Your public key isn't like a physical key, because it's stored in the open in an online directory called a keyserver. People download it and use it, along with GnuPG, to encrypt emails they send to you. You can think of the keyserver as phonebook, where people who want to send you an encrypted email look up your public key.
-
Your private key is more like a physical key, because you keep it to yourself (on your computer). You use GnuPG and your private key to descramble encrypted emails other people send to you.
+
Your private key is more like a physical key, because you keep it to yourself (on your computer). You use GnuPG and your private key to descramble encrypted emails other people send to you. In addition to encryption and decryption, you can also use these keys to sign messages and check the authenticity of other people's signatures. This process helps stop impersonators. We'll discuss this more on the next section.
@@ -229,8 +228,8 @@
To use the diceware method, you will need dice (preferably 5, but 1 will do) and this list of words. Do not substitute computer dice for physical dice. Notice that each word on the word list corresponds to a unique five-digit number. Role one dice five times, or five dice once to select the first word. Don't rearrange or discard words, because doing so makes the process much less secure. Repeat this process until you have at least six words, and there's your password.
-
Command-line key generation
-
If you prefer using the command line for a higher degree of control, you can follow the documentation from the GnuPG Mini Howto or The GNU Privacy Handbook. Make sure you stick with "RSA and RSA" (the default), because it's newer and more secure than algorithms recommended in the old previously mentioned documentation.
+
Command line key generation
+
If you prefer using the command line for a higher degree of control, you can follow the documentation from the GnuPG Mini Howto or The GNU Privacy Handbook. Make sure you stick with "RSA and RSA" (the default), because it's newer and more secure than the algorithms recommended in the old previously mentioned documentation.
Advanced key pairs
When GnuPG creates a new keypair, it compartmentalizes the encryption function from the signing function through subkeys. If you use subkeys carefully, you can keep your GnuPG identity much more secure and recover from a compromised key much more quickly. Alex Cabal and the Debian wiki provide good guides for setting up a secure subkey configuration.
@@ -269,8 +268,8 @@
Advanced
-
Uploading a key from the command-line
-
You can also upload your keys to a keyserver through the command-line. this webpage maintains a good list highly interconnected keyservers. You can also directly export your key as a file on your computer.
+
Uploading a key from the command line
+
You can also upload your keys to a keyserver through the command line. This webpage maintains a list highly interconnected keyservers. You can also directly export your key as a file on your computer.
@@ -297,7 +296,7 @@
#3 Try it out!
Now you'll try a test correspondence with a computer program named Edward, which knows how to use encryption. Except where noted, these are the same steps you'd follow when corresponding with a real, live person.
-
NOTE: Edward is currently having some technical difficulties, so he may take a long time to respond, or not respond at all. We're sorry about this and we're working hard to fix it. Your key will still work even without testing with Edward.
You can also encrypt and decrypt messages and files form the command line, if that's your preference. The option --armor makes the encrypted output appear in the regular character set.
Email encryption is a powerful technology, but it has a weakness; it requires a way to verify that a person's public key is actually theirs. Otherwise, there would be no way to stop an attacker from making an email address with your friend's name, creating keys to go with it and impersonating your friend. That's why the free software programmers that developed email encryption created keysigning and the Web of Trust.
-
When you sign someone's key, you are publicly saying that you trust that it does belong to them and not an impostor. People who use your public key can see the number of signatures it has. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is the constellation of all GnuPG users, connected to each other by chains of trust expressed through signatures, forming a giant network. The more signatures a key has, and the more signatures its signers' keys have, the more trustworthy that key is.
-
-
People's public keys are usually identified by their key fingerprint, which is a string of digits like F357AA1A5B1FA42CFD9FE52A9FF2194CC09A61E8 (for Edward's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to Enigmail → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint wherever you share your email address, so that people can double-check that they have the correct public key when they download yours from a keyserver.
+
When you sign someone's key, you are publicly saying that you trust that it belongs to them and not an impostor. Signing keys and messages is the same type mathematical operation, but they carry very different implications. It's a good practice to generally sign your email, but if you casually sign people's keys, you may accidently end up vouching for the identity of an imposter. People who use your public key can see who has signed it. Once you've used GnuPG for a long time, you may have hundreds of signatures. The Web of Trust is a constellation of GnuPG users, connected to each other by chains of trust expressed through signatures. The more signatures of people you trust a key has, the more trustworthy that key is.
-
You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like C09A61E8 for Edward. The key ID is visible directly from the Key Management window. This key ID is like a person's first name (it is a useful shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion. If you only have the key ID, you can still look up the key (as well as its fingerprint), like you did in Step 3, but if multiple options appear, you'll need the fingerprint of the person to whom are trying to communicate to verify which one to use.
@@ -420,7 +430,7 @@
To:
-
+ End #pgp-pathfinder -->
@@ -428,11 +438,31 @@
-
Important: check people's identification before signing their keys
-
Before signing a real person's key, always make sure it actually belongs to them, and that they are who they say they are. Ask them to show you their ID (unless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".
+
Identifying keys: Fingerprints and IDs
+
People's public keys are usually identified by their key fingerprint, which is a string of digits like F357AA1A5B1FA42CFD9FE52A9FF2194CC09A61E8 (for Edward's key). You can see the fingerprint for your public key, and other public keys saved on your computer, by going to Enigmail → Key Management in your email program's menu, then right clicking on the key and choosing Key Properties. It's good practice to share your fingerprint wherever you share your email address, so that people can double-check that they have the correct public key when they download yours from a keyserver.
+
+
You may also see public keys referred to by their key ID, which is simply the last 8 digits of the fingerprint, like C09A61E8 for Edward. The key ID is visible directly from the Key Management window. This key ID is like a person's first name (it is a useful shorthand but may not be unique to a given key), whereas the fingerprint actually identifies the key uniquely without the possibility of confusion. If you only have the key ID, you can still look up the key (as well as its fingerprint), like you did in Step 3, but if multiple options appear, you'll need the fingerprint of the person to whom you are trying to communicate to verify which one to use.
+
+
+
+
+
Important: check people's identification before signing their keys
+
Before signing a real person's key, always make sure it actually belongs to them, and that they are who they say they are. Ask them to show you their ID (unless you trust them very highly) and their public key fingerprint -- not just the shorter public key ID, which could refer to another key as well. In Enigmail, answer honestly in the window that pops up and asks "How carefully have you verified that the key you are about to sign actually belongs to the person(s) named above?".
+
+
+
+
Advanced
+
+
Master the Web of Trust
+
Unfortunately, trust does not spread between users the way many people think. One of best ways to strengthen the GnuPG community is to properly understand the web of trust and to carefully sign as many people's keys as circumstances permit.
+
+
+
+
+
@@ -492,6 +522,25 @@
+
+
+
+
Webmail and GnuPG
+
When you use a web browser to access your email, you're using webmail, an email program stored on a distant website. Unlike webmail, your desktop email program runs on your own computer. Although webmail can't decrypt encrypted email, it will still display it in its encrypted form. If you primarily use webmail, you'll know to open your email client when you receive a scrambled email.
+
+
+
+
+
+
+
Optional: Protect Your Privacy with Tor
+
The Onion Router (Tor) network wraps Internet communication in multiple layers of encryption and bounces it around the world several times. When used properly, Tor confuses surveillance field agents and the global surveillance apparatus alike. To have your email program send and receive email over Tor, install the Torbirdy plugin the same way you installed Enigmail, by searching for it through Add-ons.