Recent government spying revelations have shown us how hard real privacy is to achieve, and how little of our information is really safe.
GnuPG is one of the few tools that can offer real protection.
Yet it remains popular primarily in only hi-tech circles, despite it’s availability on Windows, Mac, and Gnu Linux, its ease of use, and the fact it’s free of charge.
We need to introduce new people to GnuPG and help them to start emailing safely and privately – the new GnuPG website will play an key role in making strong crypto desirable and accessible.
It’s Free Software – anyone can inspect its source code and check for back doors, and security experts frequently do. It’s made by leading experts who were originally chosen by the German Government for their aptitude. It’s build on rock solid cryptography principles that have been adopted industry-wide, and uses the OpenPGP Open Standard for compatiblity with other applications. It’s so widely used that hundreds of companies have a vested interest in checking that it works the way it should. Unfortunately that doesn’t mean they choose to donate to the project or support it in other ways. And it’s even used by Phil Zimmerman, father of strong email and voice over IP encryption.
IT WILL ONLY ENCRYPT THE BODY AND ATTACHMENTS OF AN MAIL! NOT THE SUBJECT! DO NOT WRITE ANYTHING IMPROTANT INTO THE SUBJECT – JUST WRITE „SELLERIE“.
you will generate all three in the following process.
if you encrypt something (mail, file) with your public key – it can ONLY be decrypted with your private key.
This is why NSA wants to get quantum computers so they can crack that too.
The public key goes public – on your website – attached to your mails or you can upload it to a keyserver, where people can download it again and encrypt mails that they want to send to you.
There will be a third file called „revocation certificate“ that you can use to disable your public key – in case someone stole your private key and it’s not safe anymore to send you encrypted mails with that key.
We will go through that later.
With PGP the NSA can still see who communicates with who (meta-data) but can not mass-analyse content.
You can set this up pretty fast.
the older version of Enigmail 1.8.2 works like a charm with this setup.
3dfd29a12fc36c5780574bdab67fb61d63e65e67671d14921749187f7af1639f enigmail-1.8.2-sm+tb.xpi; #should be in any case like this, no matter from where you downloaded.
5. drag and drop the enigmail-1.8.2-sm+tb.xpi into the whitespace of your addon window of thunderbird/icedove.
you will have to hit „restart now“ button to restart icedove to activate the plugin.
you will have to give a passphrase that unlocks your private key whenever you have to decrypt messages that were encrypted with the public key of your key-pair.
first select your public key: „Your Name admin2@dwaves.de (0xEA1994CC) pub.asc“ file and hit import. You should have a new entry in your list of available public keys.
you again go import keys from file and import your private key „Your Name admin2@dwaves.de (0xEA1994CC) pub-sec.asc“ and now the entry in the list turns bold-black.
DO NOT SELECT YOUR REVOCATION CERTIFICATE! OR YOU WILL REVOKE YOUR KEYPAIR IMMEDATELY (WITHOUT BEEING ASKED).
so people can conveniently download it again and have not to search all over the internet.
9. test if you can send yourself an encrypted message and decrypt it again.
WARNING: THE SUBJECT AND HEADER ARE SEND IN CLEAR-TEXT!!!!
ONLY THE MESSAGE CONTENT/ATTACHMENT IS ENCRYPTED!!!
One important point concerns mail header security. Mail headers cannot be encrypted, nor included in the signature computation. This includes also the Subject mail header. Therefore, do not write any sensitive information in the Subject when sending an encrypted message.
Signature and encryption applies to the mail body only –- and also to attachments, if you chose so. That is, when you sign a message, no mail header (such as the Subject, Date, all Received headers, etc.) can be included in the signature. Also, when you encrypt a message, mail headers are not encrypted.
If you have the feeling someone compromised your system and stole your private key.
You can revoke your public key.
it get’s imported and you can r-click on your key and click -> revoke key.
Now it reminds you to also upload your local changes to the keyservers you previously uploaded your public key to make the revocation of your key public.
gpg: WARNING: GnuPG will not work properly – please configure that tool to not interfere with the GnuPG system!
gpg: WARNING: encrypted message has been manipulated!
This website provides services for the SKS keyservers used by OpenPGP. A pool of keyservers is available at hkp://pool.sks-keyservers.net Information about the other variants of the pool is found in the overview.
A chart showing the development in the number of OpenPGP keys by day. This is the maximum number of keys found on the keyserver at the start of any given day.
