Question

Read the Pretty_Good_Privacy article.

provide answers to the following questions:

a) describe the private key files

b) describe the function of GPG

c) what is a cryptographic algorithm?

d) What are the different categories? What are the common ones?

e) What is a key ring (secring.pgp & pubring.pgp)? (for this question, refer to the PPT

lecture)

Answer 1

(a) Ans- The private key file is file that is used for encryption or decryption of data sent between your server and the connecting client for secure communications. A private key is generated when if two organization will communicate(SSL) with each other with some conditions. So there is so many confidential things that should be hack if they will communicate, for this there is certification signing will happen before communication. A private key is created by you—the certificate owner—when you request your certificate with a Certificate Signing Request (CSR). The Certificate Authority providing your certificate. Private key file is very confidentials for server and client because when they will try to communicate with each other they have to mention the primary key file.

(b) Ans- GPG( GNU Privacy Guard ) is free encryption software that's compliant with the OpenPGP standard. Using GPG you can encrypt (and decrypt) files that contain sensitive data, such as protected health information (PHI) regulated by the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules.

GPG has various functions some are-

(i) With GPG we can create of encryption key.

(ii) Encrypt a file

(iii) Decrypt a file.

(c) Ans- In simple way we can say that Cryptography is techniques for securing communication and data in the presence of adversaries(Internet).

there are 5 most popular algorithms are there-

(i) Tripl DES: -

Triple DES was designed to replace the original Data Encryption Standard (DES) algorithm, which hackers eventually learned to defeat with relative ease. At one time, Triple DES was the recommended standard and the most widely used symmetric algorithm in the industry.

Triple DES uses three individual keys with 56 bits each. The total key length adds up to 168 bits, but experts would argue that 112-bits in key strength is more like it.

(ii) RSA: -

RSA is a public-key encryption algorithm and the standard for encrypting data sent over the internet. It also happens to be one of the methods used in our PGP and GPG programs. Unlike Triple DES, RSA is considered an asymmetric algorithm due to its use of a pair of keys. You’ve got your public key, which is what we use to encrypt our message, and a private key to decrypt it. The result of RSA encryption is a huge batch of mumbo jumbo that takes attackers quite a bit of time and processing power to break.

(iii) Blowfish: -

Blowfish is yet another algorithm designed to replace DES. This symmetric cipher splits messages into blocks of 64 bits and encrypts them individually. Blowfish is known for both its tremendous speed and overall effectiveness as many claim that it has never been defeated. Meanwhile, vendors have taken full advantage of its free availability in the public domain.

(iv) Twofish: -

Computer security expert Bruce Schneier is the mastermind behind Blowfish and its successor Twofish. Keys used in this algorithm may be up to 256 bits in length and as a symmetric technique, only one key is needed. Twofish is regarded as one of the fastest of its kind, and ideal for use in both hardware and software environments. Like Blowfish, Twofish is freely available to anyone who wants to use it. As a result, you’ll find it bundled in encryption programs such as PhotoEncrypt, GPG, and the popular open source software TrueCrypt.

(v) AES: -

The Advanced Encryption Standard (AES) is the algorithm trusted as the standard by the U.S. Government and numerous organizations. Although it is extremely efficient in 128-bit form, AES also uses keys of 192 and 256 bits for heavy duty encryption purposes. AES is largely considered impervious to all attacks, with the exception of brute force, which attempts to decipher messages using all possible combinations in the 128, 192, or 256-bit cipher. Still, security experts believe that AES will eventually be hailed the de facto standard for encrypting data in the private sector.

(d) Ans:- please find an attachment for this question:-

(v) Ans:-

So Key ring is basically includes collection of certificates that identify a networking trust relationship. It is mainly made up of Private key and Public either receiver or client. And this key is confidential for both because they need to include whenever they will have communicate with each other.

secring.pgp is the place where the secrete keys are stored. Your keyrings are kept in two files. Your secret key is kept in the file SECRING.PGP and your public keys as well as the public keys of the people you encrypt to are kept in PUBRING.PGP. Both of these files should be backed up on a secure medium and kept in a safe place. If you lose SECRING.PGP and don't have a secure copy then you are stuck. You will need to generate a new key pair and re-distribute the matching public key to all your correspondents. SECRING.PGP is protected by your pass phrase. Don't write the pass phrase down, anywhere. Also, do not use PGP on a multiuser system. There are just too many ways for someone to monitor your keystrokes, capture your pass phrase, and use your secret key.

pubring.pgp A file called pubring.pgp where you keep your public key and the public keys of the people to whom you want to send ciphertext. Let us understand how to add public key

John types the following command:

pgp mary.asc

PGP "reads" the file, notes that it is a public key, asks John if he wants to add it to the public key ring, and then asks a few more questions. (More on those later.)

(At this point you will not be able to "add" these keys because you already have them on you public keyring.) After Mary has added John's public key to her public keyring they are now ready to send PGP encrypted material back and forth. However, there is one way that Vinny or Judy could compromise the security of John and Mary's PGP keys. It involves a complicated switching of keys but it can be done. John and Mary must make sure that the public keys in their possession are actually the public keys of the person whose name appears in the user id.

Hope you get some idea from my article.