• Telecom Lobby
  • OpenBSD, Tor and Privoxy
  • OpenBSD, virtualization and Privoxy
  • OpenBSD and OpenPGP
  • Gentoo and Raspberry

OpenBSD is back! Now with GnuPG

Another friend, another animal, a gnu.

And yes, this gnu is special . First of all is a capital letters GNU, he likes free software, and our special one also like electronic music. But not only free software , he is specialized also in privacy, he can be the guardian of our privacy! Because one of the hottest applications in this wonderful GNU world is GnuPG a mature piece of open source software:

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG allows you to encrypt and sign your data and communications; it features a versatile key management system, along with access modules for all kinds of public key directories. GnuPG, also known as GPG, is a command line tool with features for easy integration with other applications. A wealth of frontend applications and libraries are available. GnuPG also provides support for S/MIME and Secure Shell (ssh). Since its introduction in 1997, GnuPG is Free Software (meaning that it respects your freedom). It can be freely used, modified and distributed under the terms of the GNU General Public License .

OpenBSD want your pretty good privacy

Speaking about pretty obviously my first tough is a wonderful woman . And doing a simple association my connected brain has elaborated this image, a wonderful Julia Roberts singing a song in the set's bathroom of pretty woman , do you remember it? But you have to understand that pretty have to be also our privacy in a interconnected world, the Internet . Every single man and woman (child i don't think that have to use it) in the world have access to the Internet, but only a little part know how to protect him/her privacy from what we've previously named the privacy cannibals . Today we add another friend to our great guarantees of privacy, a cool dude that follow the OpenPGP standard that you can freely study reading the RFC 4880.

Create the perfect pgp keypair with OpenBSD

Ok let's go deep and start the configuration of our GNU PGP . Install the software from ports repository:

We've deleted possible previous gnupg configuration, recreate the user directory of the program, assign to it the correct permissions and install the version 2 of the gnupg collection.

Create the bootstrap gpg configuration file in our previously created directory.

We're creating a no expiring master key in our home directory, using RSA sign only option with the maximum key size that is 4096 bits . In gpg every key is associated with a user ID, in our case is npna@protonmail.ch . Remember to use a strong unpredictable password and to anote and store it in a secure place (¿do you remember what is a pen and what is a paper? ). It's important for the rest of the configuration know the result keyid , for our case is 0xAD8E487FF2F05FDE . Go ahead with the deep configuration:

Now we've entered in the gpg shell! Look at the new prompt gpg> . From there we can access to all the possible commands of our GNU privacy suite.

We've created a key that depend from our master key, selecting RSA for encrypt only. This is our encryption key.

Now we've created another sub key. This time to sign only, always with the RSA protocol. His size is as usual 4096 bits .

At last we've created a sub key for authentication purpose. Thanks to the --expert option that we've used we can edit like a pro our last RSA key using the (8) option in our gpg shell. Follow the commands and we've finished! Don't leave the last save if you don't launch it you will loose all! Review the created keys with:

Export to an encrypted USB stick

Ok, we've have created our 4 gpg2 keys, one master with 3 slaves, encryption, sign and authentication . Let's prepare an encrypted fresh USB stick to backup them!

We've initialized the USB stick with the OpenBSD fdisk with a GPT partition table and the we add a single RAID partition to it with disklabel. We use RAID because this is the manner that use OpenBSD to do it.

We've encrypted the first partition label of our USB stick with the command bioctl that result in the creation of the pseudo device sd3.

OpenBSD, OpenPGP, Bob and Alice but also a little bit of magic. In this catch from viaggi di nozze the Italian iconic actors Carlo Verdone and Claudia Gerini listening to some good heavy metal remember the most special situation where they have some good sex. Like them, or better i wish it'll be, our two friends OpenBSD and GnuPG continue them relation. Last time we've seen how to install, generate master key and subkeys (sign, encryption and authentication) and backup all of them in an encrypted usb stick under OpenBSD. The result of those operation can be resumed and visualized with this command:

Export the public key to the Internet

To publish our public key to the Internet allowing others OpenPGP users establish a secure channel of communication with us (i know it's not perfect but combined with other technologies it's the state of the art ) we've to export our public key 0xAD8E487FF2F05FDE to one the keyserver of the pgp network . Let's start with our shell sex :

We download the CA certificate of the keyservers pool sks-keyservers.net with its PGP signature (.asc file ). We verify it with the openssl suite and then we extract the "X509v3 Subject Key Identifier" and check if it is the same with the one that we've here.

Like you can see we've just added one new directive in our gpg.conf file after resolving the pool of keyservers sks in a single ipv4 address. Next we've created a new configure file for dirmngr that is the daemon resposible of the access to the OpenPGP keyservers

this is the normal command to transfer our pub key who owner is [ultimate] No Place No Address (No Place No Address) <npna@protonmail.ch> ; after some minutes we can search our public key in the OpenPGP network here.

Encryption using public key is AWESOME

We want to establish a secure communications channel between npna@protonmail.ch and r.giuntoli@protonmail , without public key encription and signing will give us a lot of headchache. Using it produce this esquema:

In practice never Alice or Bob have to send in an insecure channel, like Internet , their private keys. In my example alice got a Gentoo workstation, and Bob an OpenBSD one. The two folks have uploaded their public keys using the OpenPGP suite. The two trust each one and can verify the fingerprint of the other utilizing a secure channel, like they are in the same room creating this example.

Are you sure that you want to sign this key with your key "Riccardo Giuntoli r.giuntoli@protonmail.ch" (0xA51D8EF938AF47D0)

Really sign? (y/N) y

So we search the public key of Alice in the keyserver , in this case we've got only a possible key, we select pressing 1 at the OpenPGP shell. Next we enter in edid mode and always at the OpenPGP shell and we see that also Bob have created three subkeys one for encryption, another for signing and the last for authentication. We print the fingerprint to validate it with Bob to locally sign it with the option sign . We save and the returl to the bash shell.

We do the same process in the Bob OpenBSD machine:

In this case the reply at our search are three diferents keys, we install the first.

Alice encrypt and sign the message Я хочу встретиться с тобой for Bob. The process is simple, she piped it to gpg that is launched with:

1. --armor the result of the process have to be always text.
2. --sign she sign it with her subkey dedicated to the sign operation.
3. --ecrypt she encript it.
4. -r Bob the message will only readable by Bob (that seems to be russian ).
5. - it indicate to gpg that the text in input was piped.

Now she use a free past service to upload it to the Internet , the result is there:

ghostbin free past service, a message for you darling

So Bob is very exited and want to rapidly verify and decrypt his love message :

Silently download the message and save in local testmsg text file and use gpg --decrypt to read his message.

OpenPGP others applications and a little bit of magic

With the OpenPGP suite we can also simply encrypt a file or folder.

But Bob want to be more 31337 and want to hide a secret message in an image, embedding in it using a technology knowned as Steganography. And with OpenBSD is a nice and rapid task.

To obtain this little magic , Bob install steghide from the official ports of OpenBSD, next he write a text message and embedded protected with a password in the jpeg image.

Now he saves the jpg image in his harddisk with gpg and symmetric encryptions. When he will send to Alice he will decrypt it and reuse the public method.

Nice, i'm in love with this Bob and Alice story, i'm in love with my work that is and will be write about security stuff, protecting privacy for who want it.

love is back, RG