Copyright © 2004-2010 Jo HoSeok. All rights reserved.
root@wl ~ # wget ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.10.tar.bz2
root@wl ~ # digest -a sha1 gnupg-1.4.10.tar.bz2
fd1b6a5f3b2dd836b598a1123ac257b8f105615d
root@wl ~ # tar xvfj gnupg-1.4.10.tar.bz2
root@wl ~ # cd gnupg-1.4.10
root@wl ~/gnupg-1.4.10 # ./configure
root@wl ~/gnupg-1.4.10 # make
root@wl ~/gnupg-1.4.10 # make check
root@wl ~/gnupg-1.4.10 # make install
root@wl ~/gnupg-1.4.10 # gpg -help
gpg (GnuPG) 1.4.10
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA
Cipher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128,
CAMELLIA192, CAMELLIA256
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
Syntax: gpg [options] [files]
...
root@wl ~/gnupg-1.4.10 # chmod u+s /usr/local/bin/gpg 1)
1) 아래와 같은 메시지를 없애기 위함이다.
gpg: WARNING: using insecure memory! gpg: please see http://www.gnupg.org/faq.html for more information
root@wl ~ # gpg --gen-key
gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection?
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"
Real name: WindyHana
Email address: windyhana@solanara.net
Comment: WindyHaha's PGP Key
You selected this USER-ID:
"WindyHana (WindyHaha's PGP Key) <windyhana@solanara.net>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
Enter passphrase:
Repeat passphrase:
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++
.+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.+++++
..+++++
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key B0885DB9 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
pub 2048R/B0885DB9 2009-10-29
Key fingerprint = 083C 6642 84E9 F5F8 9070 C33B C0EC 0186 B088 5DB9
uid WindyHana (WindyHana's PGP Key) <windyhana@solanara.net>
sub 2048R/D0222170 2009-10-29
root@wl ~ #
root@wl ~ # gpg --armor --output pubkey.txt --export 'WindyHana' root@wl ~ # cat pubkey.txt -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.10 (SunOS) mQENBErpAAsBCADHKTnEeEyVmFSvWQBmGICDYQ9L4EA7LkAASvL+EQkP8zxHdAJP ... MX23D52kAOSzwe5AsupIzGJ0TPUh/cDnz0yAOacdltq3GqylkAtwXeYc31XiqWO8 YFpJJ92jgw== =1pMl -----END PGP PUBLIC KEY BLOCK----- root@wl #생성된 pubkey.txt를 다른 사람에게 주거나 공개된 장소에 업로드 해도 된다. 아래와 같이 공개 PGP 키 서버에 등록하 수도 있다.
root@wl # gpg --send-keys '이름' --keyserver hkp://subkeys.pgp.net
root@wl # mkfile 10m foo.file root@wl # gpg --encrypt --recipient 'WindyHana' foo.file 1) root@wl # gpg --output foo.file --decrypt foo.file.gpg 2) You need a passphrase to unlock the secret key for user: "WindyHana (WindyHana's PGP Key) <windyhana@solanara.net>" 2048-bit RSA key, ID D0222170, created 2009-10-29 (main key ID B0885DB9) Enter passphrase: gpg: encrypted with 2048-bit RSA key, ID D0222170, created 2009-10-29 "WindyHana (WindyHana's PGP Key) <windyhana@solanara.net>" root@wl #1) (공개키를 이용해) foo.file 파일을 암호화한다. foo.file.gpg 파일이 생성된다.
root@wl2 ~ # gpg --import pubkey.txt 1)
root@wl2 ~ # gpg --encrypt --recipient 'WindyHana' foo.file2
1) 키서버에 등록되어있다면 [gpg --keyserver pgpkeys.mit.edu --recv-key '키아이디'] 또는 [gpg --keyserver hkp://subkeys.pgp.net --search-keys '키이름'] 을 사용할 수 있다.root@wl ~ # gpg --output foo.file2 --decrypt foo.file2.gpg
root@wl ~ # mkfile 1m f root@wl ~ # gpg --sign f 1) root@wl ~ # gpg --clearsign f 2) root@wl ~ # gpg --detach-sign f 3) root@wl ~ # ls -al ... -rw------- 1 root root 1048576 10월 29일 15:34 f -rw-r--r-- 1 root root 21011 10월 29일 15:42 f.asc -rw-r--r-- 1 root root 1425 10월 29일 15:42 f.gpg -rw-r--r-- 1 root root 287 10월 29일 15:42 f.sig root@wl ~ #1) .gpg 파일이 생성됨. 서명하며 컨텐츠를 압축. 따라서 .gpg파일 안에 컨텐츠가 암호화 및 압축되어 있다. 암축된 컨텐츠를 풀려면 위에서 설명한 --decrypt 을 사용하면 된다.
root@wl ~ # mkfile 2m solanara-1.0.0.tar.gz root@wl ~ # gpg --armor --detach-sign solanara-1.0.0.tar.gz root@wl ~ # ls -al -rw------- 1 root root 2097152 10월 29일 16:06 solanara-1.0.0.tar.gz -rw-r--r-- 1 root root 486 10월 29일 16:06 solanara-1.0.0.tar.gz.asc root@wl ~ #--detach-sign 에 --armor를 추가했을 뿐이다. armor 인코딩은 Base64인코딩에 24비트 CRC를 저장한다(CRC값도 Base64로 인코딩한다) 이제 pubkey.txt, solanara-1.0.0.tar.gz, solanara-1.0.0.tar.gz.asc를 배포해서, 다른 사용자로부터 자신의 서명을 확인하게 할 수 있다. 다른 사용자는 아래와 같이 확인한다.
root@wl2 ~ # gpg --import pubkey.txt 1) root@wl2 ~ # ls -al -rw------- 1 root root 2097152 10월 29일 16:06 solanara-1.0.0.tar.gz -rw-r--r-- 1 root root 486 10월 29일 16:06 solanara-1.0.0.tar.gz.asc root@wl2 ~ # gpg --verify solanara-1.0.0.tar.gz.asc gpg: Signature made 2009년 10월 29일 목요일 오후 04시 09분 using RSA key ID B0885DB9 gpg: Good signature from "WindyHana (WindyHana's PGP Key) <windyhana@solanara.net>" 2) gpg: WARNING: This key is not certified with a trusted signature! 3) gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 083C 6642 84E9 F5F8 9070 C33B C0EC 0186 B088 5DB9 root@wl2 ~ #1) 위에서 했으면 하지 않아도 된다.
gpg: Signature made 2009년 10월 29일 목요일 오후 04시 09분 using RSA key ID B0885DB9 gpg: BAD signature from "WindyHana (WindyHana's PGP Key) <windyhana@solanara.net>"3) 이 메시지는 경고메시지로 입력된 키를 trust로 하지 않아서 발생한 문제이다. 이 문서 하단의 파일에 대해 위/변조 여부 알아내기를 참조한다.
root@wl ~ # wget http://apache.mirror.cdnetworks.com/httpd/httpd-2.2.14.tar.gz root@wl ~ # wget http://www.apache.org/dist/httpd/httpd-2.2.14.tar.gz.asc root@wl ~ # wget http://www.apache.org/dist/httpd/httpd-2.2.14.tar.gz.md5 root@wl ~ # wget http://www.apache.org/dist/httpd/httpd-2.2.14.tar.gz.sha1 root@wl ~ # digest -a md5 httpd-2.2.14.tar.gz 2c1e3c7ba00bcaa0163da7b3e66aaa1e root@wl ~ # cat httpd-2.2.14.tar.gz.md5 MD5 (httpd-2.2.14.tar.gz) = 2c1e3c7ba00bcaa0163da7b3e66aaa1e root@wl ~ # digest -a sha1 httpd-2.2.14.tar.gz e6e20b3fc58a57a5116e036e31bf97d409db7cfa root@wl ~ # cat httpd-2.2.14.tar.gz.sha1 SHA1(httpd-2.2.14.tar.gz)= e6e20b3fc58a57a5116e036e31bf97d409db7cfa root@wl ~ #GnuPG를 이용한 방법이다. 저자(파일을 만든 사람)의 공개키를 받아 임포트 한 후 인증검사를 하면 절차는 완료된다.
