So I need to get a block of text sent to me over email from a friend, but before he sends it he wants a public RSA key from me.

Am wondering what is the simplest way for me as a newbie to generate this pair and then use it to decrypt the message that gets sent to me?

I've been messing about for a while now tonight with Gpg4win and PuTTY and I "think" I've managed to get as far as generating my own private and public keys with each one.... but is completely beyond me as to how I can now use this to decrypt any message I might get??

Am wondering if there is an easier way for me? Or a straightforward guide I can be pointed to for doing just this?

  • getfiregpg.org/s/home "apply GnuPG operations to the text of any web page, including encryption, decryption, signing, and signature verification" This looks like what I want? Nope, it doesn't seem to be working for me.... going to try this now: ppgp.sourceforge.net Aug 15 '13 at 14:41

The standard solution to exchange encrypted or signed email is PGP or a compatible program such as GnuPG (which is free software). You and he both need to install PGP or GnuPG. There is a Windows front-end and plug-ins for email software including Thunderbird (Enigmail) and Outlook (I don't know the details and I've heard bad things about its ergonomy).

If your friend wants you to use some custom solution, explain to him that home-grown cryptography is never secure. Lead by example by refusing to use his custom scheme.


I suggest you try out the key generation utilities ssh has to offer. There is one particular tool called ssh-keygen which allows you to create a public/private key pair. Github actually has an easy to understand article explaining how to generate these keys.

Once you generate your key pair, you can use your public key to encrypt messages using a PKCS 1.5 algorithm and decrypt the messages using your private key.

The idea behind this is that someone would use your public key to send you secret messages and only you can read these messages by decrypting with your private key.

If you have any programming experience you can try use something like PyCrypto to perform the encryption and decryption operations. I am currently writing some simple crypto command line tools on my github account, but I have not implemented PKCS 1.5 yet.


Apart from GnuPG (see @Gilles' answer), some modern emailing software such as Thunderbird, Outlook or Windows Live Mail (the successor to Outlook Express) has support for S/MIME, which is functionally similar to OpenPGP (that which GnuPG implements). Using S/MIME avoids the "plugin installation" phase. However, it requires that the involved public keys be represented as X.509 certificates. A certificate can be obtained (usually not for free) from one of the few dozens commercial CA that sell such things, and your system and the system of your friend will be able to automatically validate the certificate; alternatively, you can generate your own certificates (e.g. with OpenSSL) but then you will have to do the import manually, and find some way to make sure that what you see as the certificate of your friend is indeed his certificate, not a fake one (this can be done by phoning your friend and spelling out the certificate thumbprint, among other possible ways).

See this blog post for a lot of information.


In your case, the simplest thing to do is:

  • Go to a public CA (Thawte, StartSSL, etc.)
  • Buy/generate an X509 certificate for email validation
  • Add it to your windows personal certificate store (typically, just double-click on the PFX file that contains your certificate and private key)
  • Send a signed email to your friend. He will get the signed email including your public key.

That done, your friend will be able to send you an encrypted email.

  • I don't suppose I could use this with Gmail? Aug 15 '13 at 14:14
  • There is a gmail S/MIME plugin that you can use. Or you can use a fat email client with S/MIME support. Personally, I wouldn't trust a browser plugin for encryption, but that's up to you.
    – Stephane
    Aug 15 '13 at 14:34
  • Actually, that addon is too old to be useful. The very same question was, however, asked and answered before.
    – Stephane
    Aug 15 '13 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.