IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
are used to ensure the cryptographically secure assignment of a person to a
public key. The certificates are allocated by a trustworthy third party.
With PGP, every user can authenticate the public keys of other people with
certificates. However, a user should only certify a public key if he or she
knows or has checked the identity of the owner of the key and the public key
was handed over personally.
Alternatively, the authenticity of a public key can also be verified with the aid
of what is known as the "fingerprint". This involves calculating a number
sequence (hash value) from the public key and appending the value to the key.
After a public key has been sent, the recipient can contact the sender to
compare the number sequence, for example by telephone, in order to certify
the public key after confirmation of the fingerprint.
Certification hierarchy - web of trust - Internet key server
Essentially, PGP can be used both in a certification hierarchy and in a "web of
trust". In a web of trust, the certificates of other users are relied upon to be
trustworthy, whereas in a certification hierarchy trustworthy third parties,
known as certifying agencies, authenticate the keys of all of their users in a
reliable and demonstrable way.
Within a company or an agency, a certification hierarchy should be
established in the intranet. The PGP expert should certify all keys for his or
her area of the organisation or for the organisation as a whole. The certified
public keys should be accessible to all members of staff on a server in the
intranet. Access to this area should be exclusively read-only, however. The
web of trust method should only be used for the field of private
communications.
In the Internet, public PGP keys can be made available on key servers. These
must in no way be confused with certifying agencies, however. Key servers
receive keys from anywhere, and distribute them on request. It should be made
clear that keys which are obtained from a key server are not checked by the
key server in any way.
In order to verify the authenticity of a public key that has been made available
on a key server, the fingerprint technique mentioned above should be used.
The public key's own signature
Of the parts of a PGP public key, only the user ID is overwritten by the public
key's own signature. The use of the public key's own signature makes it
possible to detect a denial-of-service attack (see T 5.28 Denial of services),
but it does not prevent such an attack. As the user ID of a public key is not
encrypted, it can be corrupted. The consequence of this would be that, if a
"corrupted" key is used, the encrypted e-mails would no longer reach the
owner of the key because they would be redirected to a different e-mail
address. The confidentiality of the encrypted message is not put at risk
because of this, as the message can only be decrypted with the aid of the
private key.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000