5

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server.

GPG has several features available, namely: 1) encrypt, 2) decrypt, 3) sign, and 4) verify. Given these options: What is the most secure way to use PGP to send & receive emails?

When sending, do I encrypt my emails? Or sign and encrypt? Or just sign? Which is best? And what is the difference between them?

What about receiving emails? What do you consider the most secure? If someone sends me an email, should I insist that it be signed? or encrypted? or something else?

There are many, conflicting explanations on blogs, tutorials, etc. for the best way to use PGP. I am looking for a "Plain English" explanation, geared towards non-InfoSec people like myself.

Note: I am not using the OS X Mail app, as I use a 3rd party email client (Sparrow).

Update: I am not interested in installing another email client. GPG comes with OS X Services menu items including encrypt, decrypt, sign, and verify. These will work with any application, email or otherwise. That is what I am using.

2
  • If the user you are contacting has you in their keyring, you can encrypt your message with your private key first and then their public key, doubling the encryption. To decrypt they would use their private key, and your public key on the message.
    – cutrightjm
    Jan 16, 2014 at 7:45
  • @ekaj Can you explain how to do that using GPG on OS X?
    – jerzy
    Jan 17, 2014 at 13:12

3 Answers 3

2

The most secure way to send and receive emails via PGP is to sign and encrypt them.

Signing provides integrity, allowing recipients to verify that the message was sent by you and has not been tampered with.

Encryption provides confidentiality, ensuring that any person who intercepts the message will not be able to read it.

Both of these are important aspects of security, although in some cases you may decide you only need one and not the other when sending mail.

For receiving mail, the one you are most interested in is signing, otherwise you cannot guarantee that the message is indeed from the sender. If you receive an unencrypted message, other people who are/were able to obtain it would be able to read it, but there's not much you do about that if its already been sent (unless you wanted to encrypt it for storage on your own PC, or to forward on to other people).

0

Using GnuPG is very easy with either Thunderbird or SeaMonkey and the Enigmail plug-in. Both are available for OS X. Signing, encryption and decryption are handled in the background, and key management is straightforward.

I don't find anything about GnuPG support in Sparrow, and this GPGTools post states that its "development was discontinued as of October 2012" after purchase by Google. You would need to do signing, encryption and decryption with the standalone GnuPG client.

Signing provides evidence that you created a message. And it also tells the recipient what public key to use for encrypting a reply. Encrypting prevents third parties from reading messages. However, message headers are not encrypted, given the mechanics of email transmission.

Commonly, you might sign messages going to mailing lists or other public forums, where encryption would be counterproductive. Signing and then encrypting is typical for private messages, although some also sign after encryption. For messages to multiple recipients, you can jointly encrypt to all of the public keys, so each recipient can decrypt them. Enigmail also encrypts outgoing messages to your public key, so that you can read them too.

What you require of correspondents is up to you. For anything where privacy matters, I only correspond with those who sign and encrypt. If identity matters, I only correspond with those whose keys have been signed by trusted third parties. If it really matters, I get public keys from multiple sources, and verify that they're identical.

The mailing list [email protected] is a good resource.

2
  • 1
    I am not interested in installing a second email client. GPG has an OS X services menu, and I should be able to use that with Sparrow just fine.
    – jerzy
    Jan 16, 2014 at 19:42
  • Other than that, this is a great answer and you explained it well.
    – jerzy
    Jan 16, 2014 at 20:01
0

Gone through your question and here I found some solution for that.

I suggest to use Thunderbird for this, as you can easily set up PGP. To encrypt your emails using PGP, you need to generate a public key and a private key. Just follow the steps(for Thunderbird) by following the steps suggested by the PGP key wizard. To launch it, choose OpenPGP->Setup wizard.

1. Signing: Choose “Yes..”

2. Encryption: Choose “No.."

3. Preferences: Choose “Yes”

Open PGP key not found: If you have no PGP key, this screen shows you how to generate one. Creating a key: To prevent your secret key being used by anyone else, the wizard suggests you protect it with a password. Optional: You can create a revocation certificate. This will allow you to disable your key if you lose it.

Sending an encrypted message: In Thunderbird, click the “write” button, which opens a message window. At the bottom right there are two symbols, a pencil and a key.

These allow you to sign or encrypt a message. Click on the key, which will turn yellow, and write your message.

If you click on “send” and you have not retrieved the addressee’s public key, Thunderbird will suggest downloading if for you. In the screen below, click on “Download missing keys”.

Hope this will help you.

1
  • 1
    I am not interested in installing a second email client. GPG has an OS X services menu, and I should be able to use that with Sparrow just fine.
    – jerzy
    Jan 16, 2014 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .