The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

8.1 Publishing per e-mail, with practice for OpenPGP

Do you wish to make your public certificate accessible to the person you are corresponding with? Simply send them your exported public certificate per e-mail. This section will show you how this works.

Practice this process with your public OpenPGP certificate! Adele can assist you. The following exercises only apply to OpenPGP; for information on publishing public X.509 certificates, please see page 67.

Adele is a very nice e-mail robot which you can use to practice correspondence. Because it is usually more pleasant to correspond with a smart human being rather than a piece of software (which is what Adele is, after all), you can imagine Adele this way:

First, send Adele your public OpenPGP certificate. Using the public key in this certificate, Adele will send an encrypted e-mail back to you.

You then use your own secret key to decrypt Adele’s response. To be able to respond to Adele with an encrypted e-mail, Adele has attached her own public certificate.

Adele acts just like a real person you are corresponding with. Of course, Adele’s e-mails are not nearly as interesting as those from the people you are actually corresponding with. On the other hand, you can use Adele to practice as much as you like – which a real person might find bothersome after a while.

So, now you export your public OpenPGP certificate and send it via e-mail to Adele. The following pages how how this works.

59

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

Exporting your public OpenPGP certificate

Select the public certificate to be exported in Kleopatra (by clicking on the corresponding line in the list of certificates) and then click on File!Export certificates... in the menu. Select a suitable file folder on your PC and save the public certificate with the file type.asc e.g.: mein-OpenPGP-Zertifikat.asc. The other file types, which can be selected, .gpg or.pgp, will save your certificate in binary format. That means that in contrast to an .ascfile, they cannot be read in the text editor.

When you select the menu item, please make sure that you are only exporting your public certificate – and not the certificate of your entire key pair with the associated private key by mistake.

Review the file once more by selecting Windows Explorer and selecting the same folder that you indicated for the export.

Now open the exported certificate file with a text editor, e.g. WordPad. The text editor will display your public OpenPGP certificate as it really looks – a fairly confusing block of text and numbers:

60

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

When publishing your OpenPGP certificate by e-mail, there are two variants which can take into account whether an e-mail program can send attachments.

Variant 1: Send public OpenPGP certificate as an e-mail text

This option always works, even if you are not able to attach files – as may be the case with some e-mail services on the Web.

Also, it is a way of seeing your public certificate for the first time, knowing exactly what is behind it, and what the certificate actually consists of.

Highlight the entire public certificate in the text editor from

---BEGIN PGP PUBLIC KEY BLOCK---

up to

---END PGP PUBLIC KEY BLOCK---

and copy it with the menu command or the key shortcut Strg+C. Now you have copied the certificate in the memory of your computer (Clipboard in a Windows context).

Now you can start your e-mail program – it does not matter which one you use – and add your public certificate into an empty e-mail. In Windows, the key command for adding (“Paste”) is Strg+V. You may know this process – copying and pasting – as “Copy & Paste”.

The e-mail program should be set up in such a way that it is possible to send only text messages and not HTML formated messages (see Section 13.3 and Annex A).

Now address this e-mail to adele@gnupp.de and write something in the subject line e.g. My public OpenPGP certificate.

61

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

This is approximately what your e-mail will look like:

Now send the e-mail to Adele. Make sure to include your own e-mail address as the sender. Otherwise

you will never receive Adele’s response ...

62

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

Variant 2: Send public OpenPGP certificate as an e-mail attachment

As an alternate to Variant 1, you can also send your exported public OpenPGP certificate directly as an e-mail file attachment. This is often the simpler and more commonly used method. Above, you learnt about the “Copy & Paste” method, because it is more transparent and easier to understand.

Now write another e-mail to Adele – this time with the certificate file in the attachment:

Add the previously exported certificate file as an attachment to your new e-mail – just as you would for any other file (e.g. pulling the file into the emtpy e-mailwindow). Add the recipient (adele@gnupp.de) and a subject, e.g.: My public OpenPGP certificate - as a file attachment.

Of course you can also add a few explanatory sentences. However, Adele does not need this explanations, because her only purpose is to help you practice this process.

Your finished e-mail should look something like this:

Now send the e-mail and attachment to Adele.

63

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

In short:

You have exported your public OpenPGP certificate in Kleopatra into a file. Subsequently, you have also copied the content of the file directly into an e-mail and attached the complete file as an e-mailattachment. Both e-mails have been sent to someone else – in this case, to Adele.

The same process applies if you are sending your public certificate to a real e-mail address. Usually, you should send public certificates as a file attachment, as described in Variant 2. This is the easiest way to do it, both for you and the recipient. And it also has the advantage that your recipient can import your certificate file directly into his own certificate administration (e.g. Kleopatra).

64

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

8.2 Publish via OpenPGP certificate server

Please note: You can only distribute your OpenPGP certificate via an OpenPGP certificate server.

Publishing your public OpenPGP certificate on a public certificate server is always a good idea, even if you are only exchanging encrypted e-mails with just a few people. This way, your public certificate is accessible to everyone on an Internet server. This saves you time in having to send your certificate e-mail to all of the people you are corresponding with.

At the same time, publishing your e-mail address on a certificate server can also make your e-mail address more susceptible to spam. This can only be addressed with good spam protection.

This is how it works: Select your public OpenPGP certificate in Kleopatra and click on File!Export certificate to server.... If you have not defined a certificate server, you will see a warning:

The public OpenPGP certificate server already contains keys.gnupg.net default settings. Click on [ Continue ] to send your selected public certificate to this server. There, your public certificate is distributed to all globally connected certificate servers. Anyone can download your public certificate from one of these OpenPGP certificate servers and use it send you a secure e-mail.

If you are only testing this process, please do not send the practice certificate: In the top dialog, click on [ Cancel ]. The test certificate is worthless and cannot be removed by the certificate server. You would not believe how many test certificates with names like “Julius Caesar”, “Helmut Kohl” or “Bill Clinton” are already floating around on these servers ...

65

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

In short:

Now you know how to publish your public OpenPGP certificate on an OpenPGP certificate server on the Internet.

For information on how to search for the public OpenPGP certificate of people you are corresponding with on a certificate server, see Chapter 16. You can read this chapter now or later when you need this function.

66

The Gpg4win Compendium 3.0.0-beta1

Chapter 8. Distribution of public certificates

8.3 Publishing X.509 certificates

In the case of public X.509 certificates, this process is even easier: all you need to do is to send a signed S/MIME e-mail to the person you are corresponding with. Your public X.509 certificate is contained in this signature, and can be imported into the recipient’s certificate administration.

Unfortunately, you cannot use Adele to practice X.509 certificates since the robot only supports OpenPGP. Therefore you should pick another person to write you, or alternately write to yourself.

Some public X.509 certificates are distributed by the certificate authority. This is usually done using X.509 certificate servers, which however do not synchronize on a global basis, as is the case with OpenPGP key servers.

When you export your public X.509 certificate, you can highlight the entire public certificate chain and save it in a file – generally the root certificate, CA certificate and personal certificate – or only your public certificate.

The first is recommended since the person you are corresponding with may be missing some parts of the chain, which he otherwise would have to find. To do this, click on all elements of the certificate chain in Kleopatra while holding the Shift key, and export the highlighted certificate into a file.

If the person you are corresponding with does not have the root certificate, he must indicate that he trusts it, or have an administrator do so, in order to finally also trust you. If this has already been done (e.g. because they are both part of the same “root”), then this shiop is already in place.

67

9Decrypting e-mails, practicing for OpenPGP

Gpg4win, the certificate of your key pair and of course your passphrase are all you need to decrypt e-mails.

This Chapter shows you step for step how to decrypt e-mails in Microsoft Outlook using the Gpg4win program component GpgOL.

Initially, you can practice this process with Adele and your public OpenPGP certificate. The following exercises again only apply to OpenPGP – explanations regarding the decryption of S/MIME e-mails can be found at the end of this chapter on page 71.

