Misplaced Pages

GNU Privacy Guard: Difference between revisions

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
Browse history interactively← Previous editNext edit →Content deleted Content addedVisualWikitext
Revision as of 18:36, 16 May 2014 editJohnValeron (talk | contribs)4,272 edits New section "In popular culture"← Previous edit Revision as of 00:53, 17 May 2014 edit undoJohnValeron (talk | contribs)4,272 editsm →In popular culture: fix parameter errorNext edit →
Line 59: Line 59:


==In popular culture== ==In popular culture==
In May 2014, '']'' reported on a 12-minute video posted to ] in May 2013 by a user named anon108. ''The Daily Dot'' identified anon108 as ] leaker ], who it said made the tutorial to teach journalist ] email encryption. ''The Daily Dot'' said this video release coincided with Greenwald's new book, '']'',<ref>{{cite web|url=http://www.dailydot.com/politics/edward-snowden-gpg-for-journalists-video-nsa-glenn-greenwald/ |title=Watch the video Edward Snowden made to teach Glenn Greenwald email encryption |publisher=The Daily Dot |date=May 13, 2014 }}</ref> in which Greenwald writes that Snowden "produced a ten -minute video entitled ''PGP for Journalists''.<ref>{{cite web|http://glenngreenwald.net/#BookExcerpt |title=Excert from No Place to Hide |publisher=Glenn Greenwald |date=May 13, 2014 }}</ref> ''The Daily Dot'' did not note the discrepancies in video length and title between its own account and Greenwald's version. In May 2014, '']'' reported on a 12-minute video posted to ] in May 2013 by a user named anon108. ''The Daily Dot'' identified anon108 as ] leaker ], who it said made the tutorial to teach journalist ] email encryption. ''The Daily Dot'' said this video release coincided with Greenwald's new book, '']'',<ref>{{cite web|url=http://www.dailydot.com/politics/edward-snowden-gpg-for-journalists-video-nsa-glenn-greenwald/ |title=Watch the video Edward Snowden made to teach Glenn Greenwald email encryption |publisher=The Daily Dot |date=May 13, 2014 }}</ref> in which Greenwald writes that Snowden "produced a ten -minute video entitled ''PGP for Journalists''.<ref>{{cite web|url=http://glenngreenwald.net/#BookExcerpt |title=Excerpt from No Place to Hide |publisher=Glenn Greenwald |date=May 13, 2014 }}</ref> ''The Daily Dot'' did not acknowledge the discrepancies in video length and title between its own account and Greenwald's version.


== See also == == See also ==

Revision as of 00:53, 17 May 2014

GNU Privacy Guard
The GNU Privacy Guard logo
Developer(s)GNU Project
Repository
Operating systemCross-platform
TypeOpenPGP
LicenseGNU GPLv3
Websitegnupg.org

GNU Privacy Guard (GnuPG or GPG) is a GPL Licensed alternative to the PGP suite of cryptographic software. GnuPG is compliant with RFC 4880, which is the current IETF standards track specification of OpenPGP. Current versions of PGP (and Veridis' Filecrypt) are interoperable with GnuPG and other OpenPGP-compliant systems.

GnuPG is a part of the Free Software Foundation's GNU software project, and has received major funding from the German government.

History

GnuPG was initially developed by Werner Koch. Version 1.0.0, which was the first production version, was released on September 7, 1999, almost two years after the first GnuPG release (version 0.0.0). The German Federal Ministry of Economics and Technology funded the documentation and the port to Microsoft Windows in 2000.

GnuPG is a system compliant to the OpenPGP standard, thus the history of OpenPGP is of importance; it was designed to interoperate with PGP, the email encryption program initially designed and developed by Phil Zimmermann.

Stable 2.0 branch was initially released on 13 November 2006. As of January 2014, latest version of 2.0 branch is 2.0.22, released in October 2013. The older stable 1.x branch, whose latest version 1.4.16 was released in December 2013, will be continued in parallel with the new GnuPG 2 series because there were significant changes in the architecture of the program which will not fit every purpose.

On February 7, 2014, a GnuPG crowdfunding effort closed, raising 36,732 euros for a new web site and infrastructure improvements.

Usage

Although the basic GnuPG program has a command line interface, there exist various front-ends that provide it with a graphical user interface. For example, GnuPG encryption support has been integrated into KMail and Evolution, the graphical e-mail clients found in KDE and GNOME, the most popular Linux desktops. There are also graphical GnuPG front-ends (Seahorse for GNOME, KGPG for KDE). For Mac OS X, the Mac GPG project provides a number of Aqua front-ends for OS integration of encryption and key management as well as GnuPG installations via Installer packages.

Furthermore, the GPGTools Installer installs all related OpenPGP applications (GPG Keychain Access), plugins (GPGMail) and dependencies (MacGPG) to use GnuPG based encryption. Instant messaging applications such as Psi and Fire can automatically secure messages when GnuPG is installed and configured. Web-based software such as Horde also makes use of it. The cross-platform extension Enigmail provides GnuPG support for Mozilla Thunderbird and SeaMonkey. Similarly, Enigform provides GnuPG support for Mozilla Firefox. FireGPG was discontinued June 7, 2010.

In 2005, G10 Code and Intevation released Gpg4win, a software suite that includes GnuPG for Windows, Gnu Privacy Assistant, and GnuPG plug-ins for Windows Explorer and Outlook. These tools are wrapped in a standard Windows installer, making it easier for GnuPG to be installed and used on Windows systems.

Other software wraps the command line in a Perl script (e.g. gpg-dialog) that is menu based.

