How to set up and use Pretty Good Privacy (PGP)

Pretty Good Privacy (PGP) is the No. 1 trusted and tested encryption program. It can be used to encrypt text, files, emails, or entire disks.

It was created in 1991 by Phil Zimmermann and was released as an open standard called OpenPGP in 1997. There is also an implementation of PGP, which has been available under a GPL license called GNU Privacy Guard (GPG) since 1999.

[Want tips for protecting your devices? Sign up for the ExpressVPN blog newsletter.] 

History of PGP

Zimmermann was a known anti-nuclear activist in the 1980s and ’90s who wanted a way to store files and information outside the government’s reach. Zimmerman created PGP and released the software free for everyone, and included the source code in every release.

In the early ’90s, encryption software was still classified as military munition, and its export was strictly prohibited. To contest these regulations Zimmermann printed the source code in books, then distributed them around the world. The rationale was that while munition was strictly controlled, the text was protected by the First Amendment. The U.S. investigated Zimmermann for three years but dropped all accusations in 1996.

Read more: How to back up your files and encrypt them

How does PGP work?

PGP is a pseudonymous system. The main uses are to keep the content of your data private and ensure the authenticity of all communication and files. It can greatly enhance anonymity when used together with software like Tor. However, the PGP signing feature does the exact opposite of keeping you anonymous; it is used to digitally prove you wrote a statement or reviewed a file.

Because of these open standards, it has become possible to create a variety of software for all devices that can interact with another.

In PGP, every user needs to create a public key and a private key. The private key stays on the user’s computer, and the public key can be safely uploaded to the web or given to other users. It does not need to be connected to your real identity or email address, but caution is needed, so as to not mix up the keys!

Read more: Cybersecurity lessons: Safer private keys with Shamir’s Secret Sharing

Let’s say you receive Alice’s public key, you could use it to create files or text that are only readable by Alice. You can also verify Alice’s signatures to confirm a file really came from her, or that she really did make a public statement attributed to her.

On the other hand, if you have Alice’s private key you can use it to access files that were intended only for her. You can also use it to sign files and statements as Alice. This is why you need to keep your private key private and why it can be dangerous if your computer is compromised. If someone gains access to your computer, they could also gain access to your private key.

While the math behind PGP is considered bulletproof, there are many possible exploits. The biggest issue is how best to authenticate the public keys. Since anybody can upload and distribute a key under any name, some verification is necessary to ensure that the key you are using really belongs to the person that you think it belongs to.

PGP tries to solve this with what they call the “web of trust.” The idea is that though you might not have met the person that you are interacting with, perhaps a trusted friend of yours has. Or a trusted friend of your trusted friend, and so on. To recreate this chain of trust, each user would sign their friend’s key. However, this process can reveal private and compromising information, and is quite a tiring process. As a result, the web of trust is not used enough to make it useful.

How to set up PGP on your device

To set up PGP on your device you will need to install a program and create your PGP key. There are lots of programs for differing needs, but we will only focus on the most usable ones.

macOS: GPGTools https://gpgtools.org/

iOS: iPGMail https://ipgmail.com/

Windows: GPG4Win https://gpg4win.org/

Android: Guardian Project https://guardianproject.info/code/gnupg/

Linux Ubuntu: Seahorse https://wiki.gnome.org/Apps/Seahorse/

Linux Ubuntu: Enigmail https://www.enigmail.net/home/index.php

Create your PGP key and back it up

To use PGP you need to create a PGP key. Your chosen PGP program will ask for a name and email address. While it doesn’t matter which identity you pick it, it will be far easier to integrate PGP into your mail program if you use an email address that you own.

We also recommend setting an expiration date on your key, for around two to three years in the future. You can always change this date, as long as you haven’t lost access to your PGP key. It’s also a good idea to create a key with the maximum size (at least 2048 bits) and set a long and complicated password (which you can generate with our random password generator).

