LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 04-11-2006, 02:00 PM   #16
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344

Quote:
Originally Posted by mac1234mac
So, for example, I create public and private key, send public key
to another person, this person encrypts some file with his
private key, using my public key, and then sends encrypted file to me and I can
decrypt the file with my private key?. So public key must
contain information about private key?.
You can decrypt the file with your private key and the other person's public key.

The public key contains no information about the private key, and no amount of processing can derive the private key from the public key (or the public key from the private key). The key pair is created by an algorithm that causes the two to be halves of a one-way symetrical operation.

For the details on the algorithm, see Wikipedia's RSA and DSA pages. However, unless your degree is in mathematics, you will have to take it as an act of faith that these algorithms have been subjected to public scrutiny, and have been found secure, for now.
 
Old 04-11-2006, 03:29 PM   #17
mac1234mac
Member
 
Registered: Sep 2005
Posts: 183

Original Poster
Rep: Reputation: 30
Let's try another way. In Wikipedia is this postal example:
Alice sends message to Bob. She asks for padlock (public key?).
So Bob creates padlock (public key) and key (private key), right?.
He sends his public key to Alice. So now Alice has only Bob's public key?. So she encrypts the message with this public key and I wonder... so what exactly she does?. Is this some kind of "latch"
padlock?. Does this mean that she can't decrypt her message(open
the padlock)?. She can only send back the message to Bob?.
And only Bob can open it?.
 
Old 04-11-2006, 05:22 PM   #18
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
That's correct. Once encrypted for someone else (your private key, their public key), even the originator cannot decrypt the file.
 
Old 04-12-2006, 08:48 AM   #19
mac1234mac
Member
 
Registered: Sep 2005
Posts: 183

Original Poster
Rep: Reputation: 30
So I need only someone's public key to encrypt message and
this person must have this public key and his private key to decrypt it?.

But what about this kernel source authentication?.
I have public key and hashed signature and it seems that I
decrypt this signature with public key. I don't need and have private key, have I?.

That's why I asked question about whether public and private key
of one person are connected. I think it is like in this postal example public key is a padlock and private key is a key to this padlock, so can't someone cut the key to the padlock having this
padlock?. I think it's possible.
 
Old 04-12-2006, 09:00 AM   #20
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
Quote:
Originally Posted by mac1234mac
So I need only someone's public key to encrypt message and
this person must have this public key and his private key to decrypt it?.
Again, you need the other person's public key, and your private key to encrypt. The other person needs your public key and their private key to decrypt.

Quote:
But what about this kernel source authentication?.
I have public key and hashed signature and it seems that I
decrypt this signature with public key. I don't need and have private key, have I?.
That's a signature, not an encrypted file. The algorithms and process is different.

Quote:
That's why I asked question about whether public and private key
of one person are connected. I think it is like in this postal example public key is a padlock and private key is a key to this padlock, so can't someone cut the key to the padlock having this
padlock?. I think it's possible.
No, it is not possible. If you can "solve" the problem without using hundreds of thousands of CPUs in a reasonable time (decades of processing), you will be forever famous.
 
Old 04-12-2006, 12:55 PM   #21
mac1234mac
Member
 
Registered: Sep 2005
Posts: 183

Original Poster
Rep: Reputation: 30
Quote:
Again, you need the other person's public key, and your private key to encrypt. The other person needs your public key and their private key to decrypt.
So we exchange public keys?. I send my public key to someone and
someone encrypts message with it and sends the message back with his public key so I can decrypt it?.

Well, it doesn't fit into this postal analogy. Because how can I
lock padlock which is not mine with my key?.

Well, so encrypting message and signing message are two different things?.

Could you explain what I have to do to sign message (theory - not how it's done in particular program). And what the other person
has to do to verify signature (well, this part I guess I know from
kernel source example). I use public key and decrypt signature with it and this signature is compared with sequence of letters and numbers derived from signed file. The sequence is created on my computer locally, as it is done in md5 verification. Am I right?.

Last edited by mac1234mac; 04-12-2006 at 12:59 PM.
 
Old 04-12-2006, 01:23 PM   #22
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
At this point, we are not covering new ground, but simply reiterating the same points over and over. I understand that you find the material confusing, but asking the same questions and getting the same answers will not enlighten you.

I suggest that you set up two login accounts on your Linux system. Generate a key pair for each account. Exchange files, sign files, and orbserve how the software operates. Attempt to defeat the process by any means you see fit. You have the environment to empirically validate the process and understand the operation yourself.

Document what you find, and present it in a way that makes sense to you, so that others may benefit.
 
Old 04-12-2006, 01:53 PM   #23
mac1234mac
Member
 
Registered: Sep 2005
Posts: 183

Original Poster
Rep: Reputation: 30
Yes, I think this is the best way. Thank you for patience.
 
Old 04-13-2006, 12:34 PM   #24
mac1234mac
Member
 
Registered: Sep 2005
Posts: 183

Original Poster
Rep: Reputation: 30
I created two accounts as you suggested. I used KGpg GUI
And here are the results:
1. Receiver produces pair of keys
2. Sender produces pair of keys
3. Receiver sends his public key to sender
4. Sender imports receiver's public key
5. Sender signs receiver's public key with sender's private key (must enter password referring to sender's pair of keys)
6. Sender encrypts file with receiver's public key (signed with
sender's private key)
7. Sender sends encrypted message
8. Receiver decrypts file with his pair of keys (must enter password
for his pair of keys).

I have one question: why is point 5 needed?.

This is really like this "latch" padlock concept.

Last edited by mac1234mac; 04-13-2006 at 12:47 PM.
 
Old 04-13-2006, 01:02 PM   #25
macemoneta
Senior Member
 
Registered: Jan 2005
Location: Manalapan, NJ
Distribution: Fedora x86 and x86_64, Debian PPC and ARM, Android
Posts: 4,593
Blog Entries: 2

Rep: Reputation: 344Reputation: 344Reputation: 344Reputation: 344
Step 5 is not needed. By signing someone else's public key, you are assigning a level of trust to that key. It's somewhat like like using a certificate authority on the web, but with more shades of gray:

unknown

Nothing is known about the owner's judgment in key signing. Keys on your public keyring that you do not own initially have this trust level.

none

The owner is known to improperly sign other keys.

marginal

The owner understands the implications of key signing and properly validates keys before signing them.

full

The owner has an excellent understanding of key signing, and his signature on a key would be as good as your own.

More details here.
 
Old 04-13-2006, 02:04 PM   #26
mac1234mac
Member
 
Registered: Sep 2005
Posts: 183

Original Poster
Rep: Reputation: 30
Well, is it not needed?. But without signing someone's public key with my private key I can't encrypt file. There is not even
such key to choose from in menu of KGpg. Level of trust is set to
0. When I sign public key level is 100%. And only then I can
encrypt file. Does KGpg - GUI give only 0% and 100% level of security available?. Do I have to use command-line gpg to
set other levels?.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ssh public/private keys lord_darkhelmet Linux - Newbie 8 10-29-2005 03:14 PM
SSH public / private keys problem guideweb Linux - Software 7 08-27-2005 09:49 PM
Using GPG without public or private keys darin3200 Linux - Security 3 01-10-2005 03:40 AM
How to delete public & private keys for SSH? TrulyTessa Linux - Security 2 11-18-2004 12:27 PM
Help with SSH and public/private keys stodge Linux - Security 5 05-14-2003 01:22 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:09 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration