My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Sat, 16 Jan 2010

/Security/e-mail: Setting Up PGP E-mail Encryption

Finally someone has agreed to help me play with PGP e-mail encryption!! So here are my notes:

In my claws-mail e-mail client, I had to install a plugin (a separate package in Debian) called claws-mail-pgpmime. After restarting, there appeared a "GPG" tab in my per-account e-mail preferences, where I clicked on the "Generate a new key pair" button. (claws-mail apparently does all the necessary pgp stuff under the hood, including adding the new keys to my private key ring....) In the same tab, I also selected the "select key by your e-mail address", which seemed logical. And then in the "Privacy" tab do not forget to select when you want your key sent, and under what circumstances e-mail is supposed to be encrypted. (And I was delighted to see a "Save sent encrypted messages as plain text option", since I have an encrypted home directory anyway.)

(Note that this FAQ[1] warns that some spammers harvest e-mail address off of the public key servers, so if you intend to publish your key to such a server, choose an e-mail address with good spam filtering....)

Now for the fun command line stuff....

PGP can only work if both ends of the communication have one another's public keys, and from what I can tell, the standard way to do that is via the world-wide network of public key servers. For instance, after adding:

keyserver keyserver.ubuntu.com

to ~/.gnupg/options, if I open an e-mail signed with a pgp-signature attachment, I can then click on the key icon to the right of my claws-mail message pane and see the prompt:

"This key is not in your keyring. Do you want Claws Mail to try and import it from a keyserver?

Of course(!?) this does not work in China because all the keyservers seem to be blocked, so I have to do it through a proxy server as follows:

proxychains gpg --no-tty --recv-keys A1295TE1D75F5533

And now claws-mail can verify the signature as "correct". And now

gpg --list-keys

will show all the keys on my private key ring, including the one I just imported. That is how I get my friend's public key.

Per this fine howto[2], I can broadcast my own key to the world thusly:

gpg --send-keys --keyserver keyserver.ubuntu.com 6D79E522

where the code at the end of the line is obtainable from the "gpg --list-keys" listing.

Note that it is also possible to share public keys by exporting them to a file as follows:

gpg --export -a 6D79E522 > mykey.asc

and e-mailing the file. Once both ends are supplied with the other's public key, encryption should be trivial.

[1] http://pgp.mit.edu/faq.html
[2] https://help.ubuntu.com/community/GnuPrivacyGuardHowto

posted at: 13:29 | path: /Security/e-mail | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Sat, 16 Jan 2010