{"id":30,"date":"2009-01-10T22:44:13","date_gmt":"2009-01-10T22:44:13","guid":{"rendered":"http:\/\/www.eriugena.org\/blog\/?p=30"},"modified":"2009-01-10T23:30:43","modified_gmt":"2009-01-10T23:30:43","slug":"30","status":"publish","type":"post","link":"http:\/\/www.eriugena.org\/blog\/?p=30","title":{"rendered":"Using PKI X.509 certificates in GnuPG"},"content":{"rendered":"<p>Many company IT Security policies insist that workers use only encryptions keys that are generated by the company PKI. That allows the company to recover the encryption keys if they are lost or if the employee leaves the company. PKI issued certificates (which contain the keys) are usualy used with S\/MIME in programs like Outlook or Thunderbird.<\/p>\n<p>However, some people wish to use the PGP encryption standard, often because it is required by a customer or other correspondent. This post explains how to\u00c2\u00a0export a certificate issued by an enterprise PKI for use in the popular open source encryption program GnuPG. GnuPG follows the PGP standard and can be used to exchange encrypted e-mail with users of the commercial PGP.<\/p>\n<p>\u00c2\u00a0In this example the\u00c2\u00a0certificate is available in the Firexox certificate store. Click to enlarge the image.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/1firefox.png\" title=\"1firefox.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/1firefox.thumbnail.png\" alt=\"1firefox.png\" \/><\/a><\/p>\n<p>This certificate is for John at Eriugena.org<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/2a-firefox.png\" title=\"2a-firefox.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/2a-firefox.thumbnail.png\" alt=\"2a-firefox.png\" \/><\/a><\/p>\n<p>Next backup the certificate onto disk. Firefox uses the extension &#8220;.p12&#8221; for a certificate that includes the private key.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/2b-firefox1.png\" title=\"2b-firefox1.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/2b-firefox1.thumbnail.png\" alt=\"2b-firefox1.png\" \/><\/a><\/p>\n<p>GnuPG cannot import an X.509 certificate. First we have to import the certificate using PGP which can convert it into a PGP type of key.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/3a-pgp1.png\" title=\"3a-pgp1.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/3a-pgp1.thumbnail.png\" alt=\"3a-pgp1.png\" \/><\/a><\/p>\n<p>In PGPkeys use the &#8220;import&#8221; function on the &#8220;keys&#8221; menu.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/3pgp.png\" title=\"3pgp.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/3pgp.thumbnail.png\" alt=\"3pgp.png\" \/><\/a><\/p>\n<p>After importing the key, click on it and select &#8220;add&#8221; and then &#8220;name&#8221;. Add a user ID to the key. This is required\u00c2\u00a0for GnuPG to recognise the user ID and in this case is useful to identify the key.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/5pgp.png\" title=\"5pgp.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/5pgp.thumbnail.png\" alt=\"5pgp.png\" \/><\/a><\/p>\n<p>PGP protects the key using the IDEA algorithm which is not available by default in GnuPG because it is pattented. To get around this you must remove the key protection by changing the passphrase to an empty one. Be careful to delete the key from PGP afterwards or else change\u00c2\u00a0back to a non-empty\u00c2\u00a0passphrase.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/6pgp.png\" title=\"6pgp.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/6pgp.thumbnail.png\" alt=\"6pgp.png\" \/><\/a><\/p>\n<p>Now export the key. PGP will write the exported key in standard PGP form which can easily be imported into GnuPG.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/7a-pgp1.png\" title=\"7a-pgp.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/7a-pgp1.thumbnail.png\" alt=\"7a-pgp.png\" \/><\/a><\/p>\n<p>Select &#8220;Include Private Key&#8221;<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/7pgp.png\" title=\"7pgp.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/7pgp.thumbnail.png\" alt=\"7pgp.png\" \/><\/a><\/p>\n<p>Import the key into the GnuPG key ring<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/8gpg.png\" title=\"8gpg.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/8gpg.thumbnail.png\" alt=\"8gpg.png\" \/><\/a><\/p>\n<p>It is very important that you right away edit the key to protect it by adding a passphrase. You can also edit the trust level of the key at this time.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/9gpg.png\" title=\"9gpg.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/9gpg.thumbnail.png\" alt=\"9gpg.png\" \/><\/a><\/p>\n<p>Now test the key by encrypting and then decrypting a message.<\/p>\n<p><a href=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/agpg.png\" title=\"agpg.png\"><img decoding=\"async\" src=\"http:\/\/www.eriugena.org\/blog\/wp-content\/uploads\/2009\/01\/agpg.thumbnail.png\" alt=\"agpg.png\" \/><\/a><\/p>\n<p>You now have a key in your GnuPG key ring that complies to your company IT Security policy. It came from the company PKI and is therefore archived and recoverable according to the policy.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Many company IT Security policies insist that workers use only encryptions keys that are generated by the company PKI. That allows the company to recover the encryption keys if they are lost or if the employee leaves the company. PKI issued certificates (which contain the keys) are usualy used with S\/MIME in programs like Outlook [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-30","post","type-post","status-publish","format-standard","hentry","category-crypto"],"_links":{"self":[{"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/30","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=30"}],"version-history":[{"count":0,"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/30\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.eriugena.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}