TUTORIAL

Securing Your Email with OpenPGP: Your Guide to Secure Emailing

by Marryam Mubariz

Organizations and individuals alike depend on email to connect, share news, and communicate with customers. Sadly, technology often brings challenges in addition to its countless blessings. 

For example, email users often become easy targets of cybercriminals, hackers, and attackers who use phishing and other malicious methods to gain unconsented access to their email accounts.

Encrypted email can prevent eavesdroppers from reading your email as it travels across the internet. The most commonly used encryption types are OpenPGP (the specification), PGP (proprietary 'Pretty Good Privacy'), and GPG (GNU Privacy Guard), which is free software.

In this post, we'll delve into how OpenPGP empowers email users to maintain their security, safety, confidentiality, and trustworthiness.

What is PGP Encryption, and How Does it Work? 

PGP (Pretty Good Privacy) encryption is a data encryption and decryption program that uses a combination of symmetric and asymmetric cryptography to encrypt emails, files, and digital communications securely. Phil Zimmermann created the first version of PGP in 1991 as an email encryption application, and it has become the standard term for this encryption technique. 

The foundation of PGP encryption is a public key protocol, in which communications are encrypted and decrypted using a key pair—a public key and a private key. The public key is uploaded to an external key server or transferred directly to prospective email recipients. Your contacts can encrypt emails they send you with this key, but you are the only one who can access the private key.

There is only one public key associated with a private key. Without a private key, it is very difficult to retrieve the content of an encrypted message. Although nothing is impossible in the era of supercomputers, it is challenging to decrypt a message without a private key. This means you need to keep your private key in a secure location!

The other person should also use PGP. In this manner, they can provide you with access to their public key, enabling both parties to send and receive emails securely. Because both sides utilize distinct keys, the public key protocol is considered an asymmetrical method.

Applications For PGP Encryption

PGP and other asymmetric encryption have been used in the IT industry for some time. Below are some of the most common use scenarios.

• Encrypting private communications: One of the primary applications of PGP is the encryption of emails and other messages.

• File system and file encryption: PGP can be used to encrypt files on a server or local storage device in addition to encrypting messages.

• Digital signatures: PGP is frequently used to verify a message or file's legitimacy. You may verify whether a communication is indeed from the sender by looking for a PGP signature.

Getting the Key For PGP Encryption

A PGP key can be obtained through a PGP program such as GPG4WIN or from vendors offering tools through the Internet Engineering Task Force (IETF)- supported open-source solution OpenPGP. After downloading and running the application, choose the "Generate key now" option in the pop-up box.

Is PGP Safer?

PGP is extremely safe if used correctly and securely by individuals and organizations’ employees. The encryption method uses algorithms that are considered unbreakable, making it one of the most secure ways to protect data and cloud systems. Protecting data with PGP makes it virtually impossible for hackers to intercept it.

Why Use OpenPGP for Email Security?

OpenPGP is a powerful tool for keeping your email communications private and secure. By encrypting your messages, it ensures that only the intended recipient can access your confidential data, protecting against unauthorized access. 

In addition to encryption, OpenPGP enables digital signatures, allowing recipients to verify that a message is genuinely from you and hasn't been altered in transit. This added layer of security helps defend against phishing, hacking, and other cyber threats. 

OpenPGP is also widely compatible with various email clients and operating systems, making it accessible even for users without technical expertise. Beyond email, it can encrypt files stored on local devices or servers, ensuring that sensitive information remains protected.

Getting the Key for PGP Encryption

A PGP key can be obtained through a PGP program such as GPG4WIN or from vendors offering tools through the Internet Engineering Task Force (IETF)-supported open-source solution OpenPGP. Choose the "Generate key now" option in the pop-up box after downloading and running the application.

Step 1: Choose And Set Up the Relevant PGP Application

The first step is to locate PGP software that works with your email client and operating system. For Linux users, the open-source program GnuPG (GNU Privacy Guard), which was first made available in 1997, is an excellent choice. Many computers have the older 1.4 version pre-installed. 

However, the most recent version is available for download on GnuPG's official website and will work for most users. 

Step 2: Create A Key Pair

A key pair can be generated after installing the PGP software. Use the key generation command from the program's manual after launching the command line. This is a GnuPG sample:

sudo gpg --gen-key

sudo gpg --gen-key 

Step 3: Provide Your Contacts With the Public Key

The generated keys can be managed through the terminal, Seahorse (for Gnome/Unity), or the KGpg graphical user interface (for KDE). Using GnuPG, the command-line command for the private key is:

sudo gpg --list-secret-keys

sudo -K 

and for the public key:

sudo gpg --list-keys

sudo -K 

You have the option to export the keys directly or view a list of them. The generated.asc file can be posted to a certificate server or delivered as an attachment to your contacts via email. A contact can send you encrypted messages if they have your public key and a key management application. You will need the same contact's public key in order to send encrypted emails to them.

How is Encrypted Email Used?

GPG can be used for three fundamental tasks: verification, encryption, and signing.

• Signing: When you sign something, a signature block is created and attached to the item you are signing using your private key and passphrase. This signature block is created using your private key and a numerical value that is calculated from the message's contents.

• Verifying: Using the public key that was used to encrypt the document, someone can confirm that anything they have received has been signed. The sender may email the public key, or it may be retrieved via a keyserver. Verification proves two things: (1) the message was signed by a person with the private key, and (2) the message's contents remained unaltered during transmission.

• Encrypting: The recipient's public key is required to encrypt a message. To encrypt something, you don't even need your own gpg key or passphrase. But when you submit anything, the majority of programs will additionally encrypt it using your public key. Otherwise, you wouldn't be able to read a message after it was encrypted. The email's contents are no longer readable while in transit once it has been encrypted. But the sender, the subject, and the recipient.

Final Thoughts 

As cybersecurity threats continue to evolve, email encryption is key. OpenPGP offers a reliable and accessible way to protect your data and ensure messages remain private and secure. By leveraging encryption and digital signatures, individuals and organizations can safeguard their data against unauthorized access, phishing attacks, and hacking attempts. 

While setting up and using PGP may seem technical at first, the added security is well worth the effort.

Want to learn more about protecting your data? Check out the CBT Nuggets course on Linux Security Essentials.