Int 7: PGP/GPG - Pretty Good Privacy
Target: Menggunakan GPG untuk enkripsi, dekripsi, sign, verify - komunikasi aman via email
Tools:gpg
Praktikum
cd ~ && mkdir crypto-int7 && cd crypto-int7
# 1. Generate GPG key pair
echo "=== Generate GPG Key ==*"
export GNUPGHOME=$PWD/gnupg
mkdir -p $GNUPGHOME
chmod 700 $GNUPGHOME
echo "Key pair created!"
echo ""
# 2. Export & import keys
echo "=== Export Public Keys ==*"
gpg --export -a "Alice" > alice-public.asc
gpg --export -a "Bob" > bob-public.asc
echo "Alice public key exported"
echo "Bob public key exported"
echo ""
# 3. Encrypt & decrypt
echo "=== Enkripsi & Dekripsi ==*"
echo "Pesan rahasia dari Bob ke Alice" > message.txt
# Bob encrypt with Alice's public key
gpg --batch --yes --encrypt -r "Alice" --output message.gpg message.txt 2>/dev/null
# Alice decrypt with her private key
gpg --batch --yes --decrypt message.gpg 2>/dev/null
echo ""
echo "✅ Bob mengirim pesan terenkripsi - hanya Alice yang bisa baca!"
echo ""
# 4. Sign & verify
echo "=== Sign & Verify ==*"
echo "Surat kontrak resmi" > contract.txt
# Alice sign
gpg --batch --yes --clearsign --output contract.sig contract.txt 2>/dev/null
echo "Contract signed by Alice:"
head -5 contract.sig
echo ""
# Verify signature
gpg --verify contract.sig 2>&1 | grep "Good signature"
Temuan
| Operasi GPG | Perintah |
|---|---|
| Generate key | gpg --full-gen-key |
| Export public | gpg --export -a "User" > user.asc
|
| Encrypt | gpg --encrypt -r "Recipient" file
|
| Decrypt | gpg --decrypt file.gpg |
| Sign | gpg --clearsign file |
| Verify | gpg --verify file.sig |
Refleksi: PGP adalah gold standard untuk email encryption selama 30+ tahun. Web of Trust (PGP) vs Certificate Authority (X.509) adalah dua pendekatan berbeda untuk autentikasi. Untuk komunikasi modern, Signal Protocol dianggap lebih aman dari PGP (karena Perfect Forward Secrecy).
Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy