The FOSS Outreach program has officially
started!
I have to laugh a little about myself. A
few days ago I was hoping that I could jump in and start doing something
wonderful. As I started asking questions about the system, one of the first
things I noticed was that I didn’t understand the product. Sure, the basic idea
is GNOME Keysign is a tool to sign keys without the use of a key server. Back
in October when I began learning about what this meant I had a simplistic view
on OpenPGP. If you want to send a “secret” message you need to have a way to
encrypt the cleartext to ciphertext and then back to cleartext. If you’re like
me, you might start to imagine someone with a strong background in mathematics
and cryptography drinking copious amounts of redbull and staying up all night
fighting the war on cyber crime. Yes,
take that <insert current global enemy here>. Unfortunately this might
make you want to slowly back away, but sending encrypted emails is much easier
than you might imagine. The encryption algorithms run quietly behind the scenes
while you’re blissfully unaware of the poor souls who probably spent their 20s
working on cryptography. The “key” (hee haw!) to encryption is having the key
necessary to lock and unlock the encryption. Simple enough, but how do you
securely send this key to your friends? If they live near you could pedal your
bike over and tell them what it is. However, this doesn’t work for people who
live outside of your town or someone that you’ve never met. To solve this
solution, you have an asymmetric keypair. One key is your private key that you
never give out to anyone while the second is a public key that you can shout
out to the world on the rough top while someone is filming for the next viral
youtube hit. Okay, you probably don’t want to do that since part of protecting
your data is conservatism, but the point is, you shouldn’t be able ascertain
the private key from the public key. The neat thing about the keypair is that
if one is used to encrypt a document and the other can decrypt that same
document, you know that those two keys are part of the same keypair. This is
great because it solves another problem; how do I know the encrypted document
is sent by the correct person? Well, because the public key can only decrypt it
if it’s part of the keypair for the private key. However, what if I’ve never
met this person? Now we can start talking about keysigning and it’s advantages.
My public key is part of a digital certificate that also includes certificate
information, such as my user id, and one or more digital signatures. Others
sign my key with a digital signature, which authenticates my public key. So if
I know Adam and trust him, and Adam knows Betty and trusts her, ergo I can
trust Betty. The more signatures I have on my public key, the more it can be
“trusted.” All of this seams fairly reasonable and logical. After downloading
the GnuPG package, I easily made myself a couple of keypairs and was off to
protecting my personal data. Eazy Piezy.
One of the things that I failed to grasp
was why. I pity the poor NSA analyst who has the misfortune to read any of my
emails. They must be incredibly boring and riddled with aggravating grammatical
mistakes. However, as mundane as they are, they are part of my data that I want
to keep protected. I wouldn’t let officers inspect my house whenever they
wanted. Whether you avidly follow the news or not, Snowden has become a
household name, usually associated with the discovery that the government is
encroaching on our civil liberties more and more. OpenPGP is a set of
encryption protocols that gives the individual the ability to encrypt their
documents with the aforementioned keypairs. I’m a bit of a lazy person and I
can rationalize myself out of encrypting my meaningless one-line email, but I
do want to insure that I have the choice to encrypt my data if I want. Here is
the call to arms. If no one encrypts their emails or cares about encrypting
their emails, it makes it that much easier for the government to take away this
option. Here’s an analogy, most people I know have a password on their phone.
Could you imagine the uproar if congress tried to initiate a bill that revoked
this feature on phones? It wouldn’t happen. A good resource is written by Phil
Zimmerman here, http://www.philzimmermann.com/EN/bibliography/bibliography.html.
The problem with the previous block of
information is that it provides the background for GNOME Keysign, but it doesn’t
tell us specifically why it does what it does and more of the technical details
of the program. Again, Keysign is a tool to sign keys without the use of a
keyserver. Why would you want to do that? Well, part of that answer is that the
unique key fingerprint sequence of numbers and letters are overlapping between
users, which can lead to downloading the wrong public key from the key server. Keysign
circumvents this problem my downloading key information from a local network. When
I start up Keysign I immediately see a user-friendly GUI with two tabs, Keys
and GetKeys, which represents the client and server sides of the program. If I
proceed with Keys as in I want someone to sign my key, Keysign fetches my
fingerprint and encodes it in a QRcode image. You can choose to transfer your
key fingerprint by transferring the actual sequence or by scanning the QRcode. Underneath
the GUI the program is publishing my key information to the local network. If
instead, I choose to GetKeys as in I want to sign someone’s key, I can either
enter in the fingerprint manually or scan the QRcode. The program then grabs
the key information from the local network and then adds it to my temporary
keyring. It then signs it with my digital signature and sends this information
back to the email associated with that public key to insure that the signature
is going to the intended email of the person whose key I just signed. Viola, signed keys!
Sadly, it took quite a bit for me to figure
all of this out, which is why I felt like I needed to make light of myself for
thinking that I would just, you know, start solving issues from the get-go.
Lucky for me, the other participants of the program have expressed that they
are all in a similar situation, which relieved some of my concerns about my own
performance. Strength in numbers, right? Hopefully, my next post will involve a
more profound inspection of the inner workings of the project. J
