Email Self-Defense - a guide to fighting surveillance with GnuPG encryption

Step 2.a Make a keypair

Make your keypair

Open a terminal using ctrl + alt + t (on GNU/linux), or find it in your applications, and use the following code to create your keypair:

The Enigmail Setup wizard may start automatically. If it doesn't, select -Enigmail → Setup Wizard from your email program's menu. You don't need -to read the text in the window that pops up unless you'd like to, but it's -good to read the text on the later screens of the wizard. Click Next with -the default options selected, except in these instances, which are listed -in the order they appear:

- -

On the screen titled "Encryption," select "Encrypt all of my messages -by default, because privacy is critical to me."
On the screen titled "Signing," select "Don't sign my messages by -default."

We will use the command line in a terminal to create a keypair using the GnuPG program. A terminal should be installed on your GNU/Linux operating system, if you are using a macOS or Windows OS system, use the programs "Terminal" (macOS) or "PowerShell" (Windows) that were also used in section 1.

On the screen titled "Key Selection," select "I want to create a new -key pair for signing and encrypting my email."

# gpg --full-generate-key to start the process.

# To answer what kind of key you would like to create, select the default option 1 RSA and RSA.

# Enter the following keysize: 4096 for a strong key.

# Choose the expiration date, we suggest 2y (2 years).

Follow the prompts to continue setting up with your personal details.

On the screen titled "Create Key," pick a strong password! You can +
+
Set your passphrase
+
On the screen titled "Passphrase," pick a strong password! You can do it manually, or you can use the Diceware method. Doing it manually is faster but not as secure. Using Diceware takes longer and requires dice, but creates a password that is much harder for attackers to figure out. To use it, read the section "Make a secure passphrase with Diceware" in -this article by Micah Lee.

+this article by Micah Lee.

+ -

If you'd like to pick a password manually, come up with something +

If you'd like to pick a passphrase manually, come up with something you can remember which is at least twelve characters long, and includes at least one lower case and upper case letter and at least one number or punctuation symbol. Never pick a password you've used elsewhere. Don't use any recognizable patterns, such as birthdays, telephone numbers, pets' names, song lyrics, quotes from books, and so on.

The program will take a little while to finish the next -step, the "Key Creation" screen. While you wait, do something else with your -computer, like watching a movie or browsing the Web. The more you use the -computer at this point, the faster the key creation will go.

- -

When the "Key Generation Completed" screen -pops up, select Generate Certificate and choose to save it in a safe place on -your computer (we recommend making a folder called "Revocation Certificate" -in your home folder and keeping it there). This step is essential for your -email self-defense, as you'll learn more about in Section -5.

Troubleshooting

I can't find the Enigmail menu.: In many new email programs, the main menu is represented by an image -of three stacked horizontal bars. Enigmail may be inside a section called -Tools.
GnuPG is not installed: +GPG is not installed. You can check if this is the case with the command gpg --version. +If GnuPG is not installed, it would bring up the following result on most GNU/Linux operating systems, or something like it: +Command 'gpg' not found, but can be installed with: + sudo apt install gnupg. Follow that command and install the program.
I took too long to create my passphrase: That's okay. It's important to think about your passphrase. When you're ready, just follow the steps from the beginning again to create your key.
The wizard says that it cannot find GnuPG.: Open whatever program you usually use for installing software, and search -for GnuPG, then install it. Then restart the Enigmail setup wizard by going -to Enigmail → Setup Wizard.
How can I see my key?: +Use the following command to see all keys gpg --list-keys. Yours should be listed in there, and later, so will Edward's (section 3). If you want to see only your key, you can use gpg --list-key [your@email]. +You can also use gpg --list-secret-key to see your own private key.
More resources: If you're having trouble with our -instructions or just want to learn more, check out -Enigmail's wiki instructions for key generation.; For more information about this process, you can also refer to The GNU Privacy +Handbook. Make sure you stick with "RSA and RSA" (the default), +because it's newer and more secure than the algorithms the documentation +recommends. Also make sure your key is at least 4096 bits if you +want to be secure.
Don't see a solution to your problem?: Please let us know on the .

@@ -825,22 +801,45 @@ provide good guides for setting up a secure subkey configuration.

