There are many reasons why you would want to sign an evidence file, one of it is to ensure that the file really came from the sender. Recently I have been exchanging files for a presentation at the HTCIA with echo6 and we ensured our files were signed and encrypted.
Using the GPG tool under Linux really makes the task very simple.
Creating the Key Pair
We need to use GPG is to create our own public and private key. The command is;
gpg --gen-key
You will be asked to choose the public key algorithm, the size of the key, the lifetime of the key (I would suggest unlimited lifespan) and some information about you (name and email address).
Encrypting a File
A file is encrypted using the command;
gpg --encrypt evidence-file-name
This will produce a binary file called evidence-file-name.gpg. An ascii encrypted file (file.asc) can be produced with
gpg --encrypt --armor evidence-file-name
Decrypting a File
Decryption is with the command;
gpg --decrypt evidence-file-name
Signing and verifying a file
There are two ways of digitally signing an evidence file;
• The signature can be incorporated into the file being signed, the command is;
gpg --sign evidence-file-name
• The signature file can be written to a separate file, the command is;
gpg --detach-sign evidence-file-name
This option creates a separate signature file called evidence-file-name.sig.
Encrypted and signed file
A file can be encrypted and signed at the same time, the command is;
gpg --encrypt --sign --armor evidence-file-name
Verifying a signed file
The authenticity of a signed file can be verified with the command;
gpg --verify evidence-file-name
Or, in the case of a detached signature, by putting the signature file first:
gpg --verify evidence-file-name.sig evidence-file-name
I would recommend for forensic evidence files that the files are signed with the detached signature option that creates a separate signature file. I also do not encrypt the evidence file itself , but rely on other forms of encryption at the drive level.
No comments:
Post a Comment