12/9/2023 0 Comments Keybase encrypt fileAfter the accountant publishes his public key, I can then encrypt the Excel file with his public key. His private key is never shared and is typically stored password-protected on his computer, though it can also be stored on smart card protected by a pin. The accountant posts his public key in a public place such as a key server. With public-key encryption, two keys are used: a private key and a public key. These are all problems that public-key encryption solves. I could look at the metadata of the Excel file, but this is easy to spoof. When I receive an email response from the accountant with the final income statement, how can I be sure that the modified excel file was not tampered with by a man in the middle, a virus, or an email hacker? I can't. Further, a shared key does not provide any form of authentication. Even if I trust the accountant, how can I be sure that his computer is not infected by some virus that steals and decrypts the password hash on some GPU farm? Or perhaps some malware is installed on the accountant's computer that captures the password as he types it to open the Excel file I sent him. What if I can't trust the accountant? If he leaks the password, all our communications can be decrypted by a thief. Using a shared key is certainly better than not encrypting at all. It is also nonsense (I've never heard of a banana taco), and thus won't be found in any literature for dictionary attacks. "Jason swallows banana tacos" is a lot harder for a computer to crack with brute force. It is easy to memorize and more secure than a password such as "b4naNa&67." We've been trained by websites to create difficult to remember passwords that are less secure than a passphrase. Note: Notice how I used a phrase rather than a word. I protect the Excel file with a passphrase "Jason swallows banana tacos." I then email the protected file and tell my accountant the password over the phone. Say I want to share my latest business earnings report with my accountant. With shared-key cryptography, there is one key to both encrypt and decrypt a message. This mode of encryption is vastly superior to shared-key encryption which is the easiest to understand. Public-key cryptography is widely used and is most commonly seen in website TLS certificates, cryptocurrency transactions such as Bitcoin and SSH authentication. You give it plain text or binary files and it uses public-key cryptography to output random encrypted ASCII (text) code. It can be used for signing, encrypting, and decrypting e-mail, files, and even disks. Pretty Good Privacy, or PGP, is an encryption program developed in 1991 by Phil Zimmermann. It's also an app where you can send an encrypted message to anyone in a Slack-like interface.īefore diving in, I will briefly explain PGP. Encryption keys are signed against something you already trust: social media accounts. It's new and fresh and solves PGP's "web of trust" complexity problem. TLDR: Keybase is cryptography for everyone. Let's expand that discussion by looking at a monumental app called Keybase. In my last article, I touched on why encryption is important and offered some common sense first steps for your security.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |