Symantec PGP Command Line Encryption Evaluation Guide

Covers version 10.3 of PGP Command Line

Getting Started Installing PGP Command Line is the first step for a Proof-of-Concept, so this document details system requirements and deployment considerations for PGP Command Line. Make sure that you complete the “Steps to Do before Starting Evaluation” checklist on the next page in advance of the evaluation. Also, if you will be purchasing hardware consult the Technical Requirements before completing any other steps so you have time to order and receive the hardware. Also, keep in mind that the Technical Requirements listed in this document are scaled down for an evaluation.

Contents PGP Command Line Encryption Checklist .......................................................................................... 3 Notes .................................................................................................................................................. 4 PGP Command Line Encryption Evaluation Architecture .................................................................. 5 Technical Requirements..................................................................................................................... 6 Reference material............................................................................................................................. 13 Test Plan ............................................................................................................................................. 14

.

Command Line Encryption Checklist Use the following checklists as an overview of the steps that need to be accomplished for the evaluation.

Steps To Do Before Starting Evaluation  Using the sample test plan at the end of this document to help you create your own test criteria / plan  Prepare a compatible environment. This will include: o Creating a virtual machine for PGP Command Line (or physical hardware). Specific system requirements are located in the Technical Requirements section of this document o Or, PGP Command Line is a small application that does not change system settings or alter system behavior. You could install PGP Command Line on any compatible system for testing. However, it would be recommended that you avoid using production data or systems that already have other encryption software on them for this testing.  Here is a link to the trialware page for PGP Command Line. Download the 10.3 version.

Evaluation Steps  Install PGP Command Line  Complete post-installation steps for PGP Command Line: o License PGP Command Line o Generate a cryptographic keypair o Export a public key o Import a public key o Encrypt and decrypt a file o Sign and verify a file  Perform desired tests

Symantec PGP Command Line Evaluation Guide

3

Notes    

This document has been written to work for customers, Symantec Sales Engineers, and partner Technical Pre-Sales Engineers This document assumes the reader is knowledgeable about PGP products (has done practice or production installations, has read the documentation and is familiar with the Knowledgebase, etc.) This document assumes the reader has access to Symantec technical publications This evaluation guide assumes the use of a lab environment which is recommended for testing. If production equipment will be used please make sure that a current backup of all related systems is taken and that the current release notes are checked for potential incompatibilities. It is also recommended that no production data is encrypted during this testing.

Symantec PGP Command Line Evaluation Guide

4

Technical Requirements All systems that are part of the evaluation should meet or exceed the minimum system requirements defined below. PGP Command Line Requirements Component

Specifications

Processor

1 GHz or faster processor recommended

Memory

1 GB required

Hard Disk

2 GB of available hard-disk space

Operating System

Windows Server 2012 Windows 8 Enterprise Windows 8 Pro Windows Server 2008 Windows Server 2008 R2 Windows 7 Windows Vista Windows Server 2003 Windows XP Pro HP-UX 11i and above (Itanium 2 and similar processors, 64-bit) IBM AIX 5.3 (TL11+) and 6.1 (TL4+, PowerPC) Red Hat Enterprise Linux 5.4, 5.5, 5.8, 6.0 (x86 and x86_64), 6.4 (x86_84) SUSE Linux Enterprise Server 10 SP2 (x86), 11 (x86 and x86_64) Oracle Solaris 9, 10 (SPARC, 32-bit), 11 (SPARC, 64-bit) Oracle Solaris 10 (x86) Oracle Solaris 10, 11 (x86_64) Apple Mac OS X 10.5, 10.6, 10.8.2, 10.8.3 (x86)

Other requirements

Virtual environments are commonly used for testing PGP Command Line

Sandbox Environment:

An internal file server:  

If you are able to choose your test domain name, use “acme.com” for the internal domain Create at least one user account for the users on your server.

Symantec PGP Command Line Evaluation Guide

5

Installation and Configuration Steps – Command Line In this section we will briefly discuss the tasks that must be performed to prepare PGP Command Line for the test environment. Other documentation covers this in more detail, including the PGP Command Line User’s Guide, chapter 2. This document will give only the steps necessary to prepare for this evaluation. Please download the most current PGP Command Line User’s Guide to help you complete the tasks referenced here. A chart of PGP Command Line commands can be found here. Other Symantec PGP documentation can be found here. Important information for our environment PGP Command Line hostname 

IP Address



Administrator credentials

Symantec PGP Command Line Evaluation Guide

6

Server installation 1) Use the Installing on Windows section of the PGP Command Line User’s Guide on pages 19-21 to complete a Default installation. The installation process typically takes 5-10 minutes.

Licensing PGP Command Line 1) Logon to system where PGP Command Line is installed. 2) Open a command prompt. 3) Run this command: pgp --license-authorize --license-name "Authorized User" --license-organization "Authorized Company" --license-number "D4LVN-LH6UG-CUNWP-YLMBP-GDR59-PVA"

Generate a cryptographic keypair 1) Run the command: pgp --gen-key “MYORGANIZATION [email protected]” --key-type rsa --bits 2048 --passphrase “passphrases are better than passwords” Note: you will need to choose your own name (MYORGANIZATION), email address ([email protected]), key type (rsa), key size (2048), and passphrase (“passphrases are better than passwords”).

Sending your public key 1) Run the command: pgp --export MYPUBLICKEY 2) A new file called “MYPUBLICKEY.asc”. Send this file to the business partner that needs to send you encrypted files.

Receiving a public key Receiving a public key has several important security steps: a) Save the received public key to a file b) Import the public key c) Fingerprint the public key d) Validate the public key e) Set trust on the public key Improper handling here invalidates the security and potentially allows a hacker (man-in-the-middle) to intercept secure communicates and read them. This is a VITAL security step. This will need to be done for each recipient and repeated as the recipient changes keys. Save the received public key to a file For this section, assume the file is called “consultant.asc” Import the public key 1) Run the command: pgp --import consultant.asc

Symantec PGP Command Line Evaluation Guide

7

Verifying the public key 1) Find the key by running this command: pgp --list-keys consultant 2) Provided just one key is listed, run this command to generate a human readable “fingerprint” of the key: pgp --fingerprint consultant –biometric The result is a unique set of words that looks like:

3) Now contact the owner of that key out of band. If you received the email from “[email protected]”, use a phone number obtained separately (not from the signature line, not from the site that also provided the email address, etc.) This might be a separate person who you already know or have met face-to-face and trust. 4) You will ask for their keywords (do not tell them!!!). If those are the same as what you had recorded, then you can be sure that their key was received (and not an attacker’s key.) Trust the public key 1) In order to trust a key, you first need to sign it and then set the trust on it. 2) Sign the key: pgp --sign-key consultant --signer MYORGANIZATION --passphrase “passphrases are better than passwords” 3) Trust the key: pgp --set-trust consultant --trust complete

Encrypting a file Assume, for this section, that the file that needs to be encrypted is called “file.txt” and that it needs to go to “consultant”, as previously configured. 1) Run this command: pgp --encrypt file.txt --recipient consultant 2) A file called “file.txt.pgp” should be created – send this to “consultant”.

Decrypting a file Assume, for this section, that the file that needs to be decrypted is called “results.txt”. 1) Run this command: pgp --decrypt results.txt.pgp --passphrase “passphrases are not passwords” 2) A file called “results.txt” should be created.

Signing a file Assume, for this section, that the file that needs to be signed is called “autograph.txt”. 1) Run this command: pgp --sign autograph.txt --passphrase “passphrases are not passwords” 2) A file called “autograph.txt.pgp” should be created.

Symantec PGP Command Line Evaluation Guide

8

Verifying the signature on a file Assume, for this section, that the file that needs to be verified is called “autograph.txt.pgp”. 1) Run this command: pgp --verify autograph.txt.pgp 2) A file called “autograph.txt” should be created with a message that it is a good signature.

Congratulations! You have just deployed PGP Command Line Encryption! If you need to test other features please consult with your Symantec representative.

Symantec PGP Command Line Evaluation Guide

9

Helpful links and reference material 1) For the Support KB landing page for PGP Command Line, go here. 2) If you want more information about a command in PGP Command Line use the “pgp --help” command.

Test Plan & Policy Adjustment A thorough and effective test plan is defined below. Before starting it, you might consider what will make a successful test in your environment. There are most likely compliance and other concerns that are driving your desire to test this software. You might consider defining the following before starting: 1. What are the most important features of this software to our company? a) Business concerns? b) Security concerns? c) Compliance requirements? 2. During testing, what are the results that I must have in order for this to be a success? 3. What is my one to two paragraph written test plan (mission statement for the Evaluation)? This is probably a summary of the answers to questions 1 and 2. 4. What additional Symantec features would I like to see, either as part of this test or as a separate undertaking? 5. What additional encryption features besides file encryption will my company use? Do I need to test these features now?

Symantec PGP Command Line Evaluation Guide

10

Symantec PGP Command Line - Test Plan The following test criteria are not intended to represent all requirements for an enterprise file encryption solution, rather to provide some guidance as to commonly tested features. To address specific requirements in your environment please consult with your Symantec Technical Sales Representative to assist in documenting these additional requirements Some of these tests require some subjective grading as far as pass or fail. Test process for Command Line: 1. Send an unencrypted file to an “incoming” folder on a server. 2. Move the file to a “processing” folder on a server. 3. Encrypt the file in that folder. 4. Move the encrypted file to a “pickup” folder. 5. Repeat this process for several files and several different encryption types (key, passphrase, selfdecrypting archive). 6. Optionally, create a script to execute these commands more easily.

Symantec PGP Command Line Evaluation Guide

11

Copyright © 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, Symantec Network Access Control, Symantec Sygate Enterprise Protection are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 20330 Stevens Creek Blvd. Cupertino, CA 95014 http://www.symantec.com

Symantec PGP Command Line Evaluation Guide

12