An Unauthorised Guide to PGP Cryptography

An Unauthorised Guide to PGP Cryptography

Introduction

Pretty Good Privacy by PGP Corporation is the industry standard in public-key cryptography. Public-key cryptography uses a pair of keys: a public key, which encrypts data, and a corresponding private key, for decryption. You publish your public key to the world while keeping your private key secret. Anyone with a copy of your public key can then encrypt data that only you can read. Conversely you can send anyone an encrypted message with their public key which only they can read.

Which Version?

PGP Desktop 9 can only be used for a limited period before online registration is required. Some earlier versions of PGP are available at The International PGP Home Page. PGP Desktop 803 is available on peer to peer networks with a license that gives unlimited use. GNU Privacy Guard, or GPG is the premiere open source implementation of OpenPGP encryption. GnuPG for Windows can be downloaded free from gpg4win.

Installing PGP 8.0.3

When installing PGP 8.0.3 untick all the boxes in the Select Components dialog. Microsoft Outlook Express 6 will not allow integrated PGP use unless you also have a Digital Signature, which you have to pay for. This is not a problem as we will be sending PGP messages as text. Use the following information for PGP 8.0.3 License:

LicenseName: r0r_ROR
LicenseCompany: TEAM ROR 2003
LicenseNumber: CUZ66-HX0PL-1ACX6-D2ZG9-F2Y3J-VEA
LicenseAuthorization:
-----BEGIN PGP LICENSE AUTHORIZATION-----
ADIAAaYAAKDwnSiyT5rfXUss42GavMstVtJVGgCfRCvCM5TN0noKOXgd1Ssacej8W78=
-----END PGP LICENSE AUTHORIZATION-----

Installing GnuPG for Windows

When installing GnuPG for Windows tick WinPT and GPG in the Choose Components dialog (GPA is an alternative to the WinPT management tool). Sometimes the GPGee extensions don't work when right clicking and the computer has to be rebooted.

Using PGP

Once installed, registered and restarted, run PGPkeys. (With GnuPG for Windows, run WinPT and double click the key icon in the System Tray to open Key Manager.)

Click the top left hand icon (Generate new keypair) and follow the instructions. This creates your PGP key pair.

To send someone your public key, click on your name in PGPkeys and copy (Ctrl + C). (With Key Manager in GnuPG use Copy from the Edit menu as Ctrl + C copies all the keys)

Open a new message in Outlook Express and paste in the text (Ctrl+P). Your public key will appear as below.

To import a public key, highlight the entire message including the dashes and copy (Ctrl + C). Open PGPkeys, paste (Ctrl + P) and click Import. (With Key Manager in GnuPG use Paste from the Edit menu as Ctrl + P does nothing.)

To send an encrypted message, first write your message in notepad and save as a text file (.txt). Right click on the file and select PGP, Encrypt. PGP Shell - Key Selection Dialog will open. Drag the user you require from the user window above to the recipient window below and remove any recipients that you don't want included with the Delete key. Tick Text Output and click OK. (With GnuPG right click on the file and select GPGee, Encrypt (PK). Sign/Encrypt Files Dialog will open. Tick the recipient(s) required, select Text Output from Misc. Options and click OK.)

This creates a .txt.asc file. Open this file in Notepad (right click, Open With, Notepad), highlight the entire message including dashes (Ctrl + A) and copy (Ctrl + C). Open a new message in Outlook Express and paste in the text (Ctrl+P). Your message will appear as below. (Enter None as the message subject to maintain confidentiality.)

To read an encrypted message, highlight the entire message including dashes and copy (Ctrl + C). Open Notepad, paste (Ctrl + P) and save as Message.txt.asc in the File name box. Right click on the file and select PGP, Decrypt & Verify (with GnuPG, right click on the file and select GPGee, Verify/Decrypt). Enter the passphrase for your private key and click OK. The decrypted message will be saved as a text file.

Problems with File Attachments

If you do not select text output when encrypting, the file created will have a pgp, gpg or other encryption extension. If the person receiving the message is not using the same application (PGP, GPG or whatever), they may not be able to open the file. Likewise, if the message is written in a Word Processor and the message receiver does not have the same one installed, they may not be able to read it. So writing messages in a text file and sending them as text is more reliable.

That's about it.