How to use PGP en­cryp­tion for email

PGP en­cryp­tion is a method for the secure en­cryp­tion and digital signing of emails and files, based on the principle of asym­met­ric cryp­to­graphy. For busi­nesses that primarily com­mu­nic­ate via email, such a method is par­tic­u­larly important to ensure no un­au­thor­ised persons can read the emails. We show you how to encrypt your emails with PGP.

What is PGP en­cryp­tion and how does it work?

PGP en­cryp­tion offers an excellent means of pro­tect­ing in­form­a­tion and en­crypt­ing your emails. PGP (pretty good privacy) was ori­gin­ally developed in 1991 by Phil Zi­m­mer­mann as a software program for en­crypt­ing emails. Over the years, PGP has es­tab­lished itself as the name for this en­cryp­tion method.

PGP en­cryp­tion is based on a public key protocol. This is a variant of asym­met­ric en­cryp­tion. A key pair (a public and a private key) is used to encrypt and decrypt messages. The public key is available to potential email contacts and is directly trans­ferred or uploaded on an external key server. This key enables your contacts to encrypt the emails that they send to you. The private key is ex­clus­ively in your pos­ses­sion and can decrypt received emails that were pre­vi­ously encoded with the public PGP key. For you to com­mu­nic­ate securely in this way, your com­mu­nic­a­tion partner must also use PGP and share their public key with you.

In the past, setting up PGP en­cryp­tion was quite complex. The necessary steps often deterred less tech-savvy users from using this type of email en­cryp­tion. However, in recent years, plugins have been developed to make PGP en­cryp­tion ac­cess­ible to a broader audience. Two such plugins are FlowCrypt and Mail­velope. Many es­tab­lished email providers have now developed their own PGP plugins and setup wizards, in­teg­rat­ing them into their own email services.

What can PGP en­cryp­tion be used for?

Asym­met­ric en­cryp­tion methods like PGP are nothing new in the world of IT and are therefore already used in many different areas. Below are the areas where PGP is most fre­quently used.

1. En­crypt­ing con­fid­en­tial messages: En­crypt­ing emails and other types of messages is one of the main ways that PGP is used.
2. En­crypt­ing files and file systems: In addition to en­crypt­ing messages, PGP can also be used to encrypt files that are stored on local storage devices or on a server.
3. Digital sig­na­tures: PGP is also often used to check the au­then­ti­city of a message or file. With a PGP signature, you can determine whether a message is really from the person who sent it. Ad­di­tion­ally, you can also see if it has been in­ter­cep­ted and possibly changed while being sent. PGP sig­na­tures can also be used to verify the au­then­ti­city of files (for example, programs).

How to set up PGP en­cryp­tion

Many email clients now come with a PGP en­cryp­tion package that includes setup in­struc­tions that are easy to follow. If, however, your email service provider hasn’t included in­struc­tions for setting up PGP, you can follow the steps below. The following PGP tutorial is a general approach to setting up PGP en­cryp­tion.

PGP en­cryp­tion with software

Step 1: Install the software

First and foremost is the search for suitable PGP software that must be com­pat­ible with both the operating system and the email program being used. Advocates of Linux make a good choice with the Open Source solution GnuPG (GNU Privacy Guard), which was released in 1997. The service is already pre-installed on many systems by default; you can download the latest version from the official website.

Users of Windows or OS X operating systems will also find binaries there, which they can use to install the system-specific Gpg4win and GPGTools, based on GnuPG.

Step 2: Generate a key pair

Once the PGP program is installed, a key pair can be created. For Linux, open the command line and use the key gen­er­a­tion command provided in the program’s manual. This example is for GnuPG:

sudo gpg --gen-key

Then choose the type of en­cryp­tion, and only deviate from the default setting (‘RSA and RSA’) if you have the necessary back­ground knowledge. Next, enter the key length in bits. The higher the value, the more secure the keys, but the slower they perform. For RSA keys, a length of at least 3,000 bits is generally re­com­men­ded for strong pro­tec­tion. Following this, specify the validity period of the keys and then provide your name and email address for which the key pair should be valid. Finally, define a secure password for your private key. You will need this later to encrypt or decrypt your elec­tron­ic messages.

Under Windows and Mac OS X, you start key gen­er­a­tion through graphical programs. Re­gard­less of PGP software and platform, you are often prompted to support key gen­er­a­tion with random keyboard inputs or mouse movements.

