General explanation of PGP

Wording confusion

When talking about PGP we mostly mean the OpenPGP standard. PGP itself is a proprietary software written back in 1991. GPG is an open source replacement for the PGP software. In this workshop, whenever I mention PGP I most likely mean the OpenPGP standard.

Key pairs

In order to use PGP we need so called key pairs, which consist of a private key and public key. This is pretty much self explanatory, but I'll tell you anyway:

• Your private key is meant to be kept secret and save. If others get hold of it they will be able to decrypt your encrypted messages. If you lose your private key you will no longer be able to decrypt your own messages.
  There are different clients and services that offer to create a keypair for you on a server or invite you to upload your private key, but in general this is a bad idea. Please know what you're doing if you keep your private key somewhere else as on your local machine.

• Your public key is meant to be shared publicly with others. Usually you will upload it to a so called keyserver (like http://pgp.mit.edu/).
  Because your public key (also often just refered as "your key") is quite long and can become even longer over time, you can use a fingerprint to identify it. To make it even shorter, often you only use the last 8 digits of your fingerprint. My PGP fingerprint is 55B4 51E0, while my full public key is 377KBs long.

"55B4 51E0" are the last 8 digits of my pgp fingerprint. My key length is 2048 Bit.

Encryption

When you have someone's public key you can use it to encrypt a message that only can be decrypted using the private key of that person - which (hopefully) means that only the intended person can decrypt the message. An attacker that gets hold of the encrypted message and the public key can not decrypt the message.

This internally builds on RSA which again builds upon the mathematical principle that it is easy and fast to multiply really big prime numbers, but it's hard (takes a lot of computing time) to find the prime factors of that result. So in the end secure encryption is a bet that it takes long enough to decrypt the message. I'd say an encryption is strong enough when decryption takes longer than our planet will exist.

An important factor is the key length. Today common lengths are 1024, 2048 and 4096 bits. While 1024 is considered to be practically breakable (still with a huge amount of money and time), 2048 is considered "good enough". 4096 is not yet supported in all software and hardware, but if you're a progressive girl or guy - go for it.

If you want a better understanding of how this works I recommend watching these 2 videos:

Diffie-Hellman Key Exchange (explained with colors) RSA Encryption Algorithm

Fun fact: If a smart mathematician comes up with a solution to the discrete logarithm problem the vast majority of all cryptography in the world (including SSL, SSH, VPN) will be easily breakable.

Signing

There's even more you can do with your PGP keypair. Using your private key you can sign a message (e.g. an email) and the recipient can (using your public key) verify that you were the one who signed it and that the message was not manipulated along the way.
You can sign and encrypt a message or just sign or just encrypt a message. But if you do both (sign & encrypt) it's recommended to do it in this exact order (encryption after signing). Most likely your client will take care of such details.

More about the public key

Your public key does not only contain the cryptographic information how to encrypt a message for you, but there's more in it:

• An expiration date
• It includes the mail address(es) this key is valid for.
• A signature by yourself for each of those mail addresses (done automatically by your client).
• (optional) [[basti:talks:pgp:key_signing|Signatures]] of other people for each of those mail addresses.
• (optional) A nice picture of you (please keep it small, because it will bloat your key)