diff options
Diffstat (limited to 'src/content/docs/guides/fundamental-concepts.md')
| -rw-r--r-- | src/content/docs/guides/fundamental-concepts.md | 293 |
1 files changed, 102 insertions, 191 deletions
diff --git a/src/content/docs/guides/fundamental-concepts.md b/src/content/docs/guides/fundamental-concepts.md index 2312f03..aab63fc 100644 --- a/src/content/docs/guides/fundamental-concepts.md +++ b/src/content/docs/guides/fundamental-concepts.md @@ -6,244 +6,155 @@ sidebar: --- If you're new to **GPG (GNU Privacy Guard)** or **PGP (Pretty Good Privacy)**, -this guide is for you. GPG is a free, open-source system for **encrypting -information** and **verifying identity**. It's widely used for secure -communication, file protection, and digital signing. +this guide clearly explains the fundamental concepts step-by-step. -Let’s walk through the core concepts in a beginner-friendly way. +## What Is GPG, and Why Use It? -## PGP and GPG: What’s the Difference Today? +GPG (GNU Privacy Guard) is a free, open-source software primarily used to: -When people talk about “PGP,” they usually mean the OpenPGP standard for -encrypted communication—not the original commercial PGP software. GPG (GNU -Privacy Guard) is the free, open-source tool most people use today. It fully -supports the OpenPGP standard and is available for all major platforms. +- **Encrypt information**, ensuring messages and files stay private. +- **Digitally sign information**, verifying authenticity and integrity. -In short: +GPG is based on the OpenPGP standard, a widely adopted protocol for secure +digital communication. -- PGP was the original software, now rarely used. -- GPG is the open-source standard tool for modern encrypted email, files, and - signatures. +In simple terms: -If you’re just starting out, you almost always want to use GPG or a tool built -on top of GPG.able, but if you prefer open-source freedom and regular updates, -GPG is the usual choice. +- **PGP** was the original commercial software and is now seldom used. +- **GPG** is the modern, free, and most commonly used implementation of OpenPGP. -## What Is a Key Pair? +Most users today rely on **GPG**. -In GPG, a **key pair** consists of a public key and a private key that are -mathematically linked. +## Understanding Key Pairs -**Public Key**: Think of it as a locked mailbox. Anyone can drop a letter (your -encrypted message) into the mailbox and lock it. +GPG is built around pairs of cryptographic keys: -- Others use it to encrypt messages they send to you. -- Others use it to verify your digital signature. +- **Public Key**: Shared openly, allowing others to encrypt messages to you or + verify your signatures. +- **Private Key**: Kept secret by you, used to decrypt incoming messages and to + sign your messages or files. -**Private Key**: This is the only key that opens the locked mailbox. You—and -only you—can retrieve and read the letters inside. +A practical analogy: Your public key is like a locked mailbox. Anyone can put +mail inside, but only you hold the private key to open and read it. -- Decrypt messages sent to you. -- Sign your own messages or files so others know they truly came from you. +A complete GPG key pair includes: -:::tip[Everyday Analogy] +- A primary key representing your identity. +- Subkeys assigned for specific purposes like encryption or digital signing. +- Your user ID, typically your name and email address. +- Metadata such as creation date, expiration date, and usage permissions. -Imagine you’ve installed a mailbox on the street. Anyone can deposit letters -into it (encrypt information), but only you—holding the mailbox key—can open it -and read what’s inside. +This structure clearly separates identity from usage, improving flexibility and +security. -::: +## Generating Your First Key Pair -## Generating a Key Pair +When generating a key pair, you’ll choose: -To use GPG, you first create a key pair. During creation, you’ll choose: +- A **cryptographic algorithm** (commonly RSA or ECC). +- A **key size** (larger sizes offer greater security but slower performance). +- A strong, unique **passphrase** to protect your private key. -- A **cryptographic algorithm** (e.g., RSA, ECC). -- A **key size** (larger sizes are more secure but slower). -- A **passphrase** to protect the private key. +A strong passphrase ensures that even if someone accesses your private key file, +they cannot use it without knowing the passphrase. -:::caution -🔒 Your passphrase adds a layer of protection — even if someone gets your key -file, they can’t use it without this password. -::: +## Primary Keys and Subkeys Explained -## What Are Subkeys? +Your **primary key** serves as your GPG identity: -A GPG identity doesn’t stop at one key pair. You can create **subkeys** under -your primary key. These are used for specific tasks: +- Linked directly to your user ID (name and email). +- Used to sign subkeys and certify the keys of other users. -- **Encryption Subkey**: Used to encrypt/decrypt data. -- **Signing Subkey**: Used to create/verifiy digital signatures. +**Subkeys** handle routine tasks: -Subkeys are tied to your identity, but they can be revoked or replaced -independently. +- **Encryption subkey**: Encrypts and decrypts messages. +- **Signing subkey**: Digitally signs files or messages. -> Tip: Use subkeys for everyday tasks and keep your **primary key offline** or -> backed up securely. +Using subkeys for everyday tasks reduces the risk of exposing your primary key. +Many users keep their primary keys stored offline or in highly secure +environments. -## Understanding the Primary Key +## Encryption and Digital Signatures -Your **primary key** is your core identity. It: +### Encryption: Ensuring Privacy -- Links to your user ID (usually name + email). -- Signs your subkeys. -- Can certify other people's public keys (used to build trust networks). +To securely send a message: -:::caution +1. Use the recipient's **public key** to encrypt the message. +2. The recipient decrypts it using their **private key**. -If someone gains access to your **primary private key**, they can impersonate -you. That’s why: +This guarantees that **only the intended recipient** can read the content. -- It should be **backed up** securely. -- It’s best to use **subkeys** for daily operations. -- Some people even keep their primary key **offline** for maximum safety. +### Digital Signatures: Proving Identity -::: +Digital signatures ensure: -## How Encryption Works +- **Authenticity**: The recipient knows the message is genuinely from you. +- **Integrity**: The recipient knows the message hasn't been altered. -Imagine you want to send a private message to someone: +Signing a message involves: -1. You encrypt the message using their **public key**. -2. Only their **private key** can decrypt it. -3. You can also add your **signature** using your private key. -4. They can **verify your signature** with your public key. +1. Using your **private key** to create a signature. +2. Others verify your signature using your **public key**. -This ensures: +This confirms both your identity and the integrity of your message. -- **Privacy**: No one but the intended recipient can read the message. -- **Authenticity**: The recipient knows the message is from you. +## Practical Examples of GPG Usage -## What Is Digital Signing? +Common real-world applications of GPG include: -Signing is like sealing a document with your unique fingerprint. It allows -others to: +- **Secure Email**: Encrypting sensitive emails for personal or professional + use. +- **Cloud Storage**: Encrypting files before uploading to cloud services like + Dropbox or Google Drive. +- **Password Sharing**: Securely sharing passwords or confidential data within + teams. +- **Software Verification**: Ensuring downloaded software hasn’t been tampered + with by verifying digital signatures. +- **Protecting Personal Data**: Encrypting personal documents stored on your + devices. -- Confirm the message hasn’t been changed. -- Confirm that **you** are the sender. +## Public Key Certificates and Trust -Digital signatures are used to: +When sharing your public key, you're actually distributing a **certificate** +that includes: -- Sign emails. -- Sign files or software packages. -- Sign other people's public keys (to build trust). +- Your public key itself. +- Your user ID (name and email). +- Digital signatures from your primary key or trusted contacts confirming your + identity. -## Real-Life Use Cases +Certificates build trust, allowing others to confirm the authenticity of your +public key. -GPG is useful in many situations beyond email or software. Here are some -practical examples where encryption and digital signatures can protect your -privacy, secure your data, or build trust with others. +## GPG Security Best Practices -### Protecting Cloud Backups +For secure and effective GPG usage: -You store sensitive files (like financial records or personal photos) in the -cloud. Before uploading, you encrypt them with your GPG public key. Even if the -cloud provider is hacked, only you can decrypt and access your data. +- **Securely Back Up Keys**: Always keep secure, offline backups of your private + key and revocation certificate. +- **Use Strong Passphrases**: Protect your private keys rigorously. +- **Store Primary Keys Offline**: Rely on subkeys for regular usage. +- **Review and Rotate Keys Regularly**: Update your keys periodically for + enhanced security. +- **Immediately Revoke Compromised Keys**: Alert contacts immediately if your + key is compromised. +- **Leverage the Web of Trust**: Build a network of trust by exchanging digital + signatures with contacts. -### Sharing Passwords Securely +## GpgFrontend: Simplifying GPG -You need to share a server password with a remote teammate. Instead of sending -it as plain text, you encrypt the password file with their public key. Only they -can decrypt and read it. +GPG's command-line interface can be challenging for new users. **GpgFrontend** +provides a user-friendly graphical interface that simplifies common GPG +operations: -### Verifying Software Downloads +- Visually create and manage key pairs. +- Easily encrypt and decrypt messages and files. +- Sign and verify digital signatures intuitively. +- Seamlessly interact with public key servers. -You want to install open-source software from the internet. Before running the -installer, you check the author’s digital signature with GPG. If the signature -is valid, you know the file wasn’t tampered with. +GpgFrontend makes secure communication accessible, even if you're new to +encryption. -### Securing Personal Notes - -You keep a journal or confidential notes on your laptop. You encrypt these notes -with your own public key. Even if your device is stolen, no one else can read -your information. - -### Proving Document Authenticity - -You sign a PDF contract before sending it to a business partner. They can verify -your digital signature to confirm the document really came from you and hasn’t -been altered. - -### Open Source Contributions - -You contribute code to an open-source project on GitHub. You sign your commits -and tags with your GPG key, so everyone knows the code changes are really from -you. - -## Public Key Certificates - -A public key in GPG/PGP is not just a raw cryptographic key. It is always -packaged as a certificate, which contains more than just the key itself. - -A public key certificate includes: - -- The public key data (for encryption and verifying signatures) -- The User ID (your name and email address) -- Signatures made by your own primary key and, optionally, by other people - -### Why Are Certificates Important? - -- Binding Identity: The certificate links your key to your identity, such as - your name and email. This way, people can verify that the key truly belongs to - you. -- Establishing Trust: Others can “sign” your public key, vouching for your - identity. This signature acts as a recommendation, forming a “Web of Trust.” -- Subkey Relationship: If you use subkeys (for encryption or signing), their - certificates include signatures from your primary key. This proves that each - subkey really belongs to your primary identity, and not to someone else. - -### Example - -When you share your public key, you are actually sharing a certificate that: - -- Includes your identity and any subkeys -- Shows cryptographic proof that the subkeys are authorized by your primary key -- May be signed by other people who trust your identity - -This is why you should always distribute your full public key certificate—not -just the bare key! - -## Best Practices for New Users - -1. **Back Up Your Keys**: Store your private key and revocation certificate in a - secure, offline location. -2. **Use Strong Passphrases**: The private key is only as safe as the password - protecting it. -3. **Separate Daily and Master Keys**: Use subkeys for regular work; keep your - primary key protected. -4. **Update When Needed**: Cryptography evolves — review and rotate keys as - needed. -5. **Revoke If Compromised**: If your private key is stolen or lost, revoke it - immediately and inform your contacts. -6. **Understand the Web of Trust**: GPG builds trust by people signing each - other's keys — this forms a decentralized trust model. - -## Where Does GpgFrontend Fit In? - -While GPG/PGP itself is powerful, it is mostly command-line based — which can be -intimidating for beginners. - -This is where **GpgFrontend** comes in. - -GpgFrontend is a graphical interface built on top of GnuPG. It helps users -perform key operations such as: - -- Generating and managing key pairs -- Encrypting and decrypting messages or files -- Signing and verifying content -- Uploading and fetching keys from key servers -- More... - -All of this can be done through a **clear and user-friendly interface**, making -GPG accessible without needing to learn complex commands. - -Whether you're just starting to explore encrypted communication or already -managing multiple keys, GpgFrontend acts as a bridge — combining the strength of -GPG with simplicity and clarity. - -:::tip - -You focus on **secure communication** — let GpgFrontend handle the complexity -behind it. - -::: +By managing the complexity behind the scenes, GpgFrontend allows you to focus +solely on keeping your information secure and private. |