Updated: $Date: 2003-02-28 16:16:22 +0100 (Fri, 28 Feb 2003) $ $Author: loic $GnuPG technical information
ADMINSITRATIVE PART
C.5. Cryptographic Services provided
[ ] Authentication (*) : ....................
[ ] Access Control (*) : ....................
[X] Signature (*) : DSA, ElGamal, RSA
[X] Integrity (*) : Encryption with SHA-1 checksum
[X] Confidentiality (*) : ElGamal, RSA, Triple-DES, CAST5-128, Blowfish, AES-128, AES-192, AES-256, Twofish
(*) Specify the names of the algorithms used.
TECHNICAL PART
General description of the product, the user manual: GnuPG uses public-key cryptography so that users may communicate securely. In a public-key system, each user has a pair of keys consisting of a private key and a public key. A user's private key is kept secret; it need never be revealed. The public key may be given to anyone with whom the user wants to communicate. GnuPG uses a somewhat more sophisticated scheme in which a user has a primary keypair and then zero or more additional subordinate keypairs. The primary and subordinate keypairs are bundled to facilitate key management and the bundle can often be considered simply as one keypair.
http://www.gnupg.org/gph/en/manual.html
A description of the services provided by the product : encryption, data signing, public key management, key certification, private key protection, key pair creation and random number generation;
A description of the cryptographic functions provided by the product (encryption, signature, key management) ;
The description of the key management implemented in the software, including at least:
- the distribution method: Export to a file or sending using TCP/IP to keyservers speaking either the LDAP, HKP or email protocol. (gnupg-1.0.7/g10/export.c, gnupg-1.0.7/keyserver/*.c) ;
- the key generation process/method:gnupg-1.0.7/g10/keygen.c gnupg-1.0.7/cipher/rsa.c gnupg-1.0.7/cipher/dsa.c gnupg-1.0.7/cipher/elgamal.c gnupg-1.0.7/cipher/primegen.c;
- the key archival format, if relevant: One file with concatenated keyblocks using the transmission format for keys as described in RFC2440 (http://www.ietf.org/rfc/rfc2440.txt) ;
- the key transmission format, if relevant: as per RFC2440 ;The description of technical means implemented to prevent alteration of the encryption method or of the associated key management: The encryption method is public key encoded along with the session key (PKCS-1 block type 2 as defined in RFC2313 http://www.ietf.org/rfc/rfc2313.txt) The private keys are protected using the methods described in RFC2440 with the enhancement that the 16 bit checksum may optionally be replaced by a SHA-1 checksum. ;
The description of pre-processing applied on un-encrypted data before encryption (compression, formating, header addition, etc.) : Encapsulation in a literal data packet as per RFC2440, using a header with a filename and a flag to distinguish between binary and plaintext data. Optionally digitally signed, optionally compressed. ;
The description of post-processing of encrypted data, after encryption (adding a header, formating, slicing into packets, etc.) : Either prepending the encrypted data with the public key encrypted session key encapsulated into the appropriate RFC2440 packet or encrypting the session key with another symmetric algorithm to allow decryption with a shared secret. Both methods may be combined to allow decryption with either a passphrase or using the private key. It is possible to add encrypt the session key for multiple private keys or passphrases.
