A few years back, a very clever and nice man called Phil Zimmermann came up with a thing called Pretty Good Privacy. It uses key pair encryption to allow people to send each other private mail. What’s so special about that, you might say, isn’t all email private? In a word, no. When you send a normal email it is like sending a postcard to the government (and anyone else who likes to snoop on you). Standard emails can (and will be) intercepted and read by several people before they get to the person they were sent to. Encrypting your mail is like putting it in a sealed envelope, something most people would do normally if it were a physical letter, but rarely do for email.
How it works (the simple version):
You need to install a version of the PGP software to start with. Once you’ve done that, it will prompt you to generate three things:
- Public Key
- Private Key
- Passphrase
You keep your Private Key safe on your computer, and make your Public Key available to everyone who might need it.
If someone wants to send you a mail they use your Public Key to encrypt it. So it’s important that you make sure that all your friends have your Public Key – send it to them, print it on your web page, or upload it to a Key Server, so that people can find it easily. Live Journal has a special function dedicated to this – once someone has uploaded their Public Key this way you can get it by clicking on the key icon next to their name on their User Info page.
When someone uses your Public Key to send mail to you, it can only be read by using your Private Key and your passphrase – so you should always keep both your Private Key and your passphrase as secure as possible. As long as no-one else has both of these things, your mail is safe, and can only be read by you.
Likewise, to send someone a private email you use their Public Key to encrypt mail going to them. So you need a Public Key for every person you want to send mail to. If you don’t have a Public Key for the person you are sending mail to, you can ask them to send you their Public Key, or search for it on a Key Server.
Remember, the Public Key locks a mail, the Private Key unlocks it. That’s why both keys are needed, and that’s what keeps the system so secure.
You can also use PGP to digitally sign your mail (even if it’s not encrypted). This works sort of the other way around from encryption. You use your Private Key to sign a mail, and the recipient can use your Public Key to verify that the signature is valid. So if someone sends you a signed mail you can be sure it really comes from them.
Unlike most other encryption systems, PGP is not a proprietary system – it is Free Open Source Software. That means that scientists and security researchers can ensure that the system is really safe. Almost all other “secure” systems and encryption schemes are closed, so their security can never be verified. On top of that, most other systems have back doors that allow government agencies to bypass them easily. So only PGP-based systems are truly trustworthy.
Speaking of trust, PGP keys also operate a web of trust. If you give me your key, and I know it really comes from you, I can sign it with my key. This means that if someone trusts me and my key, they can be pretty sure if your key is signed by me then it is also trustworthy. You can and should get your keys verified and signed by someone trustworthy. Ways to verify a key include:
- Have it given to you by hand by the owner
- Have it sent by email, and have the owner read the key fingerprint over the phone
- Download it from the user’s personal web site
The most trusted way for me to get a key is for you to physically give it to me by hand, on a USB stick or something similar; if I don’t know you personally you should also provide material identification at the same time, such as showing me your passport or driving license – that way I can be sure the key really belongs to you, and that you are who you say you are. If I know you well, an easier way to verify a key is for you to send it to me by email and then call me on the phone to tell me the key’s fingerprint, which can verify that the key I received is correct. Every PGP key has a “fingerprint” which makes it easy to check if it’s accurate. If your key is on your personal web site, or on your Live Journal profile page it’s probably fairly trustworthy too.
Once I’ve verified that your key is correct, I can sign it and send it back to you. Then when you send it to someone else, they can see that I’ve verified that your key is correct, and that you are who you say you are. So if they already trust me, they now know that they can trust you too.
Once you’ve received some keys, and made sure that you know a couple of them are trusted, PGP automatically will work out just how trustworthy all of the other keys you receive are. It’s a very clever system that works very well, without requiring any centralised control.
One other thing of note: many people I know use PGP, but only use it for mails that contain sensitive information. If you think about it, that’s not a great idea, since it means that you are telling anyone who might be listening that mails that are encrypted are actually worth trying to crack. So if you have PGP and so have your friends, you should send everything encrypted – that way you make an eavesdropper’s job much much harder, since he’ll have to try to crack every insignificant note you send, just in case he misses something. Some email programs (like Thunderbird Enigmail) allow you to set automatic encryption for those who can receive it, it’s a useful function.
How to get it:
- If you use Mozilla Thunderbird for mail (and you should, it’s great), the best solution is the Enigmail extension. Just install this and away you go – Thunderbird becomes a fully integrated OpenPGP client. Do make sure that you read the installation instructions carefully though!
- If you are using some other email client such as Evolution or Outlook, a good solution is Gnu Privacy Guard (GPG) which is a fully Free version of PGP. If you’re using Windows the best way to install this is to use GPG4Win. If you’re running GNU/Linux, it’s probably already installed on your system by default.
- If you’re not much of a computer hacker and are running Windows or Mac OS and want the easiest installation possible, the simplest solution is to download the commercial version of PGP. There’s a free trial version at PGP.com, and it should do pretty much everything you need – don’t worry if it gives you warnings about it timing out after 30 days, the useful functions you need will last forever. If you want to buy it (and I do think it’s worth it if you don’t want to futz around with GPG), then please buy it directly from Phil Zimmermann, he deserves your money.
My public key is listed here – please grab it and use it. Note that, yes it’s a simple text file! You just need to select the text and copy & paste it like any other piece of text.
If you use PGP/GPG please let me know so I can get your key. I’m also happy to sign keys if I know you, please contact me about this if you wish.