root@wl ~ # wget http://www.apache.org/dist/httpd/KEYS root@wl ~ # gpg --import KEYS root@wl ~ # gpg --verify httpd-2.2.14.tar.gz.asc gpg: Signature made 2009년 9월 24일 목요일 오전 08시 30분 using DSA key ID 751D7F27 gpg: Good signature from "Graham Leggett <minfrin@apache.org>" gpg: aka "Graham Leggett <minfrin@sharp.fm>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: EB13 8C6A F0FC 6910 01B1 6D93 344A 844D 751D 7F27 root@wl ~ #여기까지 하면 httpd-2.2.14.tar.gz은 Graham Leggett이 인증한 정상적인 파일이라 보면 된다. WARNING은 [Graham Leggett이 과연 믿을만한 사람인가?]라는 의미다. 이를 해결하려면 아래와 같이 [Graham Leggett]을 trust상태로 바꿔줘야 한다.
root@wl ~ # gpg --list-keys "Graham Leggett" pub 1024D/751D7F27 1999-08-19 uid Graham Leggett <minfrin@apache.org> uid Graham Leggett <minfrin@sharp.fm> sub 2048g/18F4AD9E 1999-08-19 root@wl ~ # gpg --edit-key 751D7F27 gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub 1024D/751D7F27 created: 1999-08-19 expires: never usage: SCA trust: unknown validity: unknown sub 2048g/18F4AD9E created: 1999-08-19 expires: never usage: E [ unknown] (1). Graham Leggett <minfrin@apache.org> [ unknown] (2) Graham Leggett <minfrin@sharp.fm> Command> sign Really sign all user IDs? (y/N) y pub 1024D/751D7F27 created: 1999-08-19 expires: never usage: SCA trust: unknown validity: unknown Primary key fingerprint: EB13 8C6A F0FC 6910 01B1 6D93 344A 844D 751D 7F27 Graham Leggett <minfrin@apache.org> Graham Leggett <minfrin@sharp.fm> Are you sure that you want to sign this key with your key "WindyHana (WindyHaha's PGP Key) <windyhana@solanara.net>" (FB267B1A) Really sign? (y/N) y You need a passphrase to unlock the secret key for user: "WindyHana (WindyHana's PGP Key) <windyhana@solanara.net>" 2048-bit RSA key, ID B0885DB9, created 2009-10-29 Enter passphrase: Command> trust pub 1024D/751D7F27 created: 1999-08-19 expires: never usage: SCA trust: unknown validity: unknown sub 2048g/18F4AD9E created: 1999-08-19 expires: never usage: E [ unknown] (1). Graham Leggett <minfrin@apache.org> [ unknown] (2) Graham Leggett <minfrin@sharp.fm> Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub 1024D/751D7F27 created: 1999-08-19 expires: never usage: SCA trust: ultimate validity: unknown sub 2048g/18F4AD9E created: 1999-08-19 expires: never usage: E [ unknown] (1). Graham Leggett <minfrin@apache.org> [ unknown] (2) Graham Leggett <minfrin@sharp.fm> Please note that the shown key validity is not necessarily correct unless you restart the program. Command> save root@wl ~ # gpg --verify httpd-2.2.14.tar.gz.asc gpg: Signature made 2009년 9월 24일 목요일 오전 08시 30분 using DSA key ID 751D7F27 gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 2 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 2u gpg: depth: 1 valid: 1 signed: 6 trust: 1-, 0q, 0n, 0m, 0f, 0u gpg: Good signature from "Graham Leggett <minfrin@apache.org>" gpg: aka "Graham Leggett <minfrin@sharp.fm>" root@wl ~ #
|
|
Copyright © 2004-2010 Jo HoSeok. All rights reserved. |