What is the most secure way to send emails using PGP?

Question

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server.

GPG has several features available, namely: 1) encrypt, 2) decrypt, 3) sign, and 4) verify. Given these options: What is the most secure way to use PGP to send & receive emails?

When sending, do I encrypt my emails? Or sign and encrypt? Or just sign? Which is best? And what is the difference between them?

What about receiving emails? What do you consider the most secure? If someone sends me an email, should I insist that it be signed? or encrypted? or something else?

There are many, conflicting explanations on blogs, tutorials, etc. for the best way to use PGP. I am looking for a "Plain English" explanation, geared towards non-InfoSec people like myself.

Note: I am not using the OS X Mail app, as I use a 3rd party email client (Sparrow).

Update: I am not interested in installing another email client. GPG comes with OS X Services menu items including encrypt, decrypt, sign, and verify. These will work with any application, email or otherwise. That is what I am using.

Answer 1

The most secure way to send and receive emails via PGP is to sign and encrypt them.

Signing provides integrity, allowing recipients to verify that the message was sent by you and has not been tampered with.

Encryption provides confidentiality, ensuring that any person who intercepts the message will not be able to read it.

Both of these are important aspects of security, although in some cases you may decide you only need one and not the other when sending mail.

For receiving mail, the one you are most interested in is signing, otherwise you cannot guarantee that the message is indeed from the sender. If you receive an unencrypted message, other people who are/were able to obtain it would be able to read it, but there's not much you do about that if its already been sent (unless you wanted to encrypt it for storage on your own PC, or to forward on to other people).

Answer 2

Using GnuPG is very easy with either Thunderbird or SeaMonkey and the Enigmail plug-in. Both are available for OS X. Signing, encryption and decryption are handled in the background, and key management is straightforward.

I don't find anything about GnuPG support in Sparrow, and this GPGTools post states that its "development was discontinued as of October 2012" after purchase by Google. You would need to do signing, encryption and decryption with the standalone GnuPG client.

Signing provides evidence that you created a message. And it also tells the recipient what public key to use for encrypting a reply. Encrypting prevents third parties from reading messages. However, message headers are not encrypted, given the mechanics of email transmission.

Commonly, you might sign messages going to mailing lists or other public forums, where encryption would be counterproductive. Signing and then encrypting is typical for private messages, although some also sign after encryption. For messages to multiple recipients, you can jointly encrypt to all of the public keys, so each recipient can decrypt them. Enigmail also encrypts outgoing messages to your public key, so that you can read them too.

What you require of correspondents is up to you. For anything where privacy matters, I only correspond with those who sign and encrypt. If identity matters, I only correspond with those whose keys have been signed by trusted third parties. If it really matters, I get public keys from multiple sources, and verify that they're identical.

The mailing list [email protected] is a good resource.

Answer 3

Gone through your question and here I found some solution for that.

I suggest to use Thunderbird for this, as you can easily set up PGP. To encrypt your emails using PGP, you need to generate a public key and a private key. Just follow the steps(for Thunderbird) by following the steps suggested by the PGP key wizard. To launch it, choose OpenPGP->Setup wizard.

1. Signing: Choose “Yes..”

2. Encryption: Choose “No.."

3. Preferences: Choose “Yes”

Open PGP key not found: If you have no PGP key, this screen shows you how to generate one. Creating a key: To prevent your secret key being used by anyone else, the wizard suggests you protect it with a password. Optional: You can create a revocation certificate. This will allow you to disable your key if you lose it.

Sending an encrypted message: In Thunderbird, click the “write” button, which opens a message window. At the bottom right there are two symbols, a pencil and a key.

These allow you to sign or encrypt a message. Click on the key, which will turn yellow, and write your message.

If you click on “send” and you have not retrieved the addressee’s public key, Thunderbird will suggest downloading if for you. In the screen below, click on “Download missing keys”.

Hope this will help you.