Vrlo često se čuju izrazi kao što su “javni ključ, privatni ključ, enkripcija, dekripcija”, itd, i svakom ko hoće da sazna šta je u pitanju pripadne muka kad krene da čita rfc-ove ili gugla po netu, zato što su objašnjenja obično kompleksna i nerazumljiva.
Međutim, to ne znači da treba stati i klonuti pred činjenicom da nešto što je komplexno nije vredno truda razumeti – lepota učenja je u savladavanju gradiva i učenje je, može se reći, najlepša od svih igara!
Da krenemo.
Računarski znalci su uveli princip “uparenih ključeva” – to je zapravo mehanizam koji omogućava da u digitalnom svetu vi saopštite – e ovo je mojih ruku delo jer sam ja potpisao da stojim iza toga. Uvode se 2 pojma= javni i privatni ključ. I javni i privatni ključ se generišu kroz matematičke mehanizme zasnovane na generičkim (”random”) 1024 ili 2048 – bitnim brojevima.
Prvi primer: ukoliko želim da pošaljem e-mail nekoj osobi i potrebno je da ta osoba bude sigurna da sam baš ja poslao emajl: uradiću enkripciju email poruke sa javnim ključem od te osobe. Zatim ta osoba iskoristi formulu po kojoj može dektriptovati (”odšifrirati”) emajl poruku samo koristeći njen privatni ključ. Znači, niko drugi ne može uraditi dekripciju tj dešifrovanje te poruke jer nema privatni ključ.
Drugi primer: ako neko želi da pošalje meni email a ja hoću da budem siguran da je ona poslala to, ta osoba treba da uradi “potpisivanje” (eng “singing) te poruke sa svojim privatnim ključem, a zatim ću ja, koristeći njen javni ključ, uraditi dekripciju te poruke.
Prilično dobro zamišljeno, right?
U Linux OS (ovde ću koristiti Debian, GPG paket što znači Gnu Privacy Guard).
Da bi smo videli postojeće ključeve, komanda:
~$ gpg –list-keys
Da bi smo generisali ključ, komanda:
~$ gpg –gen-key
gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) DSA and Elgamal (default)
(2) DSA (sign only)
(5) RSA (sign only)
Your selection?
DSA keypair will have 1024 bits.
ELG-E keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
“Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>”
Real name: Igor David
Email address: office@igord.net
Comment: LinuxSysAdmin
You selected this USER-ID:
“Igor David (LinuxSysAdmin) <office@igord.net>”
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++++++++++++++++++++++.+++++++++++++++++++++++<+++++……………………………+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++++++++++++…++++++++++.+++++++++++++++..+++++.+
gpg: key 4405CAB7 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
pub 1024D/4405CAB7 2009-09-04
Key fingerprint = 6BAB F155 A036 6D3A DFD9 0B0E 4D8A 3BE3 4405 CAB7
uid Igor David (LinuxSysAdmin) <office@igord.net>
sub 2048g/4F98B3C6 2009-09-04
Da proverimo kreirani ključ:
~$ gpg –list-keys
/home/igor/.gnupg/pubring.gpg
—————————–
pub 1024D/4405CAB7 2009-09-04
uid Igor David (LinuxSysAdmin) <office@igord.net>
sub 2048g/4F98B3C6 2009-09-04
Kreiranje javnog ključa:
$ gpg –armor –export office@igord.net > igord_pub_key
Kako izgleda javni ključ:
$ cat igord_pub_key
—–BEGIN PGP PUBLIC KEY BLOCK—–
Version: GnuPG v1.4.9 (GNU/Linux)
mQGiBEqg/C0RBADWGmt57jN4uU+mo+B5Wllkv9/cLmIku24It4DolbYKbriuARYP
SgszQTXlFV8BwKyunsdJa7jhLs1d5ij73kou4JhLOfKs+m0Oxw5fBwBZeZfgF1dh
5vWG7XuakrFFZgRa8ZCliyF+m2MFeyLyDkhUplaIIpqqSil75R8ntQ/5pwCg0jkp
0ntRVNJ00motQzf3LPU1C0MEAI53LoIyW8xNlVMEerA9UexWqq2PSYizws9vD0y9
jf3IMDN3eeitQQZ4//iJxwp8RTe8Mks+JjF+WHzjSyiNM6GGeXDk0ay3TJ+jGUva
KZ2cvu9+R9azm/C6W5RdgNaMvljTJuo1WJ2y78m4mzrrddQ/BZ6kijh66V/MhVM6
UP/iA/wNU6+lhh5TCOjbzSgXcKayl0YWGevUrn024/DGTDk0MmxdZh2BmxHYdeiG
3uhnCk2DO148+4r5CJPayP8Gu6tUKUgGufQPuQXowIBa/xqSJaPTyLKP3hd9VeHW
ENa/krR9mhv58Hjb8bqoYL1YYHlJu2EfIcrsDQgNAJaU6Rs1QbQtSWdvciBEYXZp
ZCAoTGludXhTeXNBZG1pbikgPG9mZmljZUBpZ29yZC5uZXQ+iGAEExECACAFAkqg
/C0CGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAKCRBNijvjRAXKt3/aAKC9CnNZ
IdHo1d3q1ku2zYgYzRHKDwCdFpr5OaNhLmLzgklADrYA5ptvC/a5Ag0ESqD8LRAI
AJFgVNIV6I4YMyKhcMnyG46YZFKe3LZhnLW4ERcf0IKDWGH+Q6oo+0WwPCVMHhzm
aO34t4TlbnMoqYPyVE/ZJiRcXs+ygYW0ectdIKpQ94pe/CgEi1Yw/LuV7TgsstKZ
MUwW+1YmhXM09zifItkMEziILUThsF+vHc+o93WBUJzk3VJNJgCuVWGTe5NenZIa
d/ipUg1JcT91nXO2J6/AdYnAPOY159dXygJPkwKfjgHo9IvaS+k7ymrkZWcevOUX
YOZogXp8u4uZTgJx2rfWHHszeXIhX0h+AdNdwzAEwad467TYVmh2b9qOM+1gHp4K
2Pa2MwddqkYcPM7PAf8nJgsAAwUH/RZoEAis5HOh1BEkY9aCOSvrouucHgpM7VXJ
j/bRy3nfoETaodK4kwcByp9a6qlBl4HVy6os0V13R1epPDNG0OqYfikcpK3VJvFx
CFa5UIcnku7+5xlSjNDFCg1Q516T5FLYDm9+IKPeMq8QaBZ/mp4N+8aQQa4TZi7U
tM4CvVVjAdU4SSRTSJ/DgQHcwjnpCSuNPb3N/SfeofVsNWXsUohs5XmvhI/M4wFF
fMLt/bfjYSty5ygeeOcN2LXR+JYCBkghppuo+i5tdcFbxBWIrSW5ScM9jawYXmWg
e3TTkPUYjFgnj7w2vZXWrk09wHfJWb/oakVn68iQQI3Pox+LRNGISQQYEQIACQUC
SqD8LQIbDAAKCRBNijvjRAXKt+2aAKCBYIaRXY3kCiNUPXnhttV+YoiNKQCeP5FQ
DJ+VXd//d+DHR2M/iMQhELc=
=rI9k
—–END PGP PUBLIC KEY BLOCK—–
Šta dalje?
