As I wrote last night, PGP is something that if you value your data you should always have and be knowledgeable off. PGP stand for Pretty Good Privacy and we want to know how it works. Previously we decided to have 2 keys once for each email, so our application will have something like this.
As both of our keys belong to the same user we will obviate some steps, like the public key exchange. However a public key as we mentioned before is the file you need to have before receiving an encrypted message. To get that public key, we can select the key from the keychain and click on the Export Certificate button from the menu. This sill generate a file with the extension .asc
This file is just a text file which once open you will see a code block starting with the title, BEGIN PGP PUBLIC KEY BLOCK. Followed by a block of alphanumeric text that can go for several lines. Depending on the level of encryption I have a 40 lines long key. The end of the key it will also have a title, END PGP PUBLIC KEY BLOCK.
So we can now proceed to use our key, we can use it to sign or to encrypt a message. A signature will hold the message withing a block of text similar to the key but smaller. Here is an exampled of a signed message.
The receiver will read the message, but would also be able to verify the authenticity of the signature with our public key. The keychain will have a Verify/Decrypt button which can analyze and report a signature as valid or invalid. The validity depends on the integrity of the message, if a line has been added or a character has been changed, it would break the validation of the key.
For encryption is the same process except you will choose to encrypt and the encrypted message won't be shown in text, but will only show the block of text. The title of the block will be, BEGIN PGP MESSAGE and at the end, END PGP MESSAGE. Only the public key holder that holds the recipient email can decrypt the message.
An important distinction when encrypting is that usually you select an encryption for 'others'. These others would be the public keys available on your keychain. So [email protected] explicitly encrypt ONLY to [email protected] nobody else would be able to decrypt it.
As you can see, the exchange of public keys are quite important, and to make this even easier to do, the internet helped by having a public records of public keys that you can volunteer and act like a yellow page. You can search for an email and if you are lucky, you can import the public key straight into your keychain. These pages are called keyservers. Depending on the proliferation of secure messaging we would be able to have a more secure communication between each other. And even if email is a bit old school, PGP has evolved on certain platforms to still be relevant in order to secure our communication.
Hope this mini tutorial served you well and if you are interested, leave your public key as a comment and Happy hacking!!!