In Section 8.1 you sent your public OpenPGP certificate to Adele. Using this certificate, Adele will now encrypt an e-mail and send a message back to you. You should receive Adele’s response after a short time period.

68

The Gpg4win Compendium 3.0.0-beta1

Chapter 9. Decrypting e-mails, practicing for OpenPGP

Decrypting a message with MS Outlook and GpgOL

Most e-mail programs also have special program extensions (“plugins”), which can be used to perform the encryption and decryption process directly in the e-mail program. GpgOL is such a program extension for MS Outlook, which is used here to decrypt Adele’se-mails. For more information on other software solutions, please see Annex B. You can read this section now, or later when you need this function.

Start MS Outlook and open Adele’s response e-mail. Until now, you have only known Kleopatra as a certificate administration program. However, the program can do much more than that: It can control the actual GnuPG encryption software and hence not just manage your certificates but also take care of all cryptographic tasks (with GnuPG’s assistance). Kleopatra provides the visual user interface, hence the dialogs which you as the user see while you encrypt or decrypt e-mails.

Hence Kleopatra processes Adele’s encrypted e-mails. These e-mails have been encrypted by Adele using your public OpenPGP key.

To decrypt the message, Kleopatra will now ask for your passphrase that protects your private key. Enter your passphrase.

The decryption is successful if you do not see an error dialog! You can now read the decrypted e-mail.

You can retrieve the exact results dialog of the decryption by clicking on Extras!GpgOL decryption/check in the menu of the opened e-mail.

However, surely you also want to see the result, namely the decrypted message ...

69

The Gpg4win Compendium 3.0.0-beta1

Chapter 9. Decrypting e-mails, practicing for OpenPGP

The decrypted message

Adele’s decrypted response will look something like this1:

Hello Heinrich Heine,

here is an encrypted response to your e-mail.

I received your public key with the key ID FE7EEC85C93D94BA and the name

‘Heinrich Heine <heinrich@gpg4win.de>’.

Attached is the public key of adele@gnupp.de, the friendly e-mail robot.

Regards,

adele@gnupp.de

The text block that follows is Adele’s public certificate.

In the next chapter, you will import this certificate and add it to your certificate administration. You can use imported public certificates at any time to encrypt messages to the people you are corresponding with, or to check their signed e-mails.

1Depending on the software version of Adele, it may look differently. It’s translated from German.

70

The Gpg4win Compendium 3.0.0-beta1

Chapter 9. Decrypting e-mails, practicing for OpenPGP

In short:

1.You have decrypted and encrypted an e-mail using your private key.

2.Your correspondence partner has attached his own public certificate, so that you can answer him in encrypted form.

e-mail decryption using S/MIME

So this is how e-mails are decrypted using the private OpenPGP key – but how does it work with S/MIME?

The answer: The same!

To decrypt an encrypted S/MIME e-mail, simply open the message in Outlook and enter your passphrase in the pin entry dialog. You will see a status dialog that is similar to that shown for OpenPGP. After closing this dialog, you will see the decrypted S/MIME e-mail.

Differently from OpenPGP decryption, however, when using S/MIME you cannot use Adele to practice, since Adele only supports OpenPGP.

71

10 Importing a public certificate

The person you are corresponding with does not always have to send their public certificate when they send signed e-mails to you. You can simply store their public certificate in your certificate administrator

– e.g. Kleopatra.

Storing a public certificate

Before you import a public certificate into Kleopatra, you must save it in a file. Depending on whether you received the certificate as an e-mailfile attachment or as a block of text contained in your e-mail, please proceed as follows:

If the public certificate was included as an e-mail file attachment, save it on your hard drive – just as you would normally do.

If the public certificate was mailed as a block of text that was included in the e-mail, you have to highlighte the entire certificate:

In the case of (public) OpenPGP certificates, please highlight the area from

---BEGIN PGP PUBLIC KEY BLOCK---

up to

---END PGP PUBLIC KEY BLOCK---

just as we have seen in Section 8.1.

Now use Copy & Paste to insert the highlighted section into a text editor and save the public certificate. For file endings, you should use .asc or .gpg for OpenPGP certificates and .pem oder .der for X.509 certificates.

72

The Gpg4win Compendium 3.0.0-beta1

Chapter 10. Importing a public certificate

Importing public certificates into Kleopatra

Whether you have saved the public certificate as an e-mail attachment or text block – in both cases, you will be importing it into your Kleopatra certificate administration. To do this, start Kleopatra if the program is not running already. In the menu, click on File!Import certificate..., search for the public certificate you have just saved and import it. You will receive an information dialog showing the result of the import process:

It displays the imported public certificate in Kleopatra, in a separate tab Imported certificates with the title <Path to certification file>”:

This tab is used for checking purposes, since a file can contain more than one certificate. You can close the tab using the Fenster!Close tab command or via the “Close tab” button on the right side of the window).

Now change over to the tab “Other certificates”. You should also be able to see the public certificate you have imported.

Now you have imported someone else’s certificate – in this case Adele’s public OpenPGP certificate – into your certificate administration. You can use this certificate at any time to send encrypted messages to the owner of the certificate, and to check his signatures.

73

The Gpg4win Compendium 3.0.0-beta1

Chapter 10. Importing a public certificate

As soon as you are exchanging encrypted e-mail more frequently and with a larger number of persons, you will likely want to search and import for certificates on globally available key servers. To see how this works, please see Chapter 16 .

Before continuing, an important question:

How do you know that the public OpenPGP certificate really came from Adele? It is possible to send e-mails under someone else’s name – in this respect, merely having the sender’s name does not mean anything.

So how can you ensure that a public certificate actually belongs to the sender?

This key question related to certificate inspections is explained in the next Chapter 11.

74

11 Certificate inspection

How do you know if a certificate actually belongs to the sender? And vice versa – why should the person you are writing to believe that the certificate you sent to him is really yours? The sender’s name on an e-mail means nothing, just like putting a sender’s name on an envelope.

If your bank, receives an e-mail with your name, with a request to transfer your entire bank balance to a numbered account in the Bahamas, we should hope that it will refuse to do so – no matter what the e-mail address is. On its own, an e-mail address itself does not really say anything about the sender’s identity.

75

The Gpg4win Compendium 3.0.0-beta1

Chapter 11. Certificate inspection

Fingerprints

If you are only corresponding with a very small circle of people, it is easy to check their identity: You check the fingerprint of the other certificate.

Each certificate features a unique identification, which is even better than someone’s fingerprint. For this reason this identification is also referred to as a “fingerprint”.

If you display the details of a certificate in Kleopatra, e.g. by double-clicking on the certificate, you will see its 40-character fingerprint, among other things:

The fingerprint of the above OpenPGP certificate is therefore as follows:

7EDC0D141A82250847448E91FE7EEC85C93D94BA

In short - the fingerprint clearly identifies the certificate and its owner.

Simply call the person you are corresponding with and let them read the fingerprint of their certificate to you. If the information matches the certificate you have on hand, you clearly have the right certificate.

Of course you can also meet the owner of the certificate in person, or use another method to ensure that certificate and owner can be matched. Frequently, the fingerprint is also printed on business cards; therefore, if you have a business card whose authenticity is guaranteed, you can save yourself a phone call.

76

The Gpg4win Compendium 3.0.0-beta1

Chapter 11. Certificate inspection

Authenticating an OpenPGP certificate

Once you have obtained confirmation of the authenticity of the certificate “via a fingerprint”, you can authenticate it – but only in OpenPGP. With X.509, users cannot authenticate certificates – this can only be done by the certificate authorities (CA).

By authenticating a certificate, you are letting other (Gpg4win) users know that you are of the opinion that this certificate is real – hence authentic: You are acting as a kind of “godfather” for this certificate, and help to increase the general level of trust in its authenticity.

So how does the authentication process work?

In Kleopatra, select an OpenPGP certificate that you think is real and would like to authenticate. In the menu, select: Certificates!Authenticate certificates...

Reconfirm the OpenPGP certificate to be authenticated in the following dialog, using [ Next ]:

77

The Gpg4win Compendium 3.0.0-beta1

Chapter 11. Certificate inspection

In the next step, select your own OpenPGP certificate, which you will use to authenticate the certificate selected in the last step:

Here you decide whether to [ Authenticate for private use only ] or or [ Authenticate and make visible to all ]. With the last variant, you have the option of subsequently uploading the authenticated certificate to an OpenPGP certificate server, and hence make an updated and authenticated certificate available to the entire world.

Now confirm your selection with [ Authenticate ].

Similar to the process of signing an e-mail, you also have to enter your passphrase when authenticating a certificate (with your private key). The authentication proccess is only complete once this information is entered correctly.

78

The Gpg4win Compendium 3.0.0-beta1

Chapter 11. Certificate inspection

Following a successful authentication, the following window appears:

Do you want to check the authentication one more? To do this, open the certificate details of the certificate you have just authenticated.Select the tab User ID and authentications and click on the button [ Obtain authentications ].

You will now see all authentications contained in this certificate, sorted by user ID. You should also be able to see your certificate in this list, if you have just authenticated it.

79

The Gpg4win Compendium 3.0.0-beta1

Chapter 11. Certificate inspection

Web of trust

The process of authenticating certificates creates a “Web of Trust” (WoT), which extends beyond the group of Gpg4win users and their correspondence, and it means that you are not always required to verify an OpenPGP certificate for its authenticity.

Naturally, trust in a certificate will increase if it has been authenticated by a lot of people. Your own OpenPGP certificate will receive authentications from other GnuPG users over time. This enables more and more people to trust that this certificate is really yours and not someone else’s.

The continued weaving of this “Web of Trust” creates a flexible authentication structure.

There is one theoretical possibility of making this certificate test null and void: Someone plants a wrong certificate on you. In other words, you have a public OpenPGP key that pretends to be from X but in reality was replaced?? by Y. If this falsified certificate is authenticated, it clearly creates a problem for the “Web of Trust”. For this reason it is very important to make sure that prior to authenticating a certifidate, you make absolutely sure the certificate really belongs to the person that purports to own it.

But what if a bank or government authority wants to check whether the certificates of their customers

are real? Surely, they cannot call them all ...

80

The Gpg4win Compendium 3.0.0-beta1

Chapter 11. Certificate inspection

Authentication instances

In this case, we need a “superordinate” instance that all users can trust. After all, you do not personally check the ID of a person not known to you by phoning the municipal office, but rather trust that the office that issued the ID will have already checked and authenticated these details.

These types of authentication instances also exist in the case of OpenPGP certificates. In Germany, for example, the magazine c’t has long been offering such a service free of charge, as have many universities.

Therefore, if you have received an OpenPGP certificate whose authenticity has been confirmed by such an authentication instance, you should be able to rely on it.

Such authentication instances or “Trust Centers” are also provided for in other encryption methods – such as S/MIME. However, in contrast to the "Web of Trust", these feature a hierarchical structure, with a “top authentication instance” that authenticates additional “sub-instances” and entitles them to authenticate user certificates (see Chapter 5).

The best way to describe this infrastructure is to use the example of a seal: The sticker on your license plate can only be provided by an institution that is authorised to issue such stickers, and they have received that right from another superordinate body. On a technical level, an authentication is nothing more than an authenticating party signing a certificate.

Of course, hierarchical authentication infrastructures are much better suited to the requirements of government and official instances than the loose “Web ofTrust” of GnuPG, which is based on mutual trust. At the same time, the key aspect of the authentication is the same for both: Gpg4win also supports a hierarchical authentication (S/MIME) in addition to the “Web of Trust” (OpenPGP). Accordingly, Gpg4win offers a basis that corresponds with the Signature Act of the Federal Republic of Germany.

If you would like to learn more about this topic, the following websites provide more information on this and other IT security topics:

www.bsi.de

www.bsi-fuer-buerger.de

www.gpg4win.org

Another, rather technical, information source on the issue of authentication infrastructure is the GnuPG handbook, which can also be found at:

www.gnupg.org/gph/en/manual.html

81