Sledeća stvar bi bila kako neko koristi nečiji javni ključ i kako se to koristi?
Na primer, korisnik “test” hoće da koristi javni ključ usera “igor”.
Prvo, user “igor” treba da dostavi svoj javni ključ useru “test. Ovde treba biti oprezan = javni ključ je javno dostupan, ali on treba da se u ispravnom obliku zabeleži kod usera “test”, zato što bi u slučaju da nije dobro ubeležen, neko drugi mogao da iskoristi svoj privatni ključ i dešifruje podatke!
Na primer, user “test”, koji je i sam generisao svoj privatni ključ, je sačuvao javni ključ usera “igor” u textualni fajl “igord_pub_key“. Komanda za importovanje bi bila:
$ gpg –import igord_pub_key
gpg: key 4405CAB7: public key “Igor David (LinuxSysAdmin) <office@igord.net>” imported
gpg: Total number processed: 1
gpg: imported: 1
User “test” je importovao javni ključ usera “igor” i to je za sad dovoljno, međutim bilo bi poželjno i da verifikuje da je to stvarno njegov javni ključ (da se ne bi desilo gore opisano!). Sledeća komanda zapravo radi “verifikaciju” javnog ključa usera “igor”, tako da taj njegov javni ključ user “test” može koristiti bez problema:
$ gpg –edit-key office@igord.net
gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub 1024D/4405CAB7 created: 2009-09-04 expires: never usage: SC
trust: unknown validity: unknown
sub 2048g/4F98B3C6 created: 2009-09-04 expires: never usage: E
[ unknown] (1). Igor David (LinuxSysAdmin) <office@igord.net>
Command> fpr
pub 1024D/4405CAB7 2009-09-04 Igor David (LinuxSysAdmin) <office@igord.net>
Primary key fingerprint: 6BAB F155 A036 6D3A DFD9 0B0E 4D8A 3BE3 4405 CAB7
Command> sign
pub 1024D/4405CAB7 created: 2009-09-04 expires: never usage: SC
trust: unknown validity: unknown
Primary key fingerprint: 6BAB F155 A036 6D3A DFD9 0B0E 4D8A 3BE3 4405 CAB7
Igor David (LinuxSysAdmin) <office@igord.net>
Are you sure that you want to sign this key with your
key “Test User (Test user) <test@igord.net>” (98EA38FE)
Really sign? (y/N) y
You need a passphrase to unlock the secret key for
user: “Test User (Test user) <test@igord.net>”
1024-bit DSA key, ID 98EA38FE, created 2009-09-04
Command> quit
Save changes? (y/N) y
User “test” je sad spreman da šifruje svoje podatke, na primer fajl “tajna” u fajl “tajne_za_igora_:
$ gpg –output tajne_za_igora –encrypt tajna
You did not specify a user ID. (you may use “-r”)
Current recipients:
Enter the user ID. End with an empty line: office@igord.net
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u
Current recipients:
2048g/4F98B3C6 2009-09-04 “Igor David (LinuxSysAdmin) <office@igord.net>”
Enter the user ID. End with an empty line:
User “test” sad može da pošalje fajl “tajne_za_igora” i da bude miran, jer će samo user “igor” moći da ga otključa sa svojim privatnim ključem (jer je fajl prethodno šifrovan javnim ključem usera “igor”)!
Dakle, user “igor” samo treba da dešifruje fajl “tajne_za_igora” koristeći svoj privatni ključ:
$ gpg –output tajne_od_testa –decrypt tajne_za_igora
You need a passphrase to unlock the secret key for
user: “Igor David (LinuxSysAdmin) <office@igord.net>”
2048-bit ELG-E key, ID 4F98B3C6, created 2009-09-04 (main key ID 4405CAB7)
gpg: encrypted with 2048-bit ELG-E key, ID 4F98B3C6, created 2009-09-04
“Igor David (LinuxSysAdmin) <office@igord.net>”
napomena: svi useri i klučevi su ovde izmišljeni, u cilju objašnjenja.
