Crypto Lab 2 - Using Asymmetric keys

Posted on Dec 3, 2024

Asymmetric encryption, also known as public key cryptography, uses a pair of keys: a public key for encryption and a private key for decryption. Each user has a key pair, and anything encrypted with one key can be decrypted with the other key from the same pair.

Please refer to pre-requisite for this blog to ensure that you have two users setup on Linux.

Scenario

mikey wants to send an encrypted file to bart.
mikey uses bart’s public key to encrypt the file.
bart uses his private key to decrypt the file.
The file to be encrypted is turing_bio stored at /srv/shared

bart’s Side (Generating the keys)

bart generates a key pair (public and private keys):

gpg --gen-key

Follow the prompts to generate the key pair. bart will need to provide his name, email address, and a passphrase. Here’s the sample output

    GnuPG needs to construct a user ID to identify your key.

   Real name: RN
   Name must be at least 5 characters long
   Real name: **bart12345**
   Email address: **bart12345@gmail.com**
   You selected this USER-ID:
      "bart12345 <bart12345@gmail.com>"

   ....public and secret key created and signed.

   pub   rsa3072 2024-12-10 [SC] [expires: 2026-12-]
         A6F6AFC9E969E6951FCE5DDC08C537A5ECE4F89D
   **uid                      bart12345 <bart12345@gmail.com>**
   sub   rsa3072 2024-12-10 [E] [expires: 2026-12-]

bart exports his public key to a file:

gpg --export -a "bart12345" > bart_public.key

This creates a file bart_public.key containing bart’s public key.

   cat  bart_public.key

   -----BEGIN PGP PUBLIC KEY BLOCK-----

   mQGNBGdY...............
   ............
   =7ZXt
   -----END PGP PUBLIC KEY BLOCK-----

mikey’s Side (Encrypting the File)

mikey imports bart’s public key:

gpg --import bart_public.key

mikey encrypts the file using bart’s public key:

gpg --output turing_bio_asymmetric_enc.gpg --encrypt --recipient "bart12345" turing_bio

The resulting turing_bio_asymmetric_enc.gpg is the encrypted version of the file

head turing_bio_asymmetric_enc.gpg

   ����^�b5�

bart’s Side (Decrypting the File)

bart decrypts the file using his private key:

gpg --output turing_bio_asymmetric_dec --decrypt turing_bio_asymmetric_enc.gpg

bart can now read the decrypted message and check that it is identical to original:

diff turing_bio turing_bio_asymmetric_dec

Private key details

When you use gpg –decrypt to decrypt a file, it requires the corresponding private key that matches the public key used to encrypt the file. This private key is stored in your GPG keyring. To list the private keys in your keyring, you can use the following command:

gpg --list-secret-keys

This command will output details about the private keys available in your keyring.

/home/bart/.gnupg/pubring.kbx
------------------------------
sec   rsa3072 2024-12-10 [SC] [expires: 2026-12-]
      A6F6AFC9E969E6951FCE5DDC08C537A5ECE4F89D
uid           [ultimate] bart12345 <bart12345@gmail.com>
ssb   rsa3072 2024-12-10 [E] [expires: 2026-12-]

Backing up the private key

Passphrase Protection: Your private key is usually protected by a passphrase, which you set when you generated the key pair. This adds an additional layer of security.
Backup: It’s important to keep a secure backup of your private key and remember your passphrase. Losing either means you won’t be able to decrypt files encrypted with the corresponding public key. Here’s how to do that

gpg --export-secret-keys -a "Rn12345" > private-key-backup.asc

cat private-key-backup.asc

-----BEGIN PGP PRIVATE KEY BLOCK-----

lQWGBG ...........
=8Ju6
-----END PGP PRIVATE KEY BLOCK-----

High Level concepts to remember

Public Key: Can be shared openly. It’s used for encrypting messages.
Private Key: Must be kept secure. It’s used for decrypting messages and signing.