Assignment

Make a screen capture showing the fingerprint generated by the key creation process and paste it into your Lab Report file.

Introduction

As computers, tablets, phones and other "always on" digital devices become increasingly interconnected through unsecure public networks, threats against our privacy and digital security increase in kind. Threats like identity theft and credit fraud threaten our financial security. Digital stalking and online harassment threaten our physical and emotional security. Some suggest that digital surveillance, mass data collection, and data mining by government and commercial entities encroach on our right to free speech, our freedom of association, and our Constitutional protections against unlawful search and seizure.

The need to protect confidential and private information over "public" networks is an ancient one. The solution then, as now, is to encode private data using cryptography. Simply put, cryptography takes human readable information and makes it unreadable "cipher text" which can only be read if one possesses the correct key. Generally speaking there are three cryptographic standards: symmetric cryptography, asymmetric cryptography, and hybrid cryptography.

With symmetric cryptography the sender and receiver use the same key (or "shared secret") to encrypt and decrypt a given message. Symmetric cryptography is quite fast and generally easier to implement than asymmetric cryptography. However, while symmetric cryptography does provide confidentiality and integrity, it does not guarantee authenticity. In other words, you do not know for certain who gave you the encrypted message.

With asymmetrical encryption, the sender has two keys: a private key and a public key. The sender encrypts with her private key and the receiver decrypts using the sender's public key, which the receiver obtains from the sender or through a trusted third party, such as a certificate server. While asymmetrical encryption is slower and more complex than symmetrical encryption, it does guarantee the authenticity of the sender.

The hybrid approach is to have the sender encrypt the message with a symmetric key, and then send the message and a copy of the symmetric key using the sender's asymmetric public key. The initial message and symmetric key are decrypted using the sender's public key, and subsequent messages are then decrypted quickly using the symmetric key. The hybrid approach provides the same full CIA protection as asymmetrical encryption with nearly the same speed as symmetrical encryption.

In this lab, you will learn how cryptography tools can be used to ensure message and file transfer integrity and how encryption can be used to maximize confidentiality. You will use Kleopatra, the certificate management component of GPG4Win, to generate both a public and private key as both a sender and a receiver. You will use the sender's keys to encrypt a file, send it to the receiver, and decrypt it using the receiver's copy of the keys.

This lab has five parts which should be completed in the order specified.

In the first part of the lab, you will create a public and private key pair for the senders account on the vWorkstation desktop.

In the second part of the lab, you create a public and private key pair for the receiver's account on the remote desktop, TargetWindows01.
In the third part of the lab, you will transfer and import the public key from the receiver, TargetWindows01.

In the fourth part of the lab, you will encrypt a file on the vWorkstation desktop using the receiver's public key and the sender's private key, send it to the remote machine, and then decrypt the file.

Finally, if assigned by your instructor, you will explore the virtual environment on your own in the third part of the lab to answer a set of challenge questions that allow you to use the skills you learned in the lab to conduct independent, unguided work, similar to what you will encounter in a real-world situation.

Learning Objectives

Upon completing this lab, you will be able to:

Apply the concepts of common cryptographic and encryption techniques to ensure confidentiality

Understand public and private key pairs and basic asymmetric cryptography

Generate a public and private key pair

Encrypt a data message using a public and private key pair

Decrypt a data message using a public and private key pair

Tools and Software

The following software and/or utilities are required to complete this lab. Students are encouraged to explore the Internet to learn more about the products and tools used in this lab.

FileZilla

GPG4Win (Kleopatra).