|
Presumably you are reading this because you received an e-mail from me with this signature:
This message was digitally signed. If you are curious, or worried about an "unknown attachment", see http://cromwell-intl.com/digsig/ _---___-_-_-_-___-______-_---_---___-_---___-_---_-_-___-_---_-_-___-_-_-_ All unencrypted communication by Internet, telephone, and fax is subject to interception and archiving. Corporate announcements of desire for deletion by unintended recipients accomplish nothing. ______-_-_-_-___-_---___-_-_-_---___-______-___-_---___-_---_-___-_-_-____ PGP key fingerprint: 6EBE A241 1131 573C 944E 7FC3 1343 C15E 62FE 4DD1
A digital signature is a security mechanism based on cryptography. It allows someone to verify two crucial aspects of information security:
If the digital signature can be verified, then you can have very high confidence in data integrity and sender identity. If it cannot, then either the data has been somehow modified or it is an attempt to spoof the identity of another sender. You cannot tell precisely how it was modified — what was changed, added, or deleted — just that something was done to it.
The simple answer, what you would need to do, is import my public key into your PGP keyring and make sure that your mail tool uses it.
Unfortunately, despite the fact that my messages are signed using the OpenPGP standard, a standard dating from November 1998, many people seem to use mail tools that do not understand it. If you're reading this because you were puzzled or worried by mysterious "unknown attachments" reported by your mail tool, then you are one of those people using lame mail tools.
If you're curious about the cryptography, about the mechanics (or really the mathematics) of how a digital signature is created and verified, see my "Just Enough Cryptography" page for an overview.
You must understand that digital signatures do not provide confidentiality.
While they are based on cryptography, digital signatures do not encrypt the message. Anyone can read a digitally signed message. The signature itself is just a distraction or is ignored if you or your mail software do not use it.
All communication on public telecommunication networks — Internet, telephone, facsimile, etc — is subject to interception and archiving. It is easy for governments to do this because Internet and telephone traffic must pass through a limited number of backbone interconnection points. The governments simply obligate the telecommunications companies to provide access, or even to do the data collection on behalf of the government.
Yes, this process was greatly expanded in the U.S. during the Cheney/Bush administration, but it had already been underway for many years. See, for example:
The only defense, potentially very powerful if done very carefully, is to encrypt the message. The encrypted message, the ciphertext, can still be intercepted and archived. However, the intercepting agency would have to decrypt the message to make any sense of it beyond the fact that at some time person A sent a message to person B.
Again, see my "Just Enough Crypto" page to see what would be involved to protect your communication, and what would be required to attack the encryption.
Below is an actual message. First, notice the header field specifying the boundary between message components. The randomly generated delimiter nextPart16255220.hNzM6UnThX is highlighted where it appears in the message body to separate the message itself from the signature. The sender's mail application randomly generated this distinctive string that does not appear within the message body.
Then the message body itself has a green background, and the PGP digital signature has an orange background.
From bob.cromwell@comcast.net Thu Feb 25 19:39:43 2010
From: Bob Cromwell <bob.cromwell@comcast.net>
Reply-To: bob.cromwell@comcast.net
Organization: Cromwell Intl
To: cromwell@ecn.purdue.edu
Subject: Here is an example of an OpenPGP message
Date: Thu, 25 Feb 2010 19:39:11 -0500
User-Agent: KMail/1.9.10
MIME-Version: 1.0
--nextPart1304702.zeePTlEpVM Content-Type: multipart/signed;
boundary="nextPart16255220.hNzM6UnThX";
protocol="application/pgp-signature";
micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <201002251939.17688.bob.cromwell@comcast.net>
Content-Length: 1248
--nextPart16255220.hNzM6UnThX
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
This is the message body.
All of the message body has been protected with cryptographic
"tamper protection" in the form of a digital signature.
Bob
--
This message was digitally signed. If you are curious, or worried about
an "unknown attachment", see http://cromwell-intl.com/digsig/
_---___-_-_-_-___-______-_---_---___-_---___-_---_-_-___-_---_-_-___-_-_-_
All unencrypted communication by Internet, telephone, and fax is subject
to interception and archiving. Corporate announcements of desire for
deletion by unintended recipients accomplish nothing.
______-_-_-_-___-_---___-_-_-_---___-______-___-_---___-_---_-___-_-_-____
PGP key fingerprint: 6EBE A241 1131 573C 944E 7FC3 1343 C15E 62FE 4DD1
--nextPart16255220.hNzM6UnThX
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (OpenBSD)
iEYEABECAAYFAkuHGDEACgkQE0PBXmL+TdHaQQCfSFqUDeka7KhHKPv1fLYiAVUf
by4AoJvqSRIm/xAsl4H3PZUwxixqKqmi
=K47A
-----END PGP SIGNATURE-----
--nextPart16255220.hNzM6UnThX--
As you can see from the message header and the PGP signature block, this message was digitally signed with GNU Privacy Guard (GnuPG), through the KMail mail tool, part of the KDE desktop environment, running on the OpenBSD operating system.
However, since the message uses the OpenPGP standard format (from Nov 1998), specifically OpenPGP/MIME (from Aug 2001), modern mail tools should be able to handle it regardless of application, graphical environment, or operating system.
|
|
|
|||||||||
|
|||||||||
|
| © Bob Cromwell Feb 2012. Created with /bin/vi and ImageMagick, hosted on OpenBSD with Apache. Root password available here, privacy policy here. |
