----BEGIN CLASS---- [13:27] #startclass [13:27] Roll Call [13:27] Jason Braganza [13:27] Nikita Kotak [13:27] Devesh Verma [13:27] Saikat Dey [13:27] Mohsin Mumtaz [13:27] Krishnanand Rai [13:27] Kshitij [13:28] Abhinav Shirur [13:28] Bhavin Gandhi [13:28] Mayank gupta [13:28] Priyansh Sourav [13:28] Abhilash Raj [13:28] Shivam Ahirao [13:28] Atul kumar [13:28] Gaurav Sitlani [13:28] Akshay Gaikwad [13:28] kshithij Iyer [13:28] Avik Mukherjee [13:28] Samridhi Agarwal [13:28] Messi Fc [13:28] Bhavesh Gupta [13:28] Aniket uttam [13:28] yurii pylypchuk [13:28] Ashwani Kumar Gupta [13:28] Balaji [13:28] Ravindra Lakal [13:28] Vivek Anand [13:28] Mriyam Tamuli [13:28] Himanshu Awasthi [13:28] Kundan Kumar [13:28] Atul Krishna [13:28] Sakshi Saraswat [13:28] Vamsi Krishna [13:28] pooja kumari singh [13:28] kumar vipin yadav [13:28] Mayur khomane [13:28] Deepika Upadhyay [13:29] Shivam Singhal [13:29] Mahendra Yadav [13:29] Chiranjeev Gupta [13:29] hemanth savasere [13:29] Sandeep Choudhary [13:30] Today, we have puiterwijk who is part of Fedora Infrastructure sysadmin team and also is the Fedora Infrastructure Security Officer. So, you know you are in the right hands to know about gpg. [13:31] puiterwijk: the channel is yours now :) [13:31] Hi. [13:31] Anu kumari Gupta [13:31] Roll Call: Nishanta Sarma [13:31] Hi puiterwijk [13:31] puiterwijk: Hi [13:31] Hello :) [13:31] So, as Sayan said, I sometimes do some things related to security/crypto. [13:31] Hi puiterwijk [13:31] Hello puiterwijk [13:31] Hello puiterwijk ;) [13:31] As such, Kushal asked me if I could give a quick intro to gpg and how to use it [13:31] puiterwijk Hello [13:32] Hi puiterwijk [13:32] Hi! puiterwijk [13:32] rollcall - Shashank Kumar [13:32] Okay, so, just to get a quick feeling: how many people here have a GPG key and have used it before (if you don't know what that is, don't worry)? [13:32] Roll Call- Kishore Saldanha [13:33] So, let's reverse: how many people do NOT have a GPG key? [13:34] me! [13:34] me [13:34] me [13:34] (And/or no idea what that is) [13:34] me [13:34] me [13:34] Me [13:34] me [13:34] me [13:34] me [13:34] me [13:34] me [13:34] Me [13:34] Me [13:34] me [13:34] me [13:34] Me [13:34] Me [13:34] me [13:34] me [13:34] Okay, great. At elast that confirms that this thing is on :) [13:34] me [13:34] no idea what that is [13:34] roll call Pradhvan Bisht [13:34] me [13:34] no idea [13:34] Okay, so GPG is an abreviation for GnuPG, which itself is an abreviation for GNU Privacy Guard. [13:34] me [13:34] i dont have key but have idea about it [13:35] It's basically an implementation of a crypto system you can use to exchange encrypted messages or sign messages [13:35] roll call :Apoorv Goel [13:35] join [13:35] JOIN [13:35] me [13:35] For first, make sure you can run "gpg --version" or "gpg2 --version" and it gives a version number. If not, now's the time to install it [13:36] The package is called "gnupg" (for v1) ofr "gnupg2" (for v2) in Fedora and Ubuntu [13:36] Preferably you would use gpg2 by now, but if you only have gpg, that's fine too. [13:37] I will probably just say "gpg" in the example commands, because I have done an alias gpg=gpg2 because I like typing less. But most commands should be identical between both [13:38] Is there anyone that doesn't have a version output with "gpg --version"? [13:39] So, let's first get you all a GPG key, so that we can start showing things by example [13:39] roll call : soumam banerjee soryy for being late [13:39] run this command: "gpg2 --gen-key" to start the key generation wizard [13:40] It will ask you for your name, email address and comment. Please enter your actual name/email there, and leave comment empty (just press enter). Then hit O and enter when it asks to confirm. [13:40] ! [13:40] If