Basic Ideas

Previous  Top  Next

MPGP uses PGP-compatible keyrings, and you can use all of your normal pgp tools to import and export keys from these keyrings. MPGP can share the use of your normal pgp keyrings, or use an independent set of keyrings dedicated for use with MPGP.

MPGP differentiates between two kinds of keys, which it associates with different levels of security:

·

Anonymous Keys

MPGP automatically generates and exchanges so-called "anonymous" keypairs in order to secure conversations with people you dont know well. On initial installation, MPGP will ask you to make an anonymous key (you can also regenerate a new one whenever you want). This anonymous key is generally shared with anyone who wants to send you encrypted information - it doesn't reveal anything about you or let other people read stuff sent to you, it just lets people send you encrypted information. Anonymous keys are like temporary, throwaway keys that are safe to hand out to any idiot who wants to send you a message.

·

Permanent Keys

You may also create one or more non-anonymous, permanent keys, using identities of your choice. You dont have to use your real name or email of course, but these keys would be keys that you would use to reliably identify yourself to your friends. You might submit these keys to internet keyrings or email them to your friends, so they have an independent (ie not through irc) way of identifying you. You can keep different identities for different groups of friends, etc. With these keys you will be able to "prove" your identity to someone who already has your non-anonymous key.

The only way for a man-in-the-middle attack to intercept traffic encoded to a non-anonymous key is if the same person could intercept (and dynamically modify them so that you dont see the real values of) BOTH your originally exchanged keys (which you did over email or a forum at an earlier time), AND your irc conversations in real time. This is extremely unlikely. And note that it's completely safe for anyone to see the public keys you exchange, as long as they arent able to dynamically modify them so that the keys you see are not the ones your partner sent, but are instead keys owned by the interceptor.

Both Anonymous and Permanent keys are standard pgp keys, which are just treated differently. Anonymous keys are generated autotmatically by MPGP, and don't require you to manually sign them with a keyphrase before using them. They are therefore very convenient for automatic exchange and quick communication with people you dont know well. Permanent keys are simply pgp keys that you create yourself using the PGP key tool (or import from your existing pgp keyrings). Permanent keys are meant to be shared with friends via independent channels (email, forum, keyserver), so that the people you talk to on irc can be assured you are the same person that previously provided them with that key. Non-anonymous keys require you to provide your keyphrase on each use, which makes it difficult for an imposter to use them even if your computer or hard disk is compromised.