Werner started GnuPG in 1997 and still puts most of his working time into the development and maintenance of GnuPG. He has 29 years experience in commercial software development on systems ranging from CP/M systems to mainframes, languages from assembler to Smalltalk and applications from drivers to financial analysis systems. Werner is a long time free software supporter and co-founder of the FSFE. With the support of his brother he founded g10code GmbH in 2001 to make GnuPG development his profession. Werner is full time employed by g10code.
Werner Koch (born July 11, 1961) is a German free software developer. He is best known as the principal author of the GNU Privacy Guard (GnuPG or GPG). He was also Head of Office and German Vice-Chancellor of the Free Software Foundation Europe. He is the winner of Award for the Advancement of Free Software in 2015 for founding GnuPG.
Journalists and security professionals rely on GnuPG, and Edward Snowden used it to evade monitoring whilst he leaked classified information from the U.S. National Security Agency.
Koch lives in Erkrath, near Düsseldorf, Germany. He began writing GNU Privacy Guard in 1997, inspired by attending a talk by Richard Stallman who made a call for someone to write a replacement for Phil Zimmermann’s Pretty Good Privacy (PGP) which was subject to U.S. export restrictions. The first release of GNU Privacy Guard was in 1999 and it went on to become the basis for most of the popular email encryption programs: GPGTools, Enigmail, and Koch’s own Gpg4win, the primary free encryption program for Microsoft Windows.
In 1999 Koch, via the German Unix User Group which he served on the board of, received a grant of 318,000 marks (about $170,000 US) from the German Federal Ministry of Economics and Technology to make GPG compatible with Microsoft Windows. In 2005 he received a contract from the German government to support the development of S/MIME.
Journalists and security professionals rely on GnuPG, and Edward Snowden used it to evade monitoring whilst he leaked classified information from the U.S. National Security Agency. Despite GnuPG’s popularity, Koch has struggled to survive financially, earning about $25,000 US per year since 2001 and thus considered abandoning the project and taking a better paying programming job. However, given Snowden’s leaked documents showed the extent of NSA surveillance, Koch continued. In 2014 he held a funding drive and in response received $137,000 US in donations from the public, and Facebook and Stripe each pledged to annually donate $50,000 US to GPG development. Unrelated, in 2015 Koch was also awarded a one-time grant of $60,000 US from the Linux Foundation’s Core Infrastructure Initiative.
Wayner, Peter (November 19, 1999). „Germany Awards Grant for Encryption“. The New York Times. Retrieved February 6, 2015.
Angwin, Julia (February 5, 2015). „The World’s Email Encryption Software Relies on One Guy, Who is Going Broke“. ProPublica. Retrieved February 6, 2015.
Goodin, Dan (6 February 2015). „Once-starving GnuPG crypto project gets a windfall. Now comes the hard part“. Ars Technica. Condé Nast. Retrieved 28 July 2015.
Thomson, Iain (5 February 2015). „Internet lobs $$$s at dev of crucial GPG tool after he runs short of cash“. The Register. Retrieved 6 February 2015.
Zemlin, Jim (8 February 2015). „Answering the Call for Werner Koch’s Everywhere“. Linux Foundation. Retrieved 28 July 2015.
David approached the GnuPG Project in 2002 after the relaxing of the US crypto regulation allowed the participation of US based hackers on international crypto projects. One of his first achievements was a much improved Web-of-Trust implementation. Today he mainly takes responsibility for the keyserver access and the classic GnuPG 1.x branch.
Marcus is part of the free software community since 1997, when he joined the Debian project. Probably best known for his past work on GNU/Hurd, he also has a diploma degree in mathematics, and was employed by g10code to work on the GnuPG and related software from 2001 to 2012.
Niibe is a long time free software hacker who joined the GnuPG project in 2011 and soon took over the development of the smartcard related code. He is also the person behind the Gnuk Token and the MEP game. Niibe’s work on GnuPG is financially supported by g10code.
Jussi joined the GnuPG project in 2012 and worked since then on assembler optimized code for cryptographic algorithms in Libgcrypt.
Neal started to work on GnuPG in 2015 to support maintenance and development in all areas. He is full time employed by g10code.
Kai is working on the Enigmail project since 2015. He is part time employed by g10code.
Justus started to work on GnuPG in 2015 to support maintenance and development in all areas. He is full time employed by g10code.
PRIVACY FOR THE WEAK – TRANSPARENCY FOR THE POWERFUL!