Question

I am able, with pidgin otr for example, capable of communicating with anyone and it is secure.
We haven’t exchanged a secret passkey or anything else, the program just sets up the encryption and everyone assures me it is secure.

So what I have is this:

Person1 talking to Person2 (Assuming people really are who they say they are)

Since no info was ever exchanged between person1 and person2, what’s to stop a badperson3 from intercepting all the traffic and deciphering all the messages?

I read about PGP, about how each machine has a private key and a public key that is shared between the two computers, but I don’t fully get how this can work. It’s not like person2 can encode messages using person1’s private key, and if it uses the public key, anyone listening can decipher.

I’m a bit confused.

Answer 1

Without getting into technical details, the whole idea of public key cryptography like RSA is that the public key can be used to encrypt data, but cannot be used to decrypt what it just encrypted (without breaking the encryption, of course — in the case of RSA that normally means factoring the product of two large primes).

There is, of course, still some data exchanged: you still need to get a person’s public key before you can encrypt data using that public key. It’s also worth noting that public key cryptography is generally a lot slower than symmetric cryptography. That being the case, most protocols that use public key cryptography try to minimize the amount of data encrypted using the public key algorithm. Typically, the sender will pick a random number of the right size to use as a key with a symmetric algorithm, encrypt it with the public-key algorithm, and send it to the receiver. The rest of the data is encrypted with the symmetric algorithm, using that key.

As such, in a typical case you’re retrieving a public key, then generating, encrypting, and sending a private key, then sending data encrypted with that private key.