TDCTF Academy Logo TDCTF ACADEMY

Int 7: PGP/GPG - Pretty Good Privacy

Target: Menggunakan GPG untuk enkripsi, dekripsi, sign, verify - komunikasi aman via email
Tools: gpg


Praktikum

cd ~ && mkdir crypto-int7 && cd crypto-int7

# 1. Generate GPG key pair
echo "=== Generate GPG Key ==*"
export GNUPGHOME=$PWD/gnupg
mkdir -p $GNUPGHOME
chmod 700 $GNUPGHOME

gpg --batch --passphrase '' --quick-gen-key "Alice <[email protected]>" default default 2>/dev/null
gpg --batch --passphrase '' --quick-gen-key "Bob <[email protected]>" default default 2>/dev/null

echo "Key pair created!"
echo ""

# 2. Export & import keys
echo "=== Export Public Keys ==*"
gpg --export -a "Alice" > alice-public.asc
gpg --export -a "Bob" > bob-public.asc

echo "Alice public key exported"
echo "Bob public key exported"
echo ""

# 3. Encrypt & decrypt
echo "=== Enkripsi & Dekripsi ==*"
echo "Pesan rahasia dari Bob ke Alice" > message.txt

# Bob encrypt with Alice's public key
gpg --batch --yes --encrypt -r "Alice" --output message.gpg message.txt 2>/dev/null

# Alice decrypt with her private key
gpg --batch --yes --decrypt message.gpg 2>/dev/null

echo ""
echo "✅ Bob mengirim pesan terenkripsi - hanya Alice yang bisa baca!"
echo ""

# 4. Sign & verify
echo "=== Sign & Verify ==*"
echo "Surat kontrak resmi" > contract.txt

# Alice sign
gpg --batch --yes --clearsign --output contract.sig contract.txt 2>/dev/null
echo "Contract signed by Alice:"
head -5 contract.sig
echo ""

# Verify signature
gpg --verify contract.sig 2>&1 | grep "Good signature"

Temuan

Operasi GPG Perintah
Generate key gpg --full-gen-key
Export public gpg --export -a "User" > user.asc
Encrypt gpg --encrypt -r "Recipient" file
Decrypt gpg --decrypt file.gpg
Sign gpg --clearsign file
Verify gpg --verify file.sig

Refleksi: PGP adalah gold standard untuk email encryption selama 30+ tahun. Web of Trust (PGP) vs Certificate Authority (X.509) adalah dua pendekatan berbeda untuk autentikasi. Untuk komunikasi modern, Signal Protocol dianggap lebih aman dari PGP (karena Perfect Forward Secrecy).


Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy

PADA HALAMAN INI