Information Security

Electronic Mail Encryption

Electronic mails need to be encrypted if you need true privacy when communicating. Encryption is the most practical and effective way of fighting surveillance and privacy violations by the state or any malicious actors like intelligence agencies (unwarranted eavesdropping) and black-hat crackers.

Electronic Mail Encryption can be done using the open implementation of Pretty Good Privacy (PGP, written by Phil Zimmermann) called GNU Privacy Guard (GPG) authored by Werner Koch and others.

gpg

Creating a public key pair:

A public key pair is a pair of keys: A public key and a private key. As the name makes it obvious, you keep the private key to yourself and give out the public key. You can create a key pair like so:

 

 $ gpg --gen-key

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 
Requested keysize is 2048 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 
Key does not expire at all
Is this correct? (y/N)y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Clark Kent
Email address: sman@krypton.net
Comment: Mail for my human identity
You selected this USER-ID:
    "Clark Kent (Mail for my human identity) <sman@krypton.net>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

You need a Passphrase to protect your secret key.
Repeat Passphrase

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

Not enough random bytes available.  Please do some other work to give
the OS a chance to collect more entropy! (Need 187 more bytes)
gpg: key A6D4E3CF marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   6  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 6u
pub   2048R/A6D4E3CF 2015-07-01
      Key fingerprint = 0F1E A29C B027 82AF Cfi1A3  5EB8 6F61 369A A6D4 E3CF
uid                  Clark Kent (Mail for my human identity) <sman@krypton.net>
sub   2048R/780EC813 2015-07-01

2048 bit encryption is sufficient for most people. Just go with the defaults if you are unsure.

Verifying the key

$ gpg --list-keys
pub   2048R/A6D4E3CF 2015-07-01
uid                  Clark Kent (Mail for my human identity) <sman@krypton.net>
sub   2048R/780EC813 2015-07-01

$ gpg --fingerprint A6D4E3CF
pub   2048R/A6D4E3CF 2015-07-01
      Key fingerprint = 0F1E A29C B027 82AF C1A3  5EB8 6F61 369A A6D4 E3CF
uid                  Clark Kent (Mail for my human identity) <sman@krypton.net>
sub   2048R/780EC813 2015-07-01

Fingerprint of a key is a long unique string that identifies your key. The last two words of it make your key ID. A6D4E3CF in this case. This Key ID is used to specify this particular key when listing, exporting, etc.

Exporting Public Keys

Public keys can be exported to a file so they can be mailed to people who need to communicate securely with you. Specific public keys can be exported by supplying the key-id like so:

$ gpg --export -a A6D4E3CF
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1

mQENBFWTjfwBCADRKjyRrGzuuDy8Bu3K41mwBDysih0nxM2hkz7VGJw6NtcWGtq3
3xDLyZIa754uaflXCKREN8KqLn1BCJXWAWNhROKh5MV2gP2+eDSoa0FRHKFTJQFW
+4A3OtmldzVMZOuG4s73LiQDPoQT0WK9QmUeIfh3RC/MGuOUT1oftz9oyt2Ds298
MdoZzc6vvcLRd4EOIecsAguKyNZOsyN7PEK6F2bFHVy64uoPRkMus4xoYmm/6eBs
[[...several long lines of totally meaningless random text...]]
ZIj6rHgxh4EOExWYuqb7D/0jOSPjpc/UsDHLE3DASsJ+ehsZnrsNw3fvNcmYcCtS
1FfoeSXVsahkkaTfWD4/hUlO8+L9688M29hHfGqn7HdhROPtAoN/FbCXDNB09WQI
fWDis7b3gQgPyiF/ckS65w25T2HVEBsErhHUnUQ+0YG0wnU5HVF9aNEi8aCWgYKd
8Cq11L2jJzNFTm5dZZkIjmaxIFX/JckCPoXSvJLuKDj/g0tRxKkVsj/VKX7QBcZc
i1rNvtBlS/a/QmjKkyZPbscCmD1YlOI5zwXh9Id4V0ku7r18yJqNCxmtp33qwymu
r+hFAW4pqbir
=B2FO
-----END PGP PUBLIC KEY BLOCK-----

Exporting Private Key

Private keys are exported for safekeeping. You should store this securely on an encrypted thumb-drive or have a paper backup and store it in a vault.

XKCD #1553
XKCD #1553
$ gpg --export-secret-keys -a A6D4E3CF
------BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1

lQO+BFWTjfwBCADRKjyRrGzuuDy8Bu3K41mwBDysih0nxM2hkz7VGJw6NtcWGtq3
3xDLyZIa754uaflXCKREN8KqLn1BCJXWAWNhROKh5MV2gP2+eDSoa0FRHKFTJQFW
+4A3OtmldzVMZOuG4s73LiQDPoQT0WK9QmUeIfh3RC/MGuOUT1oftz9oyt2Ds298
MdoZzc6vvcLRd4EOIecsAguKyNZOsyN7PEK6F2bFHVy64uoPRkMus4xoYmm/6eBs
[[..several lines of text snipped just to be polite to you..]]
AAkFAlWTjfwCGwwACgkQb2E2mqbU489oZgf+KN2uT+cA22SI+qx4MYeBDhMVmLqm
+w/9Izkj46XP1LAxyxNwwErCfnobGZ67DcN37zXJmHArUtRX6Hkl1bGoZJGk31g+
P4VJTvPi/evPDNvYR3xqp+x3YUTj7QKDfxWwlwzQdPVkCH1g4rO294EID8ohf3JE
uucNuU9h1RAbBK4R1J1EPtGBtMJ1OR1RfWjRIvGgloGCnfAqtdS9oyczRU5uXWWZ
CI5msSBV/yXJAj6F0ryS7ig4/4NLUcSpFbI/1Sl+0AXGXItazb7QZUv2v0JoypMm
T27HApg9WJTiOc8F4fSHeFdJLu69fMiajQsZrad96sMprq/oRQFuKam4qw==
=Yp1a
-----END PGP PRIVATE KEY BLOCK-----

Export the keys to a file like so:
$ gpg --export -a A6D4E3CF > pub.key
$ gpg --export-secret-keys -a A6D4E3CF > priv.key

Make sure to protect your private key file by storing it in an encrypted thumb drive. Then securely delete the private key file using srm command.

$ srm priv.key

Importing keys

$ gpg --import <keyfile name>

This will import public / private keys into your keyring

Note: If you export keys without specifying a Key ID, and if you have multiple keys in your keyring, then all your public / private keys will be exported at the same time.

Encrypting

Type your message in a file mymessage.txt

Then do the following command to encrypt it


$ gpg -e mymessage.txt
You did not specify a user ID. (you may use "-r")
Current recipients:

Enter the user ID. End with an empty line: Tony Stark
Current recipients:
4096R/130B30DD 2011-01-03 "Tony Stark tony@starkenterprises.com"

Enter the user ID. End with an empty line:

You will now end up with a file called mymessage.txt.gpg. Mail it to Tony Stark!

Decrypting Mails

Assuming you have an encrypted file called messagefromstark.txt.gpg, do the following:

$ gpg -d messagefromstark.txt.gpg
You need a passphrase to unlock the secret key for
user: "Clark Kent (Mail for my human identity) <sman@krypton.net>"
2048-bit RSA key, ID 780EC813, created 2015-07-01 (main key ID A6D4E3CF)

gpg: encrypted with 2048-bit RSA key, ID 780EC813, created 2015-07-01
      "Clark Kent (Mail for my human identity) <sman@krypton.net>"
Yes, man! I agree!

Note: You need to have imported Tony Stark’s GPG public keys into your GPG keyring for encrypting mails to Tony Stark. When you do gpg –list-keys, Tony’s keys should be shown.

Additional stuff

Security is complicated. I wish it wasn’t. There are some legitimate work being undertaken by people who genuinely want to uncomplicate security and encryption and make it available to everyone regardless of their technical abilities. That said, read through the content in this link and educate yourself on some good practices regarding GnuPG configuration files: https://help.riseup.net/en/security/message-security/openpgp/best-practices

EFF’s Guide to GPG on Linux ||ย  EFF’s Guide to GPG on Windows || Cryptoparties?

XKCD #538
XKCD #538

Note: Leave questions and feedback in the comments section. If you want to organize cryptoparties (awesome workshops where you can learn security stuff),ย  get in touch with us.

Advertisements

6 thoughts on “Electronic Mail Encryption

  1. Nice tutorial. For people that aren’t experienced with computers, Mailvelope is a good option. And for instant messaging, there are a lot of easy-to-use apps (that are secure), e.g., Threema.

    1. True. Mailvelope is a nice tool. I’ll add a note to the original post about it as well. As for mobile applications, I’m planning a separate post on that. Thank you!

    2. Actually one big problem with Mailvelope is it can’t encrypt attachments. Takes me back to the age old PGP/MIME vs Inline PGP debate. I personally prefer mime to Inline. Or simply, I just attach the encrypted messages and attachments and then send it. Still exposes a lot of metadata which is a bummer.

      1. Right, Mailvelope doesn’t encrypt attachments (for me, that’s not much of a downside since I rarely send files via e-mail these days).

        I don’t like the idea of meta data being unencrypted (which is one of the reasons why I don’t use WhatsApp), but it’s still better than no encryption at all, I guess.

        Looking forward to your post on mobile messengers!

      2. Everyone has their preferences ๐Ÿ˜‰ If you don’t mind Mailvelope, you should check out end-to-end extension to Chrome https://github.com/google/end-to-end.

        As for meta-data, you could use an anonymous remailer to keep your identity safe. Use burner accounts like Guerrillamail via TOR. This should give some level of anonymity. You could also try a different email provider like protonmail.ch or startmail.com. But most importantly, you should follow good OPSEC and PERSEC rules. For example, do not include a subject line that reveals the contents of the mail; things like that would keep your real IP address, name, and identity from prying eyes. Understanding what your browser sends to the server is also very useful (timezone info, date, user-agent, etc.) in securing your communications.

        Stay tuned. Thank you for reading! ๐Ÿ™‚

      3. Thanks for the tips! I try to use TOR whenever I can (it’s just too slow to use all the time), and I already have a ProtonMail account (like Threema, they’re based in Switzerland (which, due to prevailing privacy laws, adds another layer of security)).

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s