolen. This is a very simple guide on how to use Public Key Encryption (when sending to other people or simply keeping it encrypted at home). This guide is mainly for the person who has no idea what public key encryption is, but if you want to read it regardless go right ahead.
Think of encryption as a safe box that has a key to lock it and unlock it. In traditional encryption methods, there used to be only one key. The encryption software takes in your data file and your key, and outputs a encrypted file. Once encrypted, no one can read this by simply opening it in a text editor since the data is encrypted or scrambled. This is like putting the data in a safe box and locking it, no one has access except for you. Now to get the data file back, you put the key and the encrypted file into the encryption software you are using and it outputs the data (just like opening a safe box with the key).
Data — [key] —> EncryptedData —[key] —> Data
The only problem with this method is anyone with the key can decrypt it and read it. Unpractical to use online since the key has to be transferred to the other end of the communication as well, and if someone steals the key while being transferred, all the data that’s being encrypted will also be compromised. Public Key Encryption solves this problem by using two keys instead of one.
When you first start using a public key encryption system, the software program you choose to use will generate a key pair for you. The two files that are created are called the public key and the private key. You give the public key to everyone else and the public, and keep the private key securely with you. Public key encryption works similar to a safe box as well, except it has two keys. One key can only lock it, and the other key can only open it. Each key pair is related to each other, as the public key is derived from the private key (but the private key cannot be derived from the public key). The Math Behind it
PrivateKey —Oneway—> PublicKey
Data —[PublicKey]—> EncryptedData —[PrivateKey]—> Data
So you give the public key to everyone, and they can encrypt the data using the public key and send it to you. Once they encrypt using your public key, no one can decrypt it except for the one who has the private key which corresponds to the public key that was used.
Most encryption software also takes use of a passphrase, which is used to encrypt and decrypt the private key stored in your computer. Most all encrytion software suites will prompt you for your passphrase before decrypting anything. This way, only you who know the passphrase can decrypt the data and if your physical computer gets compromised the private key will not be able to be used without the passphrase.
Don’t ever write your passphrase down, and don’t keep multiple copies of your private key laying around. It’s a good idea to keep a back up of your private key somewhere extremely safe (bury it somewhere remote? Bank safe) since if you lose your private key you will not be able to generate it again and all your encrypted data will be unreadable by anyone. If you start relying on Public Key Encryption heavily, it’s a good idea to keep one copy with you, one in a safe place, and another copy broken down and spread out across several trusted persons (example: ten out of the thirteen pieces given out should be present to create the full private key again, this good if you think that you might die of something and the other people can collectively recreate the key and recover your data, you never know, Google for tools like this there are several open source ones out there).
PGP (Pretty Good Privacy) is the standard encryption method considered secure these days. You can obtain software from either pgp.com or if you like to use a more open source approach GnuPG which is what I use. For GnuPG there are several front ends, specifically kgpg and seahorse and evolution email client has built in support for GnuPG. Most other email clients (Outlook, Thunderbird) have plug-ins which enables you to encrypt and decrypt data on the fly.
I will also touch very lightly on digital signatures using Public Key Encryption. Digital signatures can verify that the message sent was not modified in transit and the message did come from the person who they claim to be. How it works is quite simple. The sender takes the data which is about to be sent, hashes it (give the data a unique fingerprint, a much smaller size than the actual data), then encrypt the hash using one of the parts of the private key and attach that to the bottom of the data. (Example signature at the bottom of this post).
Data —[Hasher]—> DataHash —[PrivateKey]—> Signature
Now that we have a signature to go along with the data, both of those are sent together. The receiver (who has your public key) will do the following.
Data —[Hasher]—> DataHash
Signature —[Public Key]—> DataHash
The receiver compares the two values, if they match that means the message is authentic and was sent by the person who public key belongs to.
That pretty much covers the basic of Public Key Encryption. If you are sending important messages back and forth, at least take your time to digitally sign the emails (although the receiver might not care or have no time to check it). This way in the future if some sort of legal issue comes up, and the receiver of email you sent earlier changed the content of the email and are using it as evidence, you can counter their argument by showing that the signature does not match. Its proof that you sent the mail. There are many other advantages to Public Key Encryption which you can use your favorite search engine to search for. Better be safe than sorry.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQBDMJQTCGo7xHppuyQRAnqfAJ4puIciLuvS5abkkY/8ksJNTfez2QCaAx66
UR7SqUyYlY4K7eZLy7XT3rU=
=nO2W
—–END PGP SIGNATURE—–