Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#1

Post by kqr » Wed, Nov 30, 2016, 12:49 PM UTC

Understanding how git works internally "from the ground up" has been incredibly helpful in my everyday work; things like blobs, commit objects, hashes and how they connect to form the git experience as I know it. Where I had been cargo-culting along previously, it all became clear once I understood the fundamental model of what was going on underneath the interface.

I feel like the same thing could apply to PGP/GnuPG. I am cargo culting my way along but I feel like I would feel much, much, much more comfortable if I knew how it worked from the ground up.

I have loose ideas of asymmetric cryptography and trust circles and such, but nothing concrete to hinge my actions upon, so I mostly try different permutations of command line arguments until GPG appears to do what I want it to do.

Is there a "from the ground up" good guide to PGP that allows me to break out of this pattern?

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#2

Post by lmm » Wed, Nov 30, 2016, 1:52 PM UTC

I found The Code Book a helpful read, though it's very much a high-level overview.

If you want to really understand what's going on at low level, one option is to just read the RFC and follow the references.

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#3

Post by hannob » Wed, Nov 30, 2016, 1:55 PM UTC

It depends a lot on from which angle you want to understand it. There's a difference between "understanding the variety of command line options" vs. "understanding the meaning of the raw data structures". I learned quite a bit by looking up things in the RFC: https://tools.ietf.org/html/rfc4880

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#4

Post by acqq » Wed, Nov 30, 2016, 1:58 PM UTC

The low-level is more than good covered, the actual use of the GPG in different scenarios is what's not discussed enough.

To understand the low level you have to learn enough of cryptography. For example, to understand the logic of RSA algorithm, read:

https://simple.wikipedia.org/wiki/RSA_(algorithm)

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#5

Post by enzolovesbacon » Wed, Nov 30, 2016, 2:15 PM UTC

Although it doesn't have PGP/GnuPG, I found "The Architecture of Open Source Applications" to be very interesting and something that should be spread out more.

My work demanded me to read the ITK and VTK parts. Git and GDB are also very nice.

http://aosabook.org/en/index.html

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#6

Post by kqr » Wed, Nov 30, 2016, 2:15 PM UTC

acqq wrote: post #4

The low-level is more than good covered, the actual use of the GPG in different scenarios is what's not discussed enough. To understand the low level you have to learn enough of cryptography. For example, to understand the logic of RSA algorithm, read: https://simple.wikipedia.org/wiki/RSA_(algorithm)

How RSA works belongs to those snippets of random information that I do possess, but can't reliably link together to get a full picture of the PGP experience.

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#7

Post by kqr » Wed, Nov 30, 2016, 2:18 PM UTC

enzolovesbacon wrote: post #5

Although it doesn't have PGP/GnuPG, I found "The Architecture of Open Source Applications" to be very interesting and something that should be spread out more. My work demanded me to read the ITK and VTK parts. Git and GDB are also very nice. http://aosabook.org/en/index.html

Ooh, ooh, ooh they're partly by Greg Wilson! I'm a huge fan of him! Shame they don't cover GnuPG. :(

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#8

Post by knweiss » Wed, Nov 30, 2016, 2:20 PM UTC

An Advanced Introduction to GnuPG by Neal H. Walfield

https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.h...

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#9

Post by Kadin » Wed, Nov 30, 2016, 2:21 PM UTC

lmm wrote: post #2

I found The Code Book a helpful read, though it's very much a high-level overview. If you want to really understand what's going on at low level, one option is to just read the RFC and follow the references.

I was going to recommend Singh's book as well. I have an older edition of it, and some of it is certainly out of date (I think it has a whole chapter on Freenet, which may still be around but these days has been eclipsed by Tor), but the core principles are quite good. It's among the best explanations of asymmetric cryptography that I've read, anyway.

Re: Ask HN: Is there a “ground-up” explanation of PGP/GnuPG?

#10

Post by acqq » Wed, Nov 30, 2016, 2:26 PM UTC

kqr wrote: post #6

acqq wrote: post #4

The low-level is more than good covered, the actual use of the GPG in different scenarios is what's not discussed enough. To understand the low level you have to learn enough of cryptography. For example, to understand the logic of RSA algorithm, read: https://simple.wikipedia.org/wiki/RSA_(algorithm)

How RSA works belongs to those snippets of random information that I do possess, but can't reliably link together to get a full picture of the PGP experience.

So what do you miss? There are of course other crypto primitives involved: even when public key algorithms are used, the whole message is encrypted with the symmetric cipher, only the key for the message is encrypted with the public key cryptography. An example for symmetric cipher is AES,

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

but note that older GPG's used less strong symmetric ciphers by default.

There's the RFC about the format of the OpenPGP message:

https://tools.ietf.org/html/rfc4880