We have this topology in our company:
A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed).
The problem is this:
- John and Paul install the certificate.
- John encrypts using the public key and sends the PGP file to Paul.
- Paul needs the private key in order to open it (+ verify it).
But wait! The private key is private and Paul should not have access to it. So how will Paul decrpyt John’s data ?
Even if Yoko gets the file attached to the email from John - she SHOULD NOT be able to open it. Only Paul. We NEED to send encrypted files from John to Paul, not only securing SSL - but the FILE itself. (The documents have very sensitive data.)
What am I missing?
(p.s. I know I can install PGP as an add-on into Outlook, but I'm trying to understand the concept of Paul not being able to have the private key.)