you're using gpg1, it will also ask about key type and size (leave those to default) and expiration (enter 2y and press enter, and confirm)) [13:40] ashwanig: yes? [13:41] sorry by mistake [13:41] Ah, okay [13:41] ! [13:41] After that, it will ask you for a passphrase. Enter a strong passowrd there, and hit Ok [13:41] (you will need to enter it twice) [13:41] saptaks: yes? [13:41] ! [13:42] can/should I have multiple gpg keys for the same email id? [13:42] ! [13:42] next [13:42] next [13:42] saptaks: you can have that, yes. But it will most likely confuse you and others that are trying to send you a message. I would suggest holding off with that for now [13:43] hello [13:43] If there's time left, I can explain more about how multi-key works [13:43] seems I am late. sorry for interruption [13:43] puiterwijk: okay [13:43] next [13:43] (oooh, this bot is fancy!) [13:43] done saptaks asked my question [13:44] https://pastebin.com/01bSU1km [13:44] this is showing [13:45] poojaencoded: okay, that's what I said with the gpg1 case: then hit enter to default on keysize, hit enter to default on key type, and then enter 2y enter, y enter [13:45] (gpg2 takes these values as default) [13:45] ok puiterwijk [13:45] next [13:45] next [13:46] Okay. So, is anyone still busy generating a key? [13:46] ! [13:46] ! [13:46] next [13:46] I got this error [13:46] https://pastebin.com/KVkcrMrS [13:46] anyone pm me the logs i am late :( [13:46] ! [13:46] that looks like you didn't enter a passphrase twice? [13:47] (or hit ctrl-c) [13:47] CHOCOS1: the session is still going [13:48] next [13:48] ! [13:48] puiterwijk it did not asked for any pharse [13:48] I'm getting `Error: The trustdb is corrupted`. Trying to fix it [13:48] ! [13:48] ! [13:48] sandeepK: hmm, okay. That sounds like you might be using GNOME and the gnome-keyring comes in the middle [13:49] Maybe you can try in a VM or something that doesn't have GNOME? [13:49] puiterwijk ok [13:49] bhavin192: if you're using gnupg1, rm ~/.gnupg/trustdb.gpg [13:49] next [13:49] Should I delete the key if passphrase is forgotten? [13:49] puiterwijk, got it working :) [13:49] ! [13:50] puiterwijk, I'm using gnupg2 [13:50] ashwanig: I would suggest against deleting the key in that case, since other people might still use it, and you might remember the passphrase later. And if you delete the key, you can't decrypt anything anymore [13:50] bhavin192: ah, okay [13:50] next [13:50] why do we need a gpg key in the first place? [13:51] ahole[m]: so, a gpg key is the key with which you can sign messages or other people can encrypt messages to you. [13:51] ! [13:51] bhavin192: try doing it under sudo [13:51] It's showing trustdb is corrupted [13:51] ! [13:51] Did anyone ever tell you about the CIA of security? [13:51] shivamA1: then try it with gpg1 [13:52] puiterwijk: no [13:52] Basically, with a GPG key you can encrypt messages between you and the receiver of the message, so that other people that are listening in to you can not see what you're saying [13:52] puiterwijk: Nope [13:52] puiterwijk: i got the same error but got resolved when i used with sudo [13:52] CHOCOS1: i pm you :) [13:52] ! [13:53] ! [13:53] championshuttler: already did pm to CHOCOS1 [13:53] Can someone please send me previous log of this session? problem with network [13:53] wait im_mohsin [13:53] Okay, so in security there's three key words: Confidentiallity (can only the intended recipient read the messages), Integrity (did the message not get changed by someone else) and Availability [13:53] im_mohsin: pm me :) [13:54] If you abreviate those three words, it reads "CIA" [13:54] It's working puiterwijk [13:54] championshuttler, Got it :) [13:54] So, with GPG you can encrypt a message, which gives you confidentiallity, and you can sign a message, which provides integrity [13:54] ! [13:54] next [13:54] ! [13:56] next [13:56] I am getting this error https://paste.fedoraproject.org/paste/T1lCePFnCkbGGZHYN8rYKw tried using sudo too [13:56] ravindra: is this with gpg2 or gpg? [13:57] gpg2 [13:57] Okay, can you try with gpg? [13:57] ok [13:57] next [13:57] How can I see my generated key? [13:58] ravindra: i think you exit during generation [13:58] balaji: great question: run gpg(or gpg2) --list-secret-keys [13:58] Do note: if you generated the key with gpg, use gpg for the rest of the session. If you generated it with gpg2, use that from now on. And if you ran it with sudo, you will have to continue to use sudo from now on [13:59] (at least for now, I can help look further into all these failures later probably) [13:59] next [13:59] what is the use of asking email address it asked? [13:59] apoorv: GPG uses the email address to determine which key to use when people send you a message [13:59] You can look up a GPG key by email address, e.g.: https://keys.fedoraproject.org/pks/lookup?search=patrick%40puiterwijk.org&op=vindex [14:00] okay thank you [14:00] next [14:00] puiterwijk, after real name and email id it is asking for comment [14:00] poojaencoded: right. Just hit enter there [14:00] Leave that empty for now [14:00] ok [14:00] That's more useful if you have multiple keys [14:00] next [14:00] is whatsapp using gpg key? [14:00] championshuttler: no. They have their own system [14:01] They could use it, but I don't think they are [14:01] next [14:01] puiterwijk, It shows sec and ssb in secret keys . Can you explain that ? [14:01] putty-gen does something similar right ? [14:01] what is 'Availability' ? [14:02] ahole[m]: putty-gen generates an SSH key, which is used for authentication purposes. But yes, it also generates a key, the key is just used differently [14:02] next [14:02] what is 'Availability' ? [14:02] knrai: Availability comes down to that the system should be Available, so people should be able to use it [14:03] In other words, a server that is powered off is totally secure, but not available :) [14:03] knrai, Where did you find Availability? [14:03] ashwanig: I just explained the CIA of security [14:03] (Confidentiallity, Integrity, Availability) [14:04] puiterwijk, Ah okay :) [14:04] Okay. So I'm going to assume that everyone now has at least a GPG key. [14:04] Let's move on to how you can use it [14:04] First, as I already said earlier: please run gpg --list-secret-keys, that should list your key [14:05] (as I said before: use the same command for "gpg" that you used when generating the key, whether that's gpg, gpg2, or sudo gpg(2)) [14:06] That will print output that contains for example a line like "sec rsa2048/0x3C0F28BCB48895CF 2017-07-19 [SC] [expires: 2019-07-19]" [14:06] After that, it will print a line "uid [ultimate] DGPlug Testing " [14:06] puiterwijk: can u repeat the command [14:07] shivamA1: gpg --list-secret-keys [14:07] Okay ty [14:07] Thank you [14:07] Those lines contain a lot of information. [14:07] shivamA1, Kicking you out for typing in sms language. [14:07] ! [14:07] The uid line contains the name and email address [14:07] next [14:08] Actually I tried using both got and gpg2 .what I found was using gpg created secrings and pubrings [14:08] anuGupta: correct. That is no problem, just ignore that for now [14:08] I am using gpg2 [14:09] Sorry won't do it again kushal please [14:09] Ok [14:09] Okay, so, the "uid" line contains your name and email, this is called the User ID (thus uid) [14:09] The other interesting line for now is the "sec" line [14:09] That tells you that that's a secret key [14:10] ! [14:10] the next part, rsa2048 is the key type and size: RSA algorithm, 2048 