Political scandals have always been about leaked information. Don’t you wonder why sensitive data has been passed around in clear text on the leaked cables that Wikileaks has been making public, while your latest SpongeBob Blu-ray or DVD disc is encrypted with DRM locks and transactions like your book purchase at Amazon is secured and encrypted by SSL certificates?
Encryption has been overlooked by general public all the time. You only hear about it in “hacker” films or breaking news scandals. Although encryption is commonly associated with hiding secrets, when in fact it’s more about securing information. When you change the mindset you’ll start considering encryption as something more relevant for your everyday digital life.
For example, the cloud storage service Mega has encryption built in, after the lessons learned on the data kidnapping of MegaUpload servers. This is for the protection of both parties, the service providers and yourself, the user. This way, only you can open the files and not even Mega employees can know what is in your storage account. Dropbox, Google Drive and other services don’t provide the same level of security, so basically anyone that has access to those servers can see your personal information.
There are many types of encryption methods. One of them is called GPG (initially PGP but the free software version is known as GPG).
GPG is a two key system, where you hold a private key and a public key. The way it works is that you encrypt a file with someone’s public key and send it. On the receiving end, the other person has a private key, and only with the private key the message can be deciphered.
Public keys can be obtained from the person directly through a file transfer or email attachment prior to encrypted communication. Some people, like me, publish their public keys on their personal web page. The most common method to get a public key is to search it on key servers. Most GPG GUI programs have the option to search, download and upload public keys on key servers.
Encryption jargon
So to get started with protecting our data using encryption, you’ll need to learn the basic concept words:
Encrypt
Encryption will protect the contents of the file, image, text or whatever is being encrypted, so that only the owner of the private key can view it.
If you want to protect a file only for your eyes, encrypt it with your own public key.
Decrypt
This is the process of removing the encryption so that you can view the contents of the protected file. This can only be done if the contents were encrypted with the public key of the person who’s supposed to see the information.
If someone sends you a file that was encrypted with your public key, only you, who has the private key, can decrypt the file.
Sign
Sometimes the only layer of protection you need, is to make sure the contents of a file or email were not altered between the time you send it and the time it is received by the other person.
It also works as a way to make sure that a message is coming from you, since you need your private key to sign the file and only you have access to it.
Signing a file or text is a mechanism to know that the contents are intact. This does not hide the message itself, it only adds a signature to the file to ensure that every bit is in place with no modifications.
Verify
This is how you check a file or message’s signature for authenticity and integrity. If the signature doesn’t match, it means that the file has been altered or didn’t came from the right person.
You can sign or encrypt a message or file. Signing doesn’t hide the information but it helps to certify that the information hasn’t been modified by anyone else before reaching you. Encrypting will hide the information so no one can see the message or file’s contents.
Setup
To setup GPG on your system, you’ll need to generate your public and private keys. Any GNU based system is compatible with GPG (GNU Privacy Guard). Most GNU/Linux distributions are already bundled with the gpg command-line tool. If not, on a Debian-based distribution you can install it with:
sudo aptitude install gpg
Generating your keys
After you installed gpg on your system, to create your keys for the first time, all you need to do is open a terminal and type:
gpg --gen-key
This will start a step by step process with some simple questions. When in doubt, use the default options by just pressing Enter. Don’t fear the command line, it’s just text.
When asked for a passphrase, note that GPG is not asking for a pass word, it’s asking for a pass phrase so make sure it is longer than one word and an easy to remember sentence.
Once that is done, you can check your list of keys with
gpg --list-keys
Key search and import
If someone hands you their public key on a file, you’ll need to import it to your keyring to use it:
gpg --import key.asc
The key.asc is the file with the public key.
You can also search for someone’s public key on key servers
gpg --search-keys myfriend@email.com
After the results, the GPG will ask which key you want to import. Select the key from the results list by their number at the beginning.
Basic usage
Encrypt
To encrypt a file, first you need to import the receiver’s public key, then you can use it like this:
gpg --encrypt --recipient myfriend@email.com my_message.txt
This will generate a file my_message.txt.gpg which is the encrypted file you’ll want to send.
Decrpyt
To decrypt a file, the sender must have used your public key. You can use whatever name you want for the output file, in this case “my_message.txt”
gpg --output my_message.txt --decrypt my_message.txt.gpg
Sign
To sign a file you use this command:
gpg --armor --detach-sign myverifiedfile.zip
This will create an additional file called ‘myverifiedfile.zip.asc’ which is the signature to verify the file. Send both files to the receiving end.
Verify
You receive two files: the data file and the signature file. You can verify the signature with this command:
gpg --verify signature_file.asc myverifiedfile.zip
Frontend tools
If you’re on GNU/Linux and using KDE you can install the user interface KGPG
sudo aptitude install kgpg
On Gnome, you can use Seahorse
sudo aptitude install seahorse
For graphical user interface options on Mac OS X and Windows, you can check the GPG website.
These GUI front ends will integrate well with your desktop environments, so you can easily encrypt, decrypt, sign or verify files from the file manger right-click menu options.
GPG and Email
The easiest way I can recommend to use encryption with email, is with Enigmail, an extension for the Mozilla Thunderbird email client. It integrates very well and makes it easy to sign, encrypt, verify and decrypt email messages.
In case you haven’t generated any keys, Enigmail will help you generate them with an easy step by step graphical Wizard.
I hope this guide helps you know more about encryption and how to use it. And remember: Encryption is not only about hiding secrets; It’s about protecting your personal information.
