GNU Privacy Guard
From Wikipedia, the free encyclopedia
| GNU Privacy Guard | |
|---|---|
 |
|
| Developed by | GNU Project |
| Latest release | 2.0.9 / March 26, 2008 |
| OS | Cross-platform |
| Genre | PGP |
| License | GNU General Public License |
| Website | gnupg.org |
GNU Privacy Guard (GnuPG or GPG) is a replacement for the PGP suite of cryptographic software. GnuPG is completely compliant with RFC 4880, which is the current IETF standards track specification of OpenPGP. Current versions of PGP (and Veridis' Filecrypt) are interoperable with GnuPG and other OpenPGP-compliant systems. Although some older versions of PGP are also interoperable, not all features of newer software are supported by the older software.
GPG is a part of the Free Software Foundation's GNU software project, and has received major funding from the German government. Released under the terms of version 3 of the GNU General Public License, GPG is free software.
Contents |
[edit] History
GnuPG was initially developed by Werner Koch. Version 1.0.0 was released on September 7, 1999. The German Federal Ministry of Economics and Technology funded the documentation and the port to Microsoft Windows in 2000.
Because GnuPG is an OpenPGP standard compliant system, the history of OpenPGP is of importance. It was designed to interoperate with PGP, the email encryption protocol developed by Phil Zimmermann.
Version 2.0 was released 13 November 2006. The old stable 1.x branch, whose last version is 1.4.9 will be continued in parallel with the new GnuPG 2 series, because there were significant changes in the architecture of the program which will not fit every purpose.[1]
[edit] Usage
GnuPG is stable, production-quality software. It is frequently included in free operating systems, such as FreeBSD, OpenBSD, and NetBSD and nearly all Linux distributions.
GnuPG can be compiled for numerous operating systems. Cross compilation is not a trivial exercise, at least in part because security provisions vary with operating system and adapting to them is often tricky. High quality compilers should routinely produce executables which will interoperate correctly with other GnuPG implementations. Pre-compiled installations are available for popular operating systems including Microsoft Windows and Mac OS X.
Although the basic GnuPG program has a command line interface, there exist various front-ends that provide it with a graphical user interface. For example, GnuPG encryption support has been integrated into KMail and Evolution, the graphical e-mail clients found in the most popular Linux desktops KDE and GNOME. There are also graphical GnuPG front-ends (Seahorse for GNOME, KGPG for KDE). For Mac OS X, the Mac GPG project provides a number of Aqua front-ends for OS integration of encryption and key management as well as GnuPG installations via Installer packages.[2] Instant messaging applications such as Psi and Fire can automatically secure messages when GnuPG is installed and configured. Web-based software such as Horde also makes use of it. The cross-platform plugin Enigmail provides GnuPG support for Mozilla Thunderbird and SeaMonkey. Similarly, Enigform and FireGPG provide GnuPG support for Mozilla Firefox.
In 2005, G10 Code and Intevation released Gpg4win, a software suite that includes GnuPG for Windows, WinPT, Gnu Privacy Assistant, and GnuPG plug-ins for Windows Explorer and Outlook. These tools are wrapped in a standard Windows installer, making it trivial for GnuPG to be installed and used on almost any recent Windows system.
[edit] Process
GnuPG encrypts messages using asymmetric keypairs individually generated by GnuPG users. The resulting public keys can be exchanged with other users in a variety of ways, such as Internet key servers. They must always be exchanged carefully to prevent identity spoofing by corrupting public key ↔ 'owner' identity correspondences. It is also possible to add a cryptographic digital signature to a message, so the message integrity and sender can be verified, if a particular correspondence relied upon has not been corrupted.
GnuPG does not use patented or otherwise restricted software or algorithms, including the IDEA encryption algorithm which has been present in PGP almost from the beginning. Instead, it uses a variety of other, non-patented algorithms such as CAST5, Triple DES, AES, Blowfish and Twofish. It is still possible to use IDEA in GnuPG by downloading a plugin for it, however this may require getting a license for some uses in some countries in which IDEA is patented.
GnuPG is a hybrid encryption software program in that it uses a combination of conventional symmetric-key cryptography for speed, and public-key cryptography for ease of secure key exchange, typically by using the recipient's public key to encrypt a session key which is only used once. This mode of operation is part of the OpenPGP standard and has been part of PGP from its first version.
[edit] Problems
The OpenPGP standard specifies several methods of digitally signing messages. In 2003, due to an error in a change to GnuPG intended to make one of those methods more efficient, a security vulnerability was introduced.[3] It affects only one method of digitally signing messages, only for some releases of GnuPG (1.0.2 through 1.2.3), and there were less than 1000 such keys listed on the key servers.[4] Most people did not use this method, and were in any case discouraged from doing so, so the damage caused (if any, and none has been publicly reported) would appear to have been minimal. Support for this method has been removed from GnuPG versions released after this discovery (1.2.4 and later). Two further vulnerabilities were discovered in early 2006; the first being that scripted uses of GnuPG for signature verification may result in false positives,[5] the second that non-MIME messages were vulnerable to the injection of data which while not covered by the digital signature, would be reported as being part of the signed message.[6] In both cases updated versions of GnuPG were made available at the time of the announcement.
GnuPG is a command-line based system, that is not written as an API which can be incorporated into other software. GPGME is an API wrapper around GnuPG which parses the output of GnuPG, and various graphical front-ends based on GPGME have been created. This currently requires an out-of-process call to the GnuPG executable for many GPGME API calls. Because GPGME makes use of a special GnuPG interface designed for machine use, a stable and maintainable API between the components is given. Possible security problems in an application do not propagate to the actual crypto code due to the process barrier.
Other software wraps the command line in a Perl script (e.g. gpg-dialog) that is menu based and more user friendly.
[edit] See also
- E-mail privacy
- Key signing party
- Asymmetric key algorithm
- Cryptosystem
- Enigmail - Thunderbird plug-in
- Enigform
- Claws mail - email client with GPG plugin
- Mutt - email client with PGP/GPG support built-in
- Comparison of e-mail clients
[edit] References
- ^ GnuPG-2.0 released, Werner Koch, 2006-11-13
- ^ Mac GNU Privacy Guard. sourceforge. Retrieved on 2008-04-29.
- ^ Phong Q. Nguyen "Can We Trust Cryptographic Software? Cryptographic Flaws in GNU Privacy Guard v1.2.3." EUROCRYPT 2004: 555–570
- ^ GnuPG's ElGamal signing keys compromised Werner Koch, November 27, 2003
- ^ False positive signature verification in GnuPG Werner Koch, February 15, 2006
- ^ GnuPG does not detect injection of unsigned data, Werner Koch, March 9, 2006
[edit] External links
- Project home page
- A Short History of the GNU Privacy Guard, written by Werner Koch, published on GnuPG's 10th birthday
- GPG on Freshmeat
|
|||||||||||||||||||
