Re: PGP encrypted email - basic questions

[Aaron Howell <aaron_howell () ngenuity-is com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dave Moore wrote:
> I'm trying to get started with PGP and there are some concepts I am
> having trouble with.

<fanboy> Hooray for PGP, everyone should use it! </fanboy>

> I understand that a recipient of a PGP signed/encrypted message will
> have to get my public key to decrypt said message. What I don't
> understand is how this is carried out in a seemingly automatic fashion
> for many of the email messages I receive, e.g. postings from mailing
> lists, in which I see the 'BEGIN PGP SIGNED.. ' and the signature at
> the end. I didn't decrypt these messages, and I have no idea how they
> got decrypted.

You're intermingling two separate things here... As you can see at the
bottom of this message, it is signed with my PGP key, however, it is NOT
encrypted. Encryption is a method of altering something (an email, for
example) using a secret code so as to be unintelligible to unauthorized
parties. Signing is a method of verifying that the message is from who
it claims to be from. This will be made more clear in a moment...

> When I encrypt a message and send it to myself, the message I see is
> decidedly not decrypted. I did notice this header..
>
> OpenPGP: id=5847D5CF;
> url=http://random.sks.keyserver.penguin.de:11371/pks/lookup?op=get&search=0x5847D5CF
>
>
> in the outgoing encrypted test message I sent, which leads me to
> suspect that it might have something to do with this process, but
> still, my message is not decrypted.

PGP is an example of Public Key cryptography [1], which is also called
asymmetric-key cryptography. Rather than using a single key for both
encryption and decryption, we have a pair of keys. One key is called the
Private key, and the other is the Public key. As can be inferred from
the names of the keys, the Private key is to be kept secret, the Public
key is to be published to the world. An example:

Bob and Joe need a method of sending email securely, but they do not
have the ability to set up a cypher in advance. Joe suggests they use
this program he has heard of called PGP, and Bob agrees. Each of them
downloads their own copy, and proceeds to create a key pair. Bob then
exports his Public key, and sends it to Joe. Joe imports Bob's key into
his Keyring (a file containing all the public keys for the people you
exchange encrypted email/files with), and then sends Bob his own Public
key. Now each has the other's Public key, and their own Private key. Bob
creates an email, and encrypts it with Joe's Public key. When Joe
receives the email, he decrypts it by providing the passphrase for his
Private key. The message is decrypted, and Joe is able to read the email.

When you sign a message, things work differently. There is no
encryption/decryption inherent in a signed message. When I send a
message signed with my Private key, anyone with my Public key can verify
that that message came from me (or someone who had compromised my
Private key, but that is a discussion for a different bottle of
Scotch...) Even though I have never explicitly given you my Public key,
you can download it from a keyserver, such as subkeys.pgp.net. A
keyserver is a public repository of Public keys. It is important to
point out that without trust, digitally signed messages mean little, if
anything, as I can just as easily create a PGP key with you name
attached to it as my own. They key here (pun definitely intended) is
that someone you know should sign your key with their own. The more
people who sign your key, the more likely it is someone I know will have
signed it. If someone I know has signed it, I am more likely to trust
that you are who you say you are. This is why there are "Key-signing
parties" at many security cons and suchlike. Lacking a central signing
authority, the web of trust is an integral part of the digital signature.

After re-reading this, I decided it wasn't really clear enough, so check
out the wikipedia footnote below, it explains things much more
succinctly than I am able.

> How does this work?

Very well, when it's done properly.  =) If you want someone to exchange
keys with and send some encrypted mail back and forth to get the feel
for it, contact me off-list and I'd be happy to help.

Aaron


[1] http://en.wikipedia.org/wiki/Public-key_cryptography
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFlfSs7MF9x9aUuGIRAk2yAKCCZTQLykOTh5B5i2b9VlhYGy0nuACgrFiZ
lGHHIKistUErYt6MJq+XUbU=
=zjBn
-----END PGP SIGNATURE-----