The following is the fourth post in a series entitled, “Securing your Email.” So far in this series, I’ve done a lot of talking about the theory of secure email and why you might want to make your email more secure. If you’re not familiar with these concepts, I strongly urge you to go back and read the rest of this series. In this post, I’m going to highlight how you can get started using public-key encryption today, using only free software.
Disclaimer: It’s important that you read this entire post before attempting anything. It is perfectly acceptable to create a “test” key using a fake name and email address. Just make sure you label it as “test” and that you delete it (or revoke it) when you’re done. Also, creating a key is (somewhat) serious business. Only create one if you plan on using it and keeping track of it.
Before we begin, we need to get a few terms out of the way. First, I’ve oversimplified one point up until now. I let the term “encryption key” have multiple meanings. An “encryption key” is actually an “encryption key pair.” Each pair consists of a “public key” and a “private key.” As you can probably guess, a “public key” is meant to be shared with anyone and everyone. For example, here’s mine. It is meant to be your public electronic identity. If anyone wants to check whether I truly wrote an email that I’ve digitally signed, they can use my public key to verify the authenticity of the message. A “private key” is never meant to leave your possession. Never, ever give someone access to your private key. It is the lifeline of your electronic identity. It’s used to digitally sign outgoing messages and to decrypt any private mail sent to you. Your private key is still passphrase-protected, so as long as you’ve chosen a strong passphrase, your key is relatively safe even in the wrong hands. This is why it’s important to use an extremely strong passphrase when creating your key: uppercase and lowercase letters, numbers, and symbols that is at least 8 characters long. It is almost certain that your passphrase will be the weakest link in the security of your key. Check out this article by Microsoft to learn more about creating a truly secure passphrase.
Let’s take a minute to understand how public and private keys work together. Basically, you are the only one who uses your private key, and everyone else uses your public key. For example if I want to digitally sign an email, my private key takes a snapshot of the outgoing email and attaches a small digital signature to the message (attachment: signature.asc). The signature is tied to the exact text of my email. If the contents of the message is altered en-route, it will not validate when it reaches the recipient. When you receive my email, FireGPG or Enigmail will see the signature.asc attachment and analyze it using my public key, which will be retrieved from the Internet if it’s not on your computer already. If my message has not been altered, the signature shows up as “valid.” No matter what, the message of the email will be visible, and if the recipient does not use any GPG-capable software, the email will look normal (except for a simple signature.asc file attached to it).
Encryption and decryption work differently. If I encrypt a message to you, I want you to be the only one able to read it. So, I encrypt the email using your public key. The text of the email is encoded, and the only way to read the original message is for you to decode it using your private key. Nobody else can read the message (unless they’ve somehow stolen your private key and cracked the passphrase). Not to get too technical, but you can actually use digital signatures and encryption at the same time. For example, I want to send you a message that is meant only for you (encryption), and I want you to verify that I actually sent it (digital signature).
Ok, enough talk. To get started creating your key pair, you’re going to need to install a piece of software called GNU Privacy Guard (GPG or GnuPG for short) on your computer. Somewhat confusingly, GPG is a free software implementation of the OpenPGP standard. PGP stands for “Pretty Good Privacy,” an ironic acronym considering that it’s extraordinarily secure. Windows users can download and install Gpg4Win, which should contain everything you need to get started, including the WinPT keyring manager. I’ll discuss more about what a “keyring manager” is in a moment. It looks like a new version of Gpg4Win is due out in a few weeks if you’d rather wait, but you shouldn’t need to. Mac OS X users can install MacGPG, which should likewise contain everything you need to get started. Linux users almost definitely have GPG installed on their system by default along with a keyring manager (like Seahorse for Gnome or KGpg for KDE).
GPG by itself uses a command-line interface. Since most users want a more robust interface, they install additional applications that harness the power of GPG and make it available via a more user-friendly point-and-click interface. The “keyring managers” that I mentioned earlier provide this interface. A keying manager is an application that keeps track of other people’s public keys so that you can verify their digital signatures and encrypt emails to them. They keep track of the trust level of these keys, and they can be used to sign someone’s public key if you want to confirm their identity. A keyring manager can also be used to generate a new key pair for yourself and keep key pairs in sync with the many online public keyservers in the world. As I mentioned in a previous post, if you want to use GPG to sign and encrypt emails, you need to use a browser extension or a desktop email client. Gpg4Win comes bundled with an extension for Microsoft Outlook. Enigmail is a fantastic extension for Mozilla Thunderbird that can serve as a keyring manager and desktop email interface for GPG. FireGPG is a great Firefox extension that can serve as a keyring manager and a GMail interface for GPG. As you can see, software developers, many of whom need to send secure emails every day, have developed a great set of tools that make getting started with secure email fairly easy.
Unfortunatley, I can’t ouline all the possible ways to use this software. I’m going to go through a few examples here and provide some links to relevant documentation. In general, to create a new key for yourself you need to enter your “key manager,” for example by going to “OpenPGP -> Key Management” in Thunderbird (with Enigmail installed) or “Tools -> FireGPG -> Key Manager” in Firefox (with FireGPG installed). Then you want to generate a new key pair by going to “Generate -> New Key Pair” in Enigmail or click “New Key” in FireGPG. If you’re using Gpg4Win without Enigmail or FireGPG, you can follow this guide (although it looks a little dated, and you may want to use the WinPT key manager over GPA). Make sure you enter your full name and the email address you plan on mailing from. The “comment” field can be left blank, unless you’re creating a “test” key. It’s up to you whether you want to give your key an expiration date. (Most people don’t.) If you’re feeling adventurous, check out the advanced options. While most key managers should use these advanced options by default, you want your key to have the following options: “Key size/length: 2048” and “Key Type: DSA & Elgamal.” It will probably take a minute or two to generate your key. Make sure to move your mouse around and do something like browse the Internet, which helps create a strong key. Once your key pair has been created, you’ll be able to add additional email addresses to it if you plan on using more than one.
If you are asked whether you’d like to create a back-up your of key pair and/or create a revocation certificate, do it. If you are not given the option to back up your key pair and you cannot figure out how with the software you’re using (either “back up” or “export” your public and private keys), you may need to use an alternative key manager or the gpg command line tool. For example, FireGPG does not allow you to export a private key (only a public key, which is not an adequate back up). If you are not given the option to create a revocation key/certificate and you cannot figure out how with the software you’re using, you should create one using an alternative key manager or the gpg command line tool. You should back up all three of these files (your public key, your private key, and your revocation certificate) on a USB flash drive, external hard drive, or blank CD and store it in a safe place. This is especially true if you created a key pair without an expiration date. This will be your fall-back so that your key is never completely unusable.
I should take a minute to explain the revocation key (or revocation certificate). It can be used to “revoke” your key pair if it is ever lost or stolen. It will be used to notify public key servers that your key is no longer valid, and it will tell your friends and colleagues to no longer use this key. This is obviously something you want to keep private as well, since someone could easily revoke your key if they got ahold of it.
Now that you’ve hopefully got a functional key pair created, you’ll want to take some steps to enter into a web-of-trust. First, you have to publish your key to one (or many) of the free pgp/gpg key servers. There are likely a few built in to your key manager, like hkp://pgp.mit.edu and hkp://pool.sks-keyservers.net. You can also manually upload your public key to the PGP Global Directory (make sure it’s not your private key!). Now your friends and colleagues can use these key servers to keep track of your public key.
To get your own web-of-trust started among your friends and colleagues, you will need to exchange two numbers with them (usually in person). Your “Key ID” should be fairly apparent in your key manager. Mine is D4188BF6. Your “Key Fingerprint” should also be available through your key manager, but you may need to do a little bit of digging into the key via “Properties.” Mine is C14A 6784 162F 9C42 E404 D37F E5B6 FD50 D418 8BF6. You might notice that the last 8 digits of my key fingerprint match my key ID. These numbers will allow you to positively identify my correct key on a public key server. Thus, you can be sure that if I gave you that key fingerprint, I am in possession of the corresponding private key. If you can positively identify me, you should sign my public key and synchronize that signed key to the key server. Once I do the same for you and more of our friends and colleagues do the same, a web-of-trust will begin to form. Using this, I can reasonably trust people that I’ve never met if their keys are signed by my trusted friends and colleagues.
I realize there was a lot of terminology thrown around in this post that you probably weren’t familiar with. I apologize for that. I also apologize for not giving step-by-step instructions for individual key managers and software. I thought it would be better if I gave more general instructions that should be applicable to any key manager. There should be guides, documentation and forums available to give specifics for most of the popular key managers. If you’re having trouble with that (or anything in this entire series), leave me a note and I’ll see if I can clarify things for you or point you toward an answer.
I’m basically done with “new educational material” for this series. In my final post, I’m going to outline some ways that the medical community could use the tools described here to change the means of communication between health care providers. Since that was my original intent of this series, I hope you’ll tune in for the final installment. It may have a lot of “what ifs,” but it should be interesting to think about.