bits [14:10] The next part, that starts with 0x3C0F... in my case is the key ID. That's a unique identifier for this key [14:10] The next field is the creation date (I created this today, so it says 2017-07-19) [14:11] the "SC" part indicates that this is a primary key ("C" for Certify) and that it is used when you sign things ("S" for Sign), and the last part is indicating when this key will expire [14:11] next [14:11] why is there "[ultimate]" written before name and email-ID [14:12] hemanth_: that is an indicator by GPG that this key is marked as "ultimately trusted", which basically means that it's a key you generated yourself [14:12] ! [14:12] ! [14:12] in GPG, you can mark keys as trusted to a certain level. And ultimate is the top level, which is used for your own keys (since you're pretty sure who you are, hopefully) [14:12] next [14:12] ! [14:12] no expire part in mine ? [14:13] thank you puiterwijk [14:13] ! [14:13] ! [14:13] ! [14:13] s/there is [14:13] apoorv: then you probably didn't generate the key just now, or you entered a "0" during creation for expiration. That's fine for now [14:13] ! [14:13] okay [14:13] My personal suggestion is to make keys that last two years and then generate a new one, so you change keys often, and that if you lose the private key it's not a big problem [14:13] (since people will stop using it) [14:14] next [14:14] In the SC part , what does it certify? [14:14] ! [14:14] ! [14:14] And why is it done? [14:14] sitlanigaurav[m]: that key is used to sign the "uid" part of the key. So, basically, with that key you sign a statement "I am $myname" [14:14] ! [14:14] That is done when you generate a key, or add extra uids or other subkeys to the key [14:15] next [14:15] done [14:15] next [14:15] What does ssb stand for? [14:15] What is the typical application for gpg? [14:15] ashwanig: that's a Secret SuBkey [14:16] What is that? [14:16] kishore: a lot of people use it for 1. sending emails, or 2. verifying messages from other people [14:16] ok [14:16] ashwanig: basically, a second GPG key that's "attached" to the main key. [14:16] next [14:16] ! [14:16] next [14:16] After the key expires, i have to use the same command to generate a new or anything else to update? [14:17] ! [14:17] ! [14:17] im_mohsin: my suggestion would be to generate a new key, but you could edit the key to change the expiration date [14:17] next [14:17] I am having the expired date the same,that is, today's date [14:17] anuGupta: can you paste the "sec" line here? [14:17] ! [14:17] Ok [14:18] How to actually use it to the first two point? [14:18] kishore: a lot of people use it for 1. sending emails, or 2. verifying messages from other people [14:18] ahole[m], have patience [14:19] next [14:19] ! [14:19] Apology for speaking out of turn. Got a bit excited. [14:19] ahole[m]: no worries. Basically, you want an email client that supports it. Either thunderbird (with the enigmail extension) or mutt (text-based) are good choices in my opinion [14:19] avik: ? [14:20] puiterwijk, will it be possible for you to give an live demo of using the gpg keys? [14:20] avik, He is giving that only. [14:20] avik: I was hoping to get time to do that today :) [14:20] next [14:20] In both sec and ssb, we have different key id, which one is to provide? Also my date of expiry is same as date of issue. Why so? [14:20] ok :D [14:20] skarpy: the sec one. And can you paste the "sec" line here? [14:20] puiterwijk: ok [14:20] next [14:21] I got this https://paste.fedoraproject.org/paste/LM8pn-8hFg-Hj6E6l43S7w . Is this okay? [14:21] paste.fedoraproject.org/paste/MynNRzNwvUqqn~vEUaF8og [14:21] anuGupta: you do not have an expiration date. You just have two creation dates, one for the primary key and one for the subkey [14:21] atultherajput: yes. Same as anuGupta [14:21] skarpy: please check your output against anuGupta's. If it looks the same, same answer applies to you [14:21] next [14:22] okay :) [14:22] How does the trust work in case of subkeys? Does it have exact same level of trust as the master key? [14:22] Ok [14:22] maxking: trust is assigned to the primary key and to the uids, not to subkeys. [14:22] puiterwijk: so how should i know when the key will expire? yes its same. [14:23] skarpy: then your key doesn't expire [14:23] (that means your gpg2 had a different default) [14:23] puiterwijk: cant i generate something which can expire at a certain time? [14:23] maxking: or even more correct: you trust a "uid", not a key. [14:23] ! [14:23] skarpy: you can, but then you need the full generation wizard: gpg2 --full-generate-key [14:23] puiterwijk: thanks, that makes sense actually. [14:23] ! [14:23] maxking: great! :) [14:23] ! [14:23] puiterwijk: ok, thanks :) [14:23] next [14:24] already asked [14:24] next [14:24] How do I make keys last for a specific time, i.e. set an expiration date(like you said it is good to keep keys for 2 years and then change)? I have the same case as anuGupta and atultherajput . [14:24] skat_sd: okay, so generate the key with gpg2 --full-generate-key [14:24] That will ask you what expiration date you want [14:24] next [14:24] Is it possible to have multiple keys with same email id, here mine is showing 2 keys ! [14:25] puiterwijk: What is the benefit of the expire feature of the key as we can have key that do not expire also ? [14:25] Yes, that is possible, but might be confusing. For now, don't worry too much [14:25] next [14:25] ! [14:26] Cyber_freak: so, I suggest all people that start with PGP to use an expiring key. At some point, you are likely to lose access to the private key, and then you can't revoke the key so that other people stop using it. If it expires, everyone will stop using it at expiration date [14:27] thanks puiterwijk got it :-) [14:27] next [14:27] is this correct because I was not getting similar output to anuGupta https://paste.fedoraproject.org/paste/MS9P6w3gSPLT2x02pWU6jA [14:27] (and yes, there are other ways to revoke it) [14:27] ! [14:27] ! [14:27] ! [14:27] devesh_verma__: yeah, same reply: your key doesn't have an expiry, abnd can use gpg2 --full-generate-key to generate a new key that expires [14:27] next [14:27] Can I delete my key before expiration? [14:28] ! [14:29] mayur01: if you generated the key just now: yes. Run gpg --delete-secret-keys $keyid [14:29] next [14:29] I was having trouble because of gpg agent in generation though fixed, yet wanted to know what role does it play in key generation [14:29] [14:29] Ok Thank you. [14:29] deepika: with gpg1: not much, with gpg2: everything. A major change between gpg1 and gpg2 is that all the crypto operations have moved to the GPG agent, so without an agent, GPG2 can't work [14:30] (with gpg1 it's just used to store your passphrase temporarily in computer memory so you don't need to re-enter it every single time) [14:30] next [14:30] gpg --list-secret-keys i am not getting any output for this :( [14:30] CHOCOS1: what command did you run to generate the key? [14:31] sorry my mistake got it [14:31] next [14:31] Even my key doesn't expire,, so should i delete my .gnupg directory and then fully generate key? [14:31] neer: for now, yes. [14:31] next [14:31] in anuGupta output theres a big number after [SC] but for me I have a number after rsa2048/ I dont have that in mine. Why is there such difference ? [14:32] puiterwijk Oh thanks, understood :) [14:32] ! [14:32] devesh_verma__: that's just a different in output. The big number is the full key fingerprint, which is the longer version of what is behind rsa2048 [14:32]