Some doubts about GnuPG

Question

I've reading on GPG since yesterday and I have a doubt: the whole system of double key encryption does make sense but it looks to me like either way you are compromising something in terms of security.

If someone sends me an encrypted file using GPG and he/she wants to make sure that I'm the only one able to decrypt it then he/she will encrypt that file using my public key. Now, the only way to decrypt it is to use my private key, which supposedly I'm the only one in the world to have it. So far, so good.

However, if we also want to make sure that there are no forgers and that we're actually exchanging files between us (issue 1) then we would need to encrypt files using each one their own private key. This requires us to share our public keys. But here we go, another problem (issue 2): what if I published my public key on a website/blog/etc. some time ago and I had forgot about it? What if an intruder is able to intercept such messages and by using the public key (that he/she found online) is now able to decrypt files?

The way I see it you have to compromise, and you can't really mitigate 100% both issue 1 and 2. Did I misunderstood something about GPG?

At this point, why not simply try to rely on a 7zip encryption and use a (moderately complicated) passphrase that you both know?

Thanks!

Answer 1

You cannot encrypt a file with a private key. With RSA, that's not because of any technical obstacle (with other schemes private keys literally are not valid inputs to the encryption function), but because private keys are designated as "private" and using them in an encryption operation compromises the security of that message. To prove you wrote the message, you don't encrypt it with your private key.

What you do do is sign the message. Signatures take a private key; best practices are to use a different keypair for signatures than for encryption (a default GPG "keypair" is really at two keypairs; there's a master keypair that's tied to your identity which is used only for signing, and a different subordinate keypair which is signed with the master keypair and which is used only for encryption). If you use different keys for signing and encryption, there are no issues with compromising your encryption.

Signing with RSA is not "encrypt with the private key." It has a passing resemblance to that (as the primitive used for encryption, the one for signing, the one for decryption, and the one for verification are all the same operation with different inputs and outputs) but it is a conceptually distinct algorithm which is designed not to let someone with the signature recover the message.

An RSA signature is created by creating a preimage-resistant hash of the message, doing various operations (known as padding) to the hash value to increase security, and passing it through the signature primitive (raising it to the power of the private exponent modulo $n$). In the more modern signature padding algorithm (PSS), the hash of the message is itself not recoverable, because it is combined with a random salt and passed through another preimage-resistant hash, and that is part of what's passed to the signature primitive (the other part is the salt, obfuscated using the hash of the hash+salt). In the older system (PKCS 1.5 padding), the hash could be directly recovered, but as it's preimage-resistant that doesn't give much help to an attacker looking for the message. An attacker in either case can test whether a given message was the one sent, but they can't find the message if they don't already have a candidate message.

Answer 2

I think your major misunderstanding stems from the fact that to authenticate a message (and a file is simply a message) you don't encrypt it, you sign it.

So the classic example is Alice wants to send a message to Bob but it may be observed by Eve. Alice and Bob want to ensure that a) only Bob can read the message and b) that Bob can verify the message was sent only by Alice. Secure key exchange is outside the scope of your question so lets assume that Bob and Alice already have generated their own keypairs and already have the public key of the other person.

Alice would first SIGN the message using her private key and then ENCRYPT both the message and the signature (normally combined but could be sent separately) using Bob's public key. Bob would then DECRYPT the message and the signature using his public key and then VERIFY the signature using Alice's public key.

This is a simplified example as public key cryptography is expensive so we want to minimize the amount of data that is involved in public key cryptography. To do that a hash will be taken of the message and that is what is signed not the actual message. The message will also not be encrypted using the recipient's public key. Since symmetric encryption is much faster, the sender will randomly generated a symmetrical key of sufficient size and use AES of some other symmetric cipher to encrypt the message (and signature). The message key is then protected by encrypting it with the recipient's public key. The sender will then send the encrypted message, the encrypted signature, and the encrypted message key to the recipient.

To decrypt and verify the receiver will first decrypt the symmetrical message key using his private key. The message key is then used to decrypt both the message and signature. Finally the receiver will hash the message and verify the signature using the message hash and the sender's public key.

This also has the added advantage of being able to have additional recipients with little overhead as the same symmetrical message encryption key can be encrypted using multiple receiver public keys and all the encrypted copies included with the message. The large message/file only has to be encrypted once regardless of the number of recipients.

Answer 3

Yes,

You totally got it wrong.

The idea if assymmetric crypto is quite simple. Everything you encrypt with one key can only be decrypt by the other. For the two key's it makes no difference which to use as private or public.

So if your public key is out there. A message encrypted with your public key can only be read by you. That's for the confidential if the message.

To prove who wad the sender if the message. You normally sign the message with your private key. This can than only be decrypt with your public key. What show's that you are the sender.