What is PGP encryption and how to implement it

Although a considerable amount of internet communication today takes place over social networks and instant messenger, e-mail is still going strong. E-mails are usually favored over chat systems when confidential information is involved such as contract details, bank details, etc. In many companies exchanging messages by e-mail is just a normal part of everyday business. Naturally, businesses want to protect this sensitive information and prevent others from reading the contents of their dispatched e-mails. If an e-mail is sent in plain text, criminals can get hold of sensitive user data, as can  prying eyes, on the hunt for any useful information they can find and use. To ensure that no unauthorized people can read the contents of your messages, you should ensure that you encrypt your e-mails at all costs.

PGP encryption offers an excellent means of protecting information and encrypting the content of your e-mails. PGP (pretty good privacy) was originally developed in 1991 by Phil Zimmermann as a software for encrypting e-mails. Over the years, PGP has come to be generally accepted as the name of this method of encryption.

PGP encryption is based on a public key protocol, where a assigned pair of keys (comprising of a public and a private key) is used. The public key is available to potential e-mail contacts since it is directly transferred or uploaded on an external key server. This key enables your contacts to encrypt all the e-mails that they send to you. The private key can only be accessed by you and is normally password-protected. It allows you to decrypt the received e-mails that have been encrypted with a public key. The person you’re communicating with should also be using PGP and give you access to their public key so that you can communicate securely. The public key protocol is described as an asymmetrical procedure since the two parties involved use different keys. Using signatures guarantees the authenticity of your messages even more.

Securing your e-mails with PGP might seem like a lot of effort at first glance, but you just need to find free or inexpensive PGP software and install it. During the installation process, a pair of keys will be automatically generated, but the rest is the user’s responsibility. The private key is archived on its own server whereas the public key is uploaded on an external server (e.g. on a web server) or e-mailed directly to contacts. This is still not enough since the contacts involved must also access the PGP encryption and send you their public key. Verifying the trustworthiness of the received keys and managing your own key is your responsibility so play it safe and encrypt your e-mails with PGP.

The steps needed for the set-up sometimes deter less-experienced users from this type of e-mail encryption. In the last few years, new plugins like OutlookPrivacyPlugin and Mailvelope have been developed in order to make secure e-mails available to a wider audience. You can implement them into current e-mail clients and browsers, which then support the user during the configuration process. Many established e-mail providers value encryption highly and link their service with PGP plugins and self-explanatory set up assistants. These plugins make it easier than ever to set up PGP encryption for your e-mail account. Another service offered at present is storing a public key in the provider’s database.

Then select the type of encryption. You should only change it from the default setting ('RSA and RSA') if you have the necessary background knowledge. Then enter the key length in bits: the higher the value, the more secure the keys, but also the slower the performance. Security experts recommend a length of 4096 bits for RSA keys. This is followed by a request for the validity period of the keys, and finally the name and e-mail address for which the key pair should apply. Finally, you need to confirm that all this information is correct and define the passphrase for your private key. You will need this later in order to encrypt or decrypt your electronic messages.

On Windows and mac OS X, you start the code generation through graphic programs. Regardless of PGP software and platform, you are often prompted to generate the key through random keyboard entries or mouse movements.

for the private key as well as

for a list of all generated public keys. Of course, you can not only see the listed keys here, but also directly export them. By doing this, you create an .asc file, which is then sent directly to the desired contacts via e-mail (as an attachment), uploaded to a certificate server, or transferred via USB stick. If the contact has received your public key and also has a key management program, they can send you encrypted messages from now on, which can be decrypted with the associated private key, including passphrase. If you also want to send encrypted e-mails to this contact as well, you need their public key.

Many users believe that the e-mails they are sending are already encrypted because of the SSL/TLS certificates, but that’s not entirely true. The SSL/TLS certificates mean that only the transmission path of the e-mail is encrypted. The disadvantage is that they can be intercepted by third parties, who can then read them in plain text. On the other hand, SSL/TLS certificates enable the encryption of elements that remain unencrypted through PGP. These elements can include information about the sender, recipient, and the subject. A combination of PGP encryption and SSL/TLS encryptions is thus the optimal solution to protect the content of your e-mails. Further information about encrypted transmission can be found in the article about SSL and TLS encryption.