One of the little projects I’ve been playing with at work this week is using public key cryptography, based on OpenPG, to transfer potentially sensitive material to a colleague in another department and I think we’ve cracked it.
The challenge was to put in a signed request form to add a user to a secure system and then to receive the user credentials back. Previously, this was done with a wet ink signature, often transferred through internal mail (since the offices are some distance apart) and then credentials sent back in an envelope marked ‘confidential’ (ie. ‘could be interesting’!). It is a time honoured method but always struck me as the weakest parts of the chain.
After some testing, I’ve now provided my colleague with my public key, generated with GPG (an Open Source implementation of the protocol). I can sign the scanned request form with my private key and he can verify it with my public key. That means the request is more securely authenticated than turning up in an envelope with a scribble on the bottom. He can then encrypt the credentials document, again with the public key, and I can unlock that with the private key, preventing anyone else picking up the user’s password enroute.
That secures the round trip and really is quite simple. Well, quite simple, but it took two computer geeks some research and testing to make it happen after being provisionally on the cards for a couple of years. That’s the rub with security; it entails a measure of inconvenience to do properly and so is done infrequently which makes it seem even more inconvenient. Hopefully I will have another chance to test the system we’ve set up before the dust settles entirely.