- -

Step 2.b Upload your public key to a keyserver

+ +

Right click on your key and select Upload Public Keys to Keyserver. You -don't have to use the default keyserver. If, after research, you would like -to change to a different default keyserver, you can change that setting -manually in the Enigmail preferences.

Step 2.b Some important steps following creation

Now someone who wants to send you an encrypted message can -download your public key from the Internet. There are multiple keyservers +

Upload your key to a keyserver

We will upload your key to a keyserver, so if someone wants to send you an encrypted message, they can download your public key from the Internet. There are multiple keyservers that you can select from the menu when you upload, but they are all copies of each other, so it doesn't matter which one you use. However, it sometimes takes a few hours for them to match each other when a new key is uploaded.

# Copy your keyID gnupg --list-key [your@email] will list your public ("pub") key information, including your keyID, which is a unique list of numbers and letters. Copy this keyID, so you can use it in the following command.

# Upload your key to a server: gpg --send-key [keyID]

+ +
+ +

Export your key to a file

Use the following command to export your secret key so you can import it into your email client at the next step. To avoid getting your key compromised, store this in a safe place, and make sure that if it is transferred, it is done so in a trusted way. Exporting your keys can be done with the following commands:

+ + +

$ gpg --export-secret-keys -a keyid > my_secret_key.asc

$ gpg --export -a keyid > my_public_key.asc

+ + +
+ +

Generate a revocation certificate

Just in case you lose your key, or it gets compromised, you want to generate a certificate and choose to save it in a safe place on your computer for now (please refer to step 6.C for how to best store your revocation cerficate safely). This step is essential for your email self-defense, as you'll learn more about in Section 5.

+ +

# Upload your key to a server: gpg --output revoke.asc [keyID]

# It will prompt you to give a reason for revocation, we recommend to use 1 "key has been compromised"

# You don't have to fill in a reason, but you can, then press enter for an empty line, and comfirm your selection.

+ +

@@ -848,20 +847,16 @@ takes a few hours for them to match each other when a new key is uploaded.

Troubleshooting

The progress bar never finishes: Close the upload popup, make sure you are connected to the Internet, -and try again. If that doesn't work, try again, selecting a different -keyserver.
My key doesn't appear in the list: Try checking "Display All Keys by Default."
My key doesn't seem to be working or I get a "permission denied.": Like every other file or folder, gpg keys are subject to permissions. If these are not set correctly, your system may not be accepting your keys. You can follow the next steps to check, and update to the right permissions.
-
More documentation: If you're having trouble with our -instructions or just want to learn more, check out -Enigmail's documentation.
Don't see a solution to your problem?: Please let us know on the feedback @@ -876,44 +871,114 @@ page.

Step 3.c Receive a response

Step 4.c Receive a response

MacOS

Troubleshooting

Windows

#2 Make your keys

Step 2.a Make a keypair

Make your keypair

Set your passphrase

Troubleshooting

Advanced

Step 2.b Upload your public key to a keyserver

Step 2.b Some important steps following creation

Upload your key to a keyserver

Export your key to a file

Generate a revocation certificate

Troubleshooting

Advanced

#3 Set up email encryption

GnuPG, OpenPGP, what?

Step 3.a Set up your email with encryption

Troubleshooting

Step 3.a Send Edward your public key

Step 4.a Send Edward your public key

Step 3.b Send a test encrypted email

Step 4.b Send a test encrypted email

Get Edward's key

Send Edward an encrypted email

Troubleshooting

Step 3.d Send a test signed email

Step 4.d Send a signed test email

Step 4.a Sign a key

Step 5.a Sign a key

#5 Use it well

#6 Use it well

Copy your revocation certificate to somewhere safe

Important: act swiftly if someone gets your private key

IMPORTANT: ACT SWIFTLY if someone gets your private key

All aboard for software freedom!

Move freedom forward with a donation to the FSF!

Set your passphrase

Troubleshooting

Advanced

Step 2.b Upload your public key to a keyserver

Step 2.b Some important steps following creation

Upload your key to a keyserver

Export your key to a file

Generate a revocation certificate

Troubleshooting

Advanced

#4 Learn the Web of Trust

#5 Learn about the Web of Trust

Step 4.a Sign a key

Step 5.a Sign a key

#5 Use it well

#6 Use it well

Copy your revocation certificate to somewhere safe

Important: act swiftly if someone gets your private key

IMPORTANT: ACT SWIFTLY if someone gets your private key