LOCAL ENCRYPTION Using GPG keys in conjunction with UNIX password manager “Pass”.

Scope of Presentation ■Estimated time: 1 hour. –Pass may be out of scope for presentation if we run long. ■Intended Goals: –Review history of PGP, GPG, and cryptography theory –Generate keypair with Raspberry Pi using thermal noise for TRNG –Separate master key with public key and signing subkeys –Add subkey to Yubikey for hardware smartcard –Store keypair in case of catastrophic failure or loss of keys –Brief overview of UNIX password manager ”Pass” ■All information can be found at murraycolin.org 1. Distil Networks 2 will have a blog post coming shortly, which will contain more information and be linked at aforementioned site

History of PGP, OpenPGP, and GPG ■PGP (Pretty Good Privacy) was created in 1991 and was the first software that was widely available implementing public key cryptiongraphy 1. ■In July 1997, Zimmermann proposed to the IETF to implement a new open standard OpenPGP. –RFC was created, and then RFC4880 is the current working standard 3. ■GPG (or GnuPG or GNU Privacy Guard) was then created, which is an OpenPGP compliant software written under the GPL

Cryptography Theory ■Computer are bad at generating random numbers on their own. –To a computerlooks as random as –Source 1 ■In order to create more entropy, we need to gather random variables from the physical environment (e.g. thermal noise or radiation). –Here is a link to a very interesting Youtube video explaining entropy a bit more in depth, in addition to providing another tool to generate entropy hardware-random-number-generator/ 2.

Cryptography Theory Continued ■No algorithm is safe forever: given enough time, any cryptography can be cracked. –The goal of a cryptographic algorithm is not to generate a “perfectly random” number, but to delay forced decryption for as long as possible. ■To elaborate: if computers become fast enough to throw enough numbers at a problem to brute force it (like with SHA1 1 ), the goal of an algorithm is to delay the inevitable for as long as possible. –1.024 MHz, $25.4 billion in MHz, $35 in –(Complete Apollo 11 program)(Raspberry Pi 2) 1.

Setting Up Environment ■Install Raspbian on Raspberry Pi and update/upgrade from repo. ■Install the rng-tools from apt-get. ■Set up BCM as according to website 1 –For information regarding BCM 2708 vs BCM 2835, please see blog. ■For all following slides, assume RSA hardware-random-number-generator/

Commands To Run On Pi ■sudo cat /dev/hwrng –Used in separate terminal to read thermal noise. ■gpg2 -–gen-key –1 (RSA and RSA (default)) –1y (1 year) –Fill out desired info accurately.

Commands To Run On Pi Continued ■gpg2 --expert --edit-key {Genereated Key} ■setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES TWOFISH ZLIB BZIP2 ZIP UNCOMPRESSED ■addkey –8 (RSA (set your own capabilities)) –a, s, e, q

Generate Revocation Keys ■gpg --armor –output {DESIREDNAME}.asc –gen-revoke {KEYID} –Use command for each key on keyring. ■Generate QR code for easier entry in case storage fails 1. –More backups do not hurt. If the SD card fails, a physical print out is always smart. ■cat {desiredname}.asc, and print output for text. 1.

Exporting Keys ■gpg –armor –export {KEYID} > {DESIREDPUBLICNAME}.asc –Exporting Public Key. ■gpg –armor –export-secret-keys {KEYID} > {DESIREDPRIVATENAME}.asc –Exporting Master Key (for backup). ■gpg –armor –export-secret-subkeys {KEYID} > {DESIREDSUBKEYNAME}.asc. –Exporting Signing Keys.

Importing Keys ■gpg --allow-secret-key-import –import {DESIREDSUBKEYNAME}.asc. ■gpg –import {DESIREDPUBLICNAME}.asc. ■gpg –list-keys –Verify public key installed on local computer. ■gpg –list-secret-keys –Verify signing subkey installed on local computer. ■gpg –edit-key {KEYID} ■trust, save.

Setup Yubikey Environment ■gpg --card-edit ■admin –Default admin PIN ” ” –Default user PIN “123456” ■passwd –1 for PIN, 3 for admin.

Adding to Yubikey ■gpg --expert --edit-key {signing subkey} ■toggle ■8 (RSA (set your own capabilities)) ■A, S, E –Authenticate, Sign, Encrypt. ■keytocard ■1 ■keytocard ■2 ■keytocard ■3 ■key 1, key 2, and key 3 to verify keys were copied to Yubikey.

Key Storage

Pass (Time Permitting) ■ ■Live demonstration.

Thank You For Your Time! ■Find me on the web: – - Portfolio – - Blog ■Where I work: – ■Tell me how I can improve and send me public keys at: