ECE 646 Fall Lab 1: Pretty Good Privacy Setup

Size: px

Start display at page:

Download "ECE 646 Fall Lab 1: Pretty Good Privacy Setup"

Brice Gabriel Watkins
6 years ago
Views:

1 ECE 646 Fall 2017 Lab 1: Pretty Good Privacy Setup This setup should be completed before the lecture on Tuesday, October 3. Please read the general information about GNU Privacy Guard from Wikipedia available at

2 PART I 1. INTRODUCTION GNU Privacy Guard (GnuPG or GPG) is a free software package functionally equivalent to PGP (Pretty Good Privacy). A basic GnuPG program has a command line interface, and is available for use with multiple operating systems. For several major operating systems, there exist one or more front-ends for GnuPG that enhance it with a Graphical User Interface (GUI). You are allowed to use any of the following versions of GPG in this class: Windows Users: Gpg4win v full version (Released: ) available at Linux Users: Version compatible with your version of Linux. Please see an example in Section INSTALLATION Download one of the aforementioned versions of GPG to your laptop or desktop at home. Windows Users: During the installation, add GPA as an additional component to install (on top of the components selected by default, such as GnuPG, Kleopatra, GpgOL, GpgEX, and Gpg4win Compendium). You will be asked a few straightforward questions. The default answers would be perfectly fine. Small changes (based on your personal preferences) are permitted as well. Linux Users (instructions tested using Linux Ubuntu LTS): The gnupg package is installed by default. However, you may need to install the GUI front-end. Here is brief description on the installation of GPA and Kleopatra front-ends. Once installed, the GUIs will look like Windows versions of the two front-ends. In order to install GPA, run the following commands: sudo apt-get install libpng16-16 sudo apt-get install gpa

3 In order to install Kleopatra, run the following command: sudo apt-get install kleopatra Download the installer by clicking the Download GPG Suite. To install, double-click on the icon of the downloaded file and follow the installation wizard. 3. KEY GENERATION First, you need to have an account provided by any of the free services, such as Gmail, Yahoo!, Hotmail, etc. YOU ARE NOT ALLOWED TO USE YOUR GMU ACCOUNT FOR THIS LAB!!! If you do not have such an account yet (or other students may be familiar with your current non-gmu account), please create a new account just for the purpose of this lab. Additionally, in order to impersonate other students taking this class with you, please create fake accounts of 3 students arbitrarily selected from the class list. These accounts will be fully controlled by you, but their IDs should suggest that they belong to a person you have chosen from the class list. For example, if the name of the student you are trying to impersonate is John Smith, you can create an account called: jsmith92@gmail.com. Using the program, generate new private-public key pairs for: Yourself (even if you have a long-term PGP key you have generated before), and students you will try to impersonate. Associate these keys with an appropriate full name and address. Hints: Generating key pairs may take a few seconds and even minutes. To speed up the process, you may move around the mouse or type randomly on the keyboard. This is because random number generation is needed for key generation. As an expiration date select a date two months after the key creation date (this will help us to invalidate all fake keys after this lab exercise is over). You will be asked to enter a passphrase used to protect access to your private key stored on a hard drive of your computer. This passphrase should be easy to memorize by you, but hard to guess by others. You can use the same passphrase for all keys you generate. Please note that if you forget your passphrase, you will need to repeat the entire key distribution process (including all tasks performed in class, described in Section 5) again, which may substantially delay your progress with this lab! It happened in this class many times before. Don t let it happen to you. After your keys are generated, their basic characteristics (User Name, Key ID, Expiry date, etc.) will appear in the GUI interface.

4 You also will have an option of displaying additional details, such as Fingerprint, Key type, etc. by clicking on a key line in GPA or GPG Keychain, or by choosing a given line, right-clicking, and selecting Certificate Details in Kleopatra. Windows & Linux Users: If you use GPA (recommended), please enable Use Advanced Mode in Edit => Preferences. Then, choose Keyring => Keys => New key As an Algorithm, choose RSA or DSA. As a key size, choose 2048 or 3072 bits. If you use Kleopatra, please choose File => New Certificate => Create a personal OpenPGP key pair. After providing Name and , choose Advanced Settings. Choose RSA+RSA (meaning, RSA for signing and RSA for encryption) or DSA+Elgamal (meaning, DSA for signing and Elgamal for encryption). As a key size, choose 2048, 3072, or 4096 bits. Mark the Certificate Usage for Signing and Encryption. Mark Valid until, and set an expiration date to the date two months after the key creation date. Start the GPG Keychain app. Generate your key pair by clicking New in the tool bar. This will open a window and you need to enter the name of key owner, address and passphrase. There are more options under Advanced Options in the same window. Please set the Key type to RSA and RSA (default, meaning, RSA for signing and RSA for encryption) or DSA and Elgamal (meaning, DSA for signing and Elgamal for encryption). Set Length to 2048, 3072 (available for both aforementioned key types), or 4096 bits (available for RSA and RSA only). Then click Generate Key. 4. PUBLIC KEY CARD Using an arbitrary editor, please prepare and print your public key card containing the following information copied from the GUI of GPA, Kleopatra, or GPG Keychain: Your Name address: should be same as the one used to generate your public and private key (non-gmu address) Key ID Fingerprint. Please note that you do not need to prepare public key cards for any fake users, for which you have created public-private key pairs. No photo needs to be included as a part of the card. If you have problems with the access to a printer, the handwritten version of your card would be satisfactory as well.

5 5. KEY DISTRIBUTION: KEY EXCHANGE IN CLASS Bring four identical copies of your public key card, along with your GMU ID to the lecture on Tuesday, October 3. Submit one copy to the instructor. Show your GMU ID before the submission. Exchange public key cards with three of your classmates (preferably one friend and two strangers ). If you do not know their names, ask them to show you their GMU IDs. The group of three classmates you exchange the public key cards with is your DIRECT TRUST GROUP. AVOID FORMING CLOSED GROUPS OF 3 OR 4 STUDENTS WHO ALL EXCHANGE PUBLIC KEY CARDS AMONG ONE ANOTHER 6. DOCUMENTATION AND TESTING Please use the remaining time before the exchange of keys in class to get familiar with the program documentation, FAQs, and the meaning of all options of the menu. In particular consider getting familiar with the following resources: The Gpg4win Compendium (EN English version): HTML version: PDF version:

ECE646 Fall Lab 1: Pretty Good Privacy. Instruction

ECE646 Fall Lab 1: Pretty Good Privacy. Instruction ECE646 Fall 2012 Lab 1: Pretty Good Privacy Instruction PLEASE READ THE FOLLOWING INSTRUCTIONS CAREFULLY: 1. You are expected to address all questions listed in this document in your final report. 2. All