Step 3: Share the public key with your contacts

You can manage the generated keys under Linux either via the terminal or with Seahorse (for Gnome/Unity) or the graphical interface KGpg (for KDE). The command-line command for the private key using GnuPG is:

sudo gpg --list-secret-keys
sudo -K

and for the public key :

sudo gpg --list-keys
sudo -K

In addition to being able to see a list of the keys, you can also directly export them. The .asc file that is created can be sent as an at­tach­ment to your contacts via email or uploaded to a cer­ti­fic­ate server. If a contact has received your public key and has a key man­age­ment program, they can send you encrypted messages. To send encrypted emails to the same contact , you’ll need their public key.

Online PGP en­cryp­tion

Instead of using programs that you install on your own system, you can also use online PGP tools to create key pairs, encrypt your emails or decrypt emails you receive. Below we’ll take a look at the web service PGP Key Generator.

PGP Key Generator is a JavaS­cript program that enables key pair gen­er­a­tion and can be executed in most web browsers. You can use the open-source service free of charge and without needing to register.

First, enter the required spe­cific­a­tions for the keys in the Options form. Then click on Generate keys to start the key gen­er­a­tion process. When the process is complete, you will be able to view the public key and your private key.

Close

Since this web service is open source, experts can view the source code at any time. This means that they can con­tinu­ously evaluate how secure and reliable the generator is. However, being a JavaS­cript ap­plic­a­tion, there is also room for concern about cy­ber­crime. If criminals are able to identify security gaps in the web service, these gaps can be exploited to attack your system and obtain sensitive in­form­a­tion.

PGP en­cryp­tion for email clients

If you prefer to com­mu­nic­ate via webmail services like Gmail, Yahoo, or Outlook.com will find the Mail­velope browser extension to be just right. The add-on is based on OpenPGP.js and is available for Google Chrome, Microsoft Edge, and Mozilla Firefox. Once you have installed the extension, the Mail­velope icon appears in your browser’s toolbar, allowing you to access the user interface. Here you can create, import, and manage your keys, as well as the public keys of your contacts, or upload created public keys to a public key server.

Close

If you have Mail­velope installed and access your webmail inbox using the browser, the add-on scans it for PGP messages. This way, it can display specific elements for en­crypt­ing or de­crypt­ing an email. In the options, you can enable or disable PGP en­cryp­tion for Gmail, Outlook, and others.

PGP en­cryp­tion on mobile devices

To use PGP en­cryp­tion on iOS and Android devices, you need an email client that supports key man­age­ment software and PGP en­cryp­tion. We have selected a key man­age­ment app for both iOS and Android that allows you to store and manage the PGP keys of your contacts.

iOS – Easy PGP

Easy PGP is a user-friendly and secure iOS app that brings the power of PGP en­cryp­tion to your mobile device. With EasyPGP, you can create, import, and export PGP key pairs to protect your com­mu­nic­a­tion. The app performs all op­er­a­tions locally on your device, ensuring your data never leaves your phone and guar­an­tee­ing maximum privacy. The modern, intuitive user interface makes PGP en­cryp­tion ac­cess­ible to everyone. Key features include the easy creation of new PGP key pairs with cus­tom­is­able en­cryp­tion settings.

Close

Android – Open­Key­chain: Easy PGP

For Android users, the app ‘Open­Key­chain: Easy PGP’ is available, which is also open-source and based on the OpenPGP standard.

After in­stalling the app, you can view, import, and manage your private and public keys under ‘Keys’. Under ‘Encrypt/Decrypt’, you can encrypt or decrypt messages and files using these keys.

Close

Encrypted content vs. encrypted con­nec­tions

Many users believe they are already ex­chan­ging encrypted emails with their contacts via SSL or TLS cer­ti­fic­ates. However, that’s only half the truth. Because the use of SSL/TLS cer­ti­fic­ates only encrypts the trans­mis­sion path of elec­tron­ic messages between mail servers. The dis­ad­vant­age is that messages can be in­ter­cep­ted and read in plain text during upload to the server by third parties.

Ad­di­tion­ally, unlike PGP, SSL/TLS does not sign the email and therefore does not guarantee its au­then­ti­city. On the other hand, SSL/TLS cer­ti­fic­ates enable the en­cryp­tion of email com­pon­ents that remain un­en­cryp­ted with PGP, such as in­form­a­tion about the sender, recipient, or subject.

A com­bin­a­tion of PGP en­cryp­tion and SSL/TLS en­cryp­tion is therefore the optimal solution in practice to protect your email content. You can find more in­form­a­tion about encrypted trans­mis­sion in our article ‘En­crypt­ing email with SSL/TLS’.