Process

GnuPG is a hybrid encryption software program in that it uses a combination of conventional symmetric-key cryptography for speed, and public-key cryptography for ease of secure key exchange, typically by using the recipient's public key to encrypt a session key which is only used once. This mode of operation is part of the OpenPGP standard and has been part of PGP from its first version.

GnuPG encrypts messages using asymmetric keypairs individually generated by GnuPG users. The resulting public keys may be exchanged with other users in a variety of ways, such as Internet key servers. They must always be exchanged carefully to prevent identity spoofing by corrupting public key ↔ "owner" identity correspondences. It is also possible to add a cryptographic digital signature to a message, so the message integrity and sender can be verified, if a particular correspondence relied upon has not been corrupted.

GnuPG also supports symmetric encryption algorithms. By default GnuPG uses the CAST5 symmetrical algorithm.

GnuPG does not use patented or otherwise restricted software or algorithms. Instead, GnuPG uses a variety of other, non-patented algorithms.

For a long time it did not support the IDEA encryption algorithm used in PGP. It was in fact possible to use IDEA in GnuPG by downloading a plugin for it, however this might require a license for some uses in countries in which IDEA was patented. Starting with version 1.4.13/2.0.20, GnuPG supports IDEA because the last patent of IDEA expired in 2012 (Support of IDEA is "to get rid of all the questions from folks either trying to decrypt old data or migrating keys from PGP to GnuPG", and is not recommended for normal use).

GnuPG currently supports the following algorithms:

Limitations

GnuPG is a command-line based system, that is not written as an API which may be incorporated into other software. GPGME is an API wrapper around GnuPG which parses the output of GnuPG, and various graphical front-ends based on GPGME have been created. This currently requires an out-of-process call to the GnuPG executable for many GPGME API calls. Because GPGME makes use of a special GnuPG interface designed for machine use, a stable and maintainable API between the components is given. Possible security problems in an application do not propagate to the actual crypto code due to the process barrier.

Problems

The OpenPGP standard specifies several methods of digitally signing messages. In 2003, due to an error in a change to GnuPG intended to make one of those methods more efficient, a security vulnerability was introduced. It affected only one method of digitally signing messages, only for some releases of GnuPG (1.0.2 through 1.2.3), and there were fewer than 1000 such keys listed on the key servers. Most people did not use this method, and were in any case discouraged from doing so, so the damage caused (if any, and none has been publicly reported) would appear to have been minimal. Support for this method has been removed from GnuPG versions released after this discovery (1.2.4 and later).

Two further vulnerabilities were discovered in early 2006; the first being that scripted uses of GnuPG for signature verification may result in false positives, the second that non-MIME messages were vulnerable to the injection of data which while not covered by the digital signature, would be reported as being part of the signed message. In both cases updated versions of GnuPG were made available at the time of the announcement.

In popular culture

In May 2014, The Daily Dot reported on a 12-minute video "GPG for Journalists" posted to Vimeo in May 2013 by a user named anon108. The Daily Dot identified anon108 as NSA leaker Edward Snowden, who it said made the tutorial to teach journalist Glenn Greenwald email encryption. The Daily Dot said this video release coincided with Greenwald's new book, No Place to Hide, in which Greenwald writes that Snowden "produced a ten -minute video entitled PGP for Journalists. The Daily Dot did not acknowledge the discrepancies in video length and title between its own account and Greenwald's version.

See also

References

  1. "Bundesregierung fördert Open Source" (in German). Heise Online. Retrieved July 24, 2013.
  2. "Release Notes". GnuPG. Retrieved 2014-01-30.
  3. "Gnu Privacy Guard". OpenPGP.org. Retrieved 2014-02-26.
  4. "Where to Get PGP". Philzimmermann.com. Retrieved 2014-02-26.
  5. ^ Werner Koch (2006-11-13). " GnuPG 2.0 released". gnupg.org. Retrieved 2014-01-30.
  6. Cite error: The named reference gnupg-2.0.22-announcement was invoked but never defined (see the help page).
  7. Cite error: The named reference gnupg-1.4.16-announcement was invoked but never defined (see the help page).
  8. "GnuPG: New web site and infrastructure". goteo.org. Retrieved 2014-03-09.
  9. "Mac GNU Privacy Guard". sourceforge. Retrieved 2008-04-29. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  10. "GPGTools Installer". gpgtools. Retrieved 2011-03-22. {{cite web}}: Italic or bold markup not allowed in: |publisher= (help)
  11. "FireGPG's developers blog". Retrieved July 24, 2013.
  12. "GnuPG Features". Retrieved October 1, 2009.
  13. Koch, Werner (2012-12-21). "GnuPG 1.4.13 released" (Mailing list). gnupg-users. Retrieved 2013-05-19.
  14. Phong Q. Nguyen "Can We Trust Cryptographic Software? Cryptographic Flaws in GNU Privacy Guard v1.2.3." EUROCRYPT 2004: 555–570
  15. GnuPG's ElGamal signing keys compromised Werner Koch, November 27, 2003
  16. False positive signature verification in GnuPG Werner Koch, February 15, 2006
  17. GnuPG does not detect injection of unsigned data, Werner Koch, March 9, 2006
  18. "Watch the video Edward Snowden made to teach Glenn Greenwald email encryption". The Daily Dot. May 13, 2014.
  19. "Excerpt from No Place to Hide". Glenn Greenwald. May 13, 2014.
  20. getfiregpg.org

External links

GNU Project
History
Licenses
Software
Contributors
Other topics
Cryptographic software
Email clients
Secure
communication
OTR
SSH
TLS & SSL
VPN
ZRTP
P2P
DRA
Disk encryption
(Comparison)
Anonymity
File systems (List)
Security-focused
operating system
Service providers
Educational
Anti–computer forensics
Related topics
Categories: