mirror of
https://codeberg.org/openpgp/notes.git
synced 2025-09-09 11:19:41 +02:00
remove top-level anchors in chapters
This commit is contained in:
parent
fcd0b890c1
commit
ae29cdc0c8
14 changed files with 21 additions and 29 deletions
|
@ -11,13 +11,13 @@ This documentation project seeks to introduce all OpenPGP concepts and functiona
|
|||
|
||||
## What is OpenPGP?
|
||||
|
||||
OpenPGP is an open standard for cryptographic operations. It is a system based on well-understood [cryptographic building blocks](cryptography_chapter). OpenPGP supports the secure delivery of files and messages between a sender and a recipient. It also addresses identities and their verification. OpenPGP is an outgrowth of the ["Pretty Good Privacy (PGP)"](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) encryption program and has many widely used and [interoperable implementations](interop_section).
|
||||
OpenPGP is an open standard for cryptographic operations. It is a system based on well-understood [cryptographic building blocks](/cryptography). OpenPGP supports the secure delivery of files and messages between a sender and a recipient. It also addresses identities and their verification. OpenPGP is an outgrowth of the ["Pretty Good Privacy (PGP)"](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) encryption program and has many widely used and [interoperable implementations](interop_section).
|
||||
|
||||
With OpenPGP, you can:
|
||||
|
||||
- [Encrypt](encryption_chapter) and [decrypt](decryption_chapter) messages to preserve confidentiality
|
||||
- [Sign](signing_data) and [verify](verification_chapter) data to ensure {term}`authenticity<Authentication>`
|
||||
- [Issue and validate certifications](component_signatures_chapter) about {term}`keys<Key>` and {term}`identities<Identity>`, similar to the role of a {term}`Certificate Authority<Certification Authority>` ({term}`CA<Certification Authority>`) in validating {term}`identities<Identity>`.
|
||||
- [Encrypt](/encryption) and [decrypt](/decryption) messages to preserve confidentiality
|
||||
- [Sign](/signing_data) and [verify](/verification) data to ensure {term}`authenticity<Authentication>`
|
||||
- [Issue and validate certifications](/signing_components) about {term}`keys<Key>` and {term}`identities<Identity>`, similar to the role of a {term}`Certificate Authority<Certification Authority>` ({term}`CA<Certification Authority>`) in validating {term}`identities<Identity>`.
|
||||
|
||||
## Who is the audience for this document?
|
||||
|
||||
|
|
|
@ -11,7 +11,7 @@ Certificates are composites of components that are linked together using [signat
|
|||
|
||||
A certificate can be valid or invalid as a whole. However, even when a certificate is valid, individual components (subkeys or identities) of it can be invalid.
|
||||
|
||||
In this section, we discuss the validity of certificates and their components. This discussion is closely related to [signature validity](verification_chapter), and builds on that concept.
|
||||
In this section, we discuss the validity of certificates and their components. This discussion is closely related to [signature validity](/verification), and builds on that concept.
|
||||
|
||||
The validity of the signatures that link a certificate is a necessary precondition. Two concepts are particularly central to the validity of certificates and components:
|
||||
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(certificates_chapter)=
|
||||
# Certificates
|
||||
|
||||
OpenPGP fundamentally hinges on the concept of "{term}`OpenPGP certificates<OpenPGP Certificate>`," also known as "{term}`OpenPGP public keys<OpenPGP Public Key>`." These {term}`certificates<OpenPGP Certificate>` are complex data structures essential for {term}`identity verification`, data encryption, and {term}`digital signatures<OpenPGP Signature Packet>`. Understanding their structure and function is pivotal to effectively applying the OpenPGP standard.
|
||||
|
@ -12,9 +11,9 @@ An {term}`OpenPGP certificate`, by definition, does not contain {term}`private k
|
|||
|
||||
Fundamentally, the effective management of {term}`certificates<OpenPGP Certificate>` and a thorough grasp of their {term}`authentication` and {term}`trust models<Trust Model>` are crucial for proficient OpenPGP usage. Although this document offers just a brief overview of these aspects, they form a fundamental part of the broader OpenPGP framework and warrant further study.
|
||||
|
||||
- For an in-depth exploration of OpenPGP's {term}`private key material`, refer to {ref}`private_key_chapter`. This chapter provides essential insights into {term}`private key<Transferable Secret Key>` management and security practices.
|
||||
- For an in-depth exploration of OpenPGP's {term}`private key material`, refer to [](/private). This chapter provides essential insights into {term}`private key<Transferable Secret Key>` management and security practices.
|
||||
|
||||
- The bindings that link the {term}`components<Component>` of a {term}`certificate<OpenPGP Certificate>` are comprehensively discussed in {ref}`component_signatures_chapter`, offering a deeper understanding of {term}`certificate<OpenPGP Certificate>` structure and integrity.
|
||||
- The bindings that link the {term}`components<Component>` of a {term}`certificate<OpenPGP Certificate>` are comprehensively discussed in [](/signing_components), offering a deeper understanding of {term}`certificate<OpenPGP Certificate>` structure and integrity.
|
||||
|
||||
- Finally, our chapter {ref}`zoom_certificates` discusses the internal structure of {term}`certificates<OpenPGP Certificate>` in detail.
|
||||
|
||||
|
@ -78,7 +77,7 @@ An {term}`OpenPGP certificate` usually contains multiple {term}`component keys<O
|
|||
An {term}`OpenPGP component key`
|
||||
```
|
||||
|
||||
{term}`Component keys<OpenPGP Component Key>` containing {term}`private key material` also include {term}`metadata` specifying the password protection scheme. This is another facet of {term}`metadata`, akin to the aforementioned creation timestamp and additional parameters for certain algorithms. However, this discussion focuses on {term}`OpenPGP certificates<OpenPGP Certificate>`, in which the {term}`component keys<OpenPGP Component Key>` contain only the public part of its cryptographic key data. For information on {term}`private keys<Transferable Secret Key>` in OpenPGP, see {numref}`private_key_chapter`.
|
||||
{term}`Component keys<OpenPGP Component Key>` containing {term}`private key material` also include {term}`metadata` specifying the password protection scheme. This is another facet of {term}`metadata`, akin to the aforementioned creation timestamp and additional parameters for certain algorithms. However, this discussion focuses on {term}`OpenPGP certificates<OpenPGP Certificate>`, in which the {term}`component keys<OpenPGP Component Key>` contain only the public part of its cryptographic key data. For information on {term}`private keys<Transferable Secret Key>` in OpenPGP, see [](private).
|
||||
|
||||
(fingerprint)=
|
||||
### Fingerprint
|
||||
|
@ -181,7 +180,7 @@ Currently, the OpenPGP standard prescribes only one format to be stored in user
|
|||
|
||||
## Linking the components
|
||||
|
||||
To form an {term}`OpenPGP certificate`, individual {term}`components<Component>` are interconnected by the {term}`certificate holder` using their OpenPGP software. Within OpenPGP, this process is termed "binding", as in "a {term}`subkey<OpenPGP Subkey>` is bound to the {term}`primary key<OpenPGP Primary Key>`." These bindings are realized using cryptographic {term}`signatures<OpenPGP Signature Packet>`. An in-depth discussion of this topic can be found in {ref}`component_signatures_chapter`.
|
||||
To form an {term}`OpenPGP certificate`, individual {term}`components<Component>` are interconnected by the {term}`certificate holder` using their OpenPGP software. Within OpenPGP, this process is termed "binding", as in "a {term}`subkey<OpenPGP Subkey>` is bound to the {term}`primary key<OpenPGP Primary Key>`." These bindings are realized using cryptographic {term}`signatures<OpenPGP Signature Packet>`. An in-depth discussion of this topic can be found in [](signing_components).
|
||||
|
||||
In very abstract terms, the {term}`primary key<OpenPGP Primary Key>` of a {term}`certificate<OpenPGP Certificate>` acts as a root of trust or "{term}`certification authority<Certification Authority>`." It is responsible for:
|
||||
|
||||
|
|
|
@ -22,7 +22,7 @@ The series of OpenPGP packets inside the Compressed Data packet can be handled l
|
|||
|
||||
## Typical usage
|
||||
|
||||
Compressed data packets are often used inside [encrypted data packets](encryption_chapter), or wrapping the data of an [inline-signed message](inline_signature).
|
||||
Compressed data packets are often used inside [encrypted data packets](/encryption), or wrapping the data of an [inline-signed message](inline_signature).
|
||||
|
||||
---
|
||||
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(cryptography_chapter)=
|
||||
# Cryptographic concepts and terms
|
||||
|
||||
(crypto-hash)=
|
||||
|
@ -133,7 +132,7 @@ In OpenPGP, digital signatures have diverse applications, extending beyond mere
|
|||
{term}`Digital signatures<OpenPGP Signature Packet>` in OpenPGP are used in two primary contexts:
|
||||
|
||||
- [Data signatures](signing_data)
|
||||
- [Signatures on components](component_signatures_chapter)
|
||||
- [Signatures on components](/signing_components)
|
||||
|
||||
(hybrid_cryptosystems)=
|
||||
## Hybrid cryptosystems
|
||||
|
@ -142,4 +141,4 @@ In OpenPGP, digital signatures have diverse applications, extending beyond mere
|
|||
|
||||
### Usage and terminology in OpenPGP
|
||||
|
||||
OpenPGP uses a {term}`hybrid cryptosystem` for encryption. This approach involves generating unique shared secrets, known as "session keys," for each session. For detailed information on this topic, please refer to the chapters {ref}`encryption_chapter` and {ref}`decryption_chapter`.
|
||||
OpenPGP uses a {term}`hybrid cryptosystem` for encryption. This approach involves generating unique shared secrets, known as "session keys," for each session. For detailed information on this topic, please refer to the chapters [](encryption) and [](decryption).
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(decryption_chapter)=
|
||||
# Decryption
|
||||
|
||||
Message decryption is the process of taking an encrypted message and recovering its plaintext.
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(encryption_chapter)=
|
||||
# Encryption
|
||||
|
||||
[Encryption](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-confidentiality-via-encrypt) is one of the core facilities of OpenPGP. It provides confidentiality.
|
||||
|
@ -48,7 +47,7 @@ Two generations of encryption mechanisms are currently relevant in OpenPGP, and
|
|||
|
||||
The main difference between these lies in the symmetric part of the encryption mechanism, represented by versions 1 and 2 of the *Symmetrically Encrypted and Integrity Protected Data* packets (abbreviated as "SEIPD"). The two versions use different mechanisms to provide non-malleability. More on these below.
|
||||
|
||||
Older, legacy encryption mechanisms exist in OpenPGP. However, those must not be used for encryption anymore. Messages encrypted using these legacy mechanisms may still be decrypted, although with caution. For more information, see the [decryption](decryption_chapter) chapter.
|
||||
Older, legacy encryption mechanisms exist in OpenPGP. However, those must not be used for encryption anymore. Messages encrypted using these legacy mechanisms may still be decrypted, although with caution. For more information, see the [decryption](/decryption) chapter.
|
||||
|
||||
SEIPD packets are used in combination with two mechanisms that store *session keys*:
|
||||
|
||||
|
|
|
@ -240,7 +240,7 @@ Issuer Key
|
|||
Key
|
||||
In OpenPGP, and cryptography more generally, the term "key" holds different meanings.
|
||||
|
||||
First, it can apply to different [cryptographic primitives](cryptography_chapter):
|
||||
First, it can apply to different [cryptographic primitives](/cryptography):
|
||||
|
||||
- asymmetric public key
|
||||
- asymmetric private key
|
||||
|
@ -510,7 +510,7 @@ Self-signature
|
|||
An {term}`OpenPGP Signature Packet` by the {term}`Certificate Holder` on a {term}`Component` of their own {term}`Certificate`.
|
||||
|
||||
Session Key
|
||||
A unique shared secret used in encryption in a {term}`Hybrid Cryptosystem`. See {ref}`encryption_chapter` and {ref}`decryption_chapter`.
|
||||
A unique shared secret used in encryption in a {term}`Hybrid Cryptosystem`. See [](encryption) and [](decryption).
|
||||
|
||||
Soft Revocation
|
||||
A {term}`Revocation Signature Packet` for a {term}`Certification` or a {term}`Component Key`, which includes a {term}`Reason For Revocation Subpacket` with a {term}`Revocation Code`, that does not signify the target being compromised (e.g., `0` or `2`).
|
||||
|
|
|
@ -3,19 +3,18 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(private_key_chapter)=
|
||||
# Managing private key material in OpenPGP
|
||||
|
||||
## Overview of private keys
|
||||
|
||||
This chapter discusses the handling of private key material within OpenPGP.
|
||||
|
||||
Private key material is associated with component keys, which are integral parts of [OpenPGP certificates](certificates_chapter). For a discussion of packet structure internals, see the chapter {ref}`zoom_private`.
|
||||
Private key material is associated with component keys, which are integral parts of [OpenPGP certificates](/certificates). For a discussion of packet structure internals, see the chapter {ref}`zoom_private`.
|
||||
|
||||
## Terminology: "certificates" and "private keys"
|
||||
|
||||
Recall that in this document, the term *OpenPGP certificate* refers to what are commonly known as "OpenPGP public keys." OpenPGP certificates are the combination of component public keys, identity components, binding self-signatures, and third-party certifications,
|
||||
as discussed in the previous chapter ({ref}`certificates_chapter`).
|
||||
as discussed in the previous chapter ([](/certificates)).
|
||||
|
||||
This chapter focuses on the corresponding counterpart to the elements of certificates: the *private key material* of component keys.
|
||||
|
||||
|
|
|
@ -43,7 +43,7 @@ The OpenPGP standard defines a set of [Signature types](https://www.ietf.org/arc
|
|||
- **{term}`Signatures over data<Data Signature>`**: These signatures are denoted by {term}`type IDs<Type ID>` `0x00` for binary documents and `0x01` for canonical text documents. The {term}`signer` uses these {term}`signatures<OpenPGP Signature Packet>` to claim ownership, assert creation, or certify the immutability of the document.
|
||||
- **{term}`Signatures on components<Signature On Component>`**: These are {term}`signatures<OpenPGP Signature Packet>` that are associated with {term}`component keys<Component Key>` or {term}`identity components<Identity Component>` of a {term}`certificate<OpenPGP Certificate>`.
|
||||
|
||||
{term}`Signatures on components<Signature On Component>` are a complex topic, and we discuss them in depth in {ref}`component_signatures_chapter`. They are grouped based on two criteria:
|
||||
{term}`Signatures on components<Signature On Component>` are a complex topic, and we discuss them in depth in [](/signing_components). They are grouped based on two criteria:
|
||||
|
||||
- the origin of the {term}`signature<OpenPGP Signature Packet>`, distinguishing between a {term}`self-signature` and a {term}`third-party signature`
|
||||
- the nature of the statement made by the {term}`signature<OpenPGP Signature Packet>`, such as certifying an {term}`identity` or binding {term}`component keys<Component Key>` into a {term}`certificate<OpenPGP Certificate>`
|
||||
|
@ -57,7 +57,7 @@ An overview of {term}`signature types<OpenPGP Signature Type>` in OpenPGP
|
|||
|
||||
This chapter will cover the overarching principles applicable to all {term}`OpenPGP signature types<OpenPGP Signature Type>`.
|
||||
|
||||
For more detail about specific {term}`types of signatures<OpenPGP Signature Type>`, see the chapters on [](/signing_data) and {ref}`component_signatures_chapter`, respectively.
|
||||
For more detail about specific {term}`types of signatures<OpenPGP Signature Type>`, see the chapters on [](/signing_data) and [](/signing_components), respectively.
|
||||
|
||||
## Structure of an OpenPGP signature packet
|
||||
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(component_signatures_chapter)=
|
||||
# Signatures on components
|
||||
|
||||
This chapter examines {term}`OpenPGP signatures<OpenPGP Signature Packet>` associated with {term}`certificate components<Component>`, applying to:
|
||||
|
@ -13,7 +12,7 @@ This chapter examines {term}`OpenPGP signatures<OpenPGP Signature Packet>` assoc
|
|||
|
||||
{term}`Signatures on components<Signature On Component>` are used to construct and maintain {term}`certificates<OpenPGP Certificate>`, and to model the {term}`authentication` of {term}`identities<Identity>`.
|
||||
|
||||
This chapter expands on topics introduced in the {ref}`certificates_chapter` chapter.
|
||||
This chapter expands on topics introduced in the [](certificates) chapter.
|
||||
|
||||
## Self-signatures vs third-party signatures
|
||||
|
||||
|
|
|
@ -14,7 +14,7 @@ it does not automatically signal if the expected party indeed controls the {term
|
|||
|
||||
{term}`Data signatures<Data Signature>` can only be issued by {term}`component keys<Component Key>` with the *{term}`signing<Signing Key Flag>`* [key flag](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-flags).
|
||||
|
||||
Note that {term}`data signatures<Data Signature>` are distinct from {ref}`component_signatures_chapter`, which are used to form and maintain {term}`certificates<OpenPGP Certificate>`, as well as to {term}`certify<Certification>` {term}`identities<Identity>` on {term}`certificates<OpenPGP Certificate>`.
|
||||
Note that {term}`data signatures<Data Signature>` are distinct from [](/signing_components), which are used to form and maintain {term}`certificates<OpenPGP Certificate>`, as well as to {term}`certify<Certification>` {term}`identities<Identity>` on {term}`certificates<OpenPGP Certificate>`.
|
||||
|
||||
(data_signature_types)=
|
||||
## Signature types
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(verification_chapter)=
|
||||
# Signature verification
|
||||
|
||||
Signature verification in the OpenPGP protocol is a complex process.
|
||||
|
|
|
@ -3,7 +3,6 @@ SPDX-FileCopyrightText: 2023 The "Notes on OpenPGP" project
|
|||
SPDX-License-Identifier: CC-BY-SA-4.0
|
||||
-->
|
||||
|
||||
(versions)=
|
||||
# OpenPGP versions
|
||||
|
||||
## Differences between OpenPGP versions
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue