In this lesson, we show how to sign software. It is also called code signing. First, how to generate the public key/private key pair using a software package called GPG and learn how to generate message digest of the software program to ensure they are not modified either during the retrieval or while they are saved in the repository or mirror site. We will also sign the hash to provide authenticity of the software source, i.e. who create and sign the software? We will use common software too to perform these signing tasks. The popular Apache web server software package will be used as an example. GNU Private Guard, short for GnuPG or GPG, is a tool for secure communication. GNU GPG was initially developed by Werner Coch, a system compliant to the OpenGPG standard. Here, we show how it can be used to generate public key and private key pair on the Mac. We use a command gpg2 with --full-generate-key options. It is sure that the version is version 2.1.1.18. It ask what type of key we want first, and there are four choices. RSA is the most popular choice, we pick that. It then ask us for the size of the key. It can be range from 1024 to 4096 bits I choose here 2048, but most people start choosing 4096 bits. It also ask if when the key will expire. For your pertinent key you intend to use, we typically specify zero, it never expire. We enter real name and email address as the user ID. It then ask us the passphrase, and actually equivalent to password in our field, to protect the private key. It also generate a revocation certificate for us. Later on, if we lost our private key or somehow got stolen, we can submit that to key server. You can then generate another versions of public key/private key. Here, it shows a fingerprint of the key we often use, the last 8 or 16 hexadecimal digit of key ID to identify the key. You can also use a whole fingerprint to identify the key. The letters in the square bracket indicate the usage of the key. For example, the first one, the pub key, has S and C. S stand for signing, C stand for creating certificate that's purpose of the key. The sub key has E in it. E stand for encryption. The sub key is used for encryptions. You can add additional sub key or revoke them later on. We use the gpg2 with the option --armor end option --export cchow@uccs to export my public key in ASCII format. With that --armor option, instead of binary, it generate a ASCII-readable kind of format. You either could copy and paste to other too, so it's very convenient for human consumption and it's also safe for copying. We can save the output as a text file and then cut and paste to a keyserver webpage or use the command gpg2 --keyserver. We specify a server domain name, such as very popular one, pgp.mit.edu. And then with the option --send-key, we specify and identify the key typically with the last 8 and 16 hexadecimal digit to identify the key and send it out to the keyserver for distribution. Let us first see how a software organization or a company such as Apache Software Foundation release its famous Apache HTTP Web Server software. How Apache provide critical security-related information on their website so that their users can verify the integrity and authenticity of the software they download? Here, we use the same technique similar to that we showing you in the last lesson, the Bank of America certificate web verifications. We generate the private key and public key in the same way, but instead of generating the certificate request and send it to where we sign CA, certificate authority for signing and publishing, Apache use OpenPGP standard and they have different philosophy and using software package has a GPG to generate a key pair and submit a public key to keyserver without having to pay. Here, we use a one sks-keyservers.net pool. It consist of a lot of keyserver that weren't here to serve this purpose. You can generate a public key in ASCII format as I demonstrate in the last slide, and we then copy the public key and paste to a submit text box in this http pool.sks-keyserver website. We can also simply use the gpg command with the option --keyserver to submit and upload the public key to the keyserver. Any user can visit the same website and enter our key ID or whoever the public-key signer's email address to retrieve the related OpenPGP key and related information, such as someone else has in those assigned the key. Currently, there are about 4.6 million keys maintained in this set of sks-keyserver pool. When the httpd developer group finished a version ready to be released, let's say httpd-2.4.225, Jim will generate a MD5 and SHA1 message digest of the software package the group generated, and use his private key to generate the PGP signature, basically scramble using typically RSA key for that signature. And then that MD5 and SHA message digest function can be use to generate the message digest. The MD5 and SHA1 individually has been found in real situation to put to use the same message digest resolved from different document, but that's very rare. However, the chance of generating the same message digest with two different functions from a different document is very, very low, and therefore we see a lot of company put up two different message digest. And same thing here, Apache list both of message digest. On a Mac, we can use MD5 or openssl sha1 command to generate the hashes. We can use gpg2 detach-sig option to generate a signature. So instead of combine the signature with the document, the signature is separate from the main document. Jim then update the HTTP Apache Software download webpage. And here, we see it add the links to the software release, the PGP signature, the MD5 and SHA digest he just generated. And here we show the image of the current HTTP download web page with the current stable release 2.4.25 versions. And user interest in the source code can then download them and verify and install it.
