Skip to content

PGP_Key_Learning.md

Latest commit

 

History

History
54 lines (39 loc) · 3.19 KB

PGP_Key_Learning.md

File metadata and controls

54 lines (39 loc) · 3.19 KB
Raw

🎓 PGP_Key_Learning.md

LEARNING CRYPTOGRAPHY

This module provides a foundational understanding of PGP (Pretty Good Privacy) mechanics, public-key infrastructure, and the trust models necessary for secure cryptographic communication.

🧠 Core Concepts

  • Asymmetric Cryptography: PGP relies on a key pair:
    • Public Key: Shared openly to allow others to encrypt messages for you or verify your digital signatures.
    • Private Key: Kept strictly confidential and used to decrypt messages or sign documents.
  • The Web of Trust (WoT): Unlike centralized certificate authorities (CA), PGP uses a decentralized model where users sign each other's keys to establish trust.
  • Fingerprints: A unique, shorter representation of a public key. It is the primary mechanism for verifying that a key belongs to the intended owner.

📚 Learning Path & Resources

Topic Focus Area Resource
Foundations How PGP encryption works GnuPG Documentation
Trust Models Web of Trust vs. TOFU PGP Trust Model Explained
Practical Use GPG Command Line Basics The GNU Privacy Handbook
Advanced Subkeys and Smartcards Debian GPG Best Practices
OSINT Practice Extracting data from public keys OSINT Dojo (YouTube)
OSINT Research Extracting Emails from PGP Sigs Medium (Catalyst256)
OSINT Methodology Using PGP keys for OSINT LaptrinhX
Dark Web Context PGP role in privacy and security TechNadu

⛓️ Workflow Mechanics

  1. Key Generation: Creating a master key with optional subkeys for encryption and signing.
  2. Key Distribution: Publishing the public key to keyservers or personal websites.
  3. Verification: Confirming the key's authenticity through an out-of-band channel (comparing the fingerprint).
  4. Encryption/Signing: Using the recipient's public key to encrypt and your private key to sign.
  5. Contextual Awareness: In dark web environments, PGP is frequently used for identity verification and securing communications to mitigate the risk of interception.

📝 Self-Assessment Checklist

  • Can I explain the difference between a master key and subkeys?
  • Do I understand the risks associated with keyserver key poisoning?
  • Have I practiced signing and verifying a text file using gpg?
  • Do I know how to create a revocation certificate for my own key?
  • Can I extract metadata from a public PGP key using tools like Kleopatra?
  • Do I know how to retrieve email addresses from PGP signatures?

⬅️ Back to Main Directory