If you lose the password you will also lose access to your PGP key and won’t be able to decrypt any files associated with it. Make sure to back it up well, and if you don’t trust yourself to remember the password, back it up separately. You could save it in your password manager, or simply write it down and keep it somewhere safe.

You now have your PGP key! Congrats! You can now upload it to a public server so that people can see you use PGP and they can find your key.

Create a PGP revocation certificate

The next step is to create a revocation certificate. Don’t worry about keeping your revocation certificate secure. In fact, you want to keep it as accessible as possible! Send it to yourself as an email attachment, put it in your Dropbox directory, and keep it on your standard drive. If you ever lose your private key, forget your password, or worse, if someone else gets access to it, you can revoke the key with the revocation certificate. Revoking the private key will ensure others won’t send any more files to you with that key. This also prevents two valid keys of you floating around, which can be another source of confusion.

Back up your PGP key

Backing up your key is more tricky. You want your backup to be as secure as possible. Hopefully won’t need to worry too much about it being accessible.

Always make sure to back up the PGP key and its password separately. For example, you could choose to keep your password in the password manager and store the key on a USB stick in your safe or bank deposit box.

If you have set up automatic backups for your ordinary data, you can keep them together, but make sure they are properly encrypted!

Security and accessibility are often in conflict. The more your key is accessible to you, the more it will also be accessible to others. Think about your risk preferences when making decisions about password complexity and the location of your backups. Someone on the run from an authoritarian government should put more effort into their security than an ordinary citizen who just wants to uphold their right to privacy online.

How to send encrypted messages using PGP

Get PGP public keys of your contacts

You will need to receive the public PGP keys of your contacts before you can send them encrypted messages or verify your files, and you will also need to publish yours.

You can upload your PGP key to a key server, which is probably the most convenient place for your contacts to receive it. You can also host it on your website, link to it in your twitter bio, or use a dedicated service like keybase.io. You can even upload your PGP key to your Facebook page.

A PGP key can be identified with a user ID (a name or email address), a key ID (like 0x0BACE776), and a fingerprint (like 509E 7B97 D266 A283 DC10 5E6F 57ED 72A2 0BAC E776). While the key ID and the fingerprint are both calculated from the PGP key itself, the keyID is a bit too short to uniquely identify the key, so the fingerprint is preferred instead. Why not print it on your business card to strengthen your online identity and status as a privacy-conscious, savvy individual?

Encrypt your files

To encrypt files, you will need the public key of the person who you want to send the encrypted files to. You can also choose your own public key, or use multiple different PGP keys.

You could use PGP to conveniently store your Bitcoin wallet on a USB stick. The advantages are plentiful and you won’t need to worry about who has access to the USB stick, or whether it might have been copied without your knowledge. You also won’t need to remember a password or communicate the password to the intended recipient of the file, which is often impossible without encrypted channels.

Modern software makes it easy for you to encrypt and decrypt files. Often, it’s as simple as a right-click on the file in question. Select a key, and the process will create a .gpg or .pgp file that can safely be sent over the internet, stored on an external storage unit, or keep in the cloud.

Sign files

Anybody can encrypt a file and send it to you and even if the file comes from your contact’s email address, it is no guarantee that the file really was sent by them. PGP offers the option to sign files, which proves without a doubt that the file came from your contact.

You can choose to encrypt and sign a file, just to encrypt it, or just sign it. You can use this feature to sign public statements or to sign software releases. It is very common among open-source software projects to sign any code and programs.

If the software wasn’t signed it would be very difficult to verify its authenticity, as an attacker could have introduced backdoors to the software without the knowledge of the developers.

These signature files are usually of the same name as the files they are representing, plus the endings .asc or .sig.

In some software you can verify a signature by simply double-clicking the signature file, or running the command gpg –verify file.sig

You will need to have the PGP key of the signatory to verify the signature.

While it is impossible for an attacker to change an encrypted file without the owner finding out, it might still be very valuable for the attacker to know who encrypted the file in the first place. People seeking anonymity need to carefully create new PGP keys for each of their contacts, which can be complicated and error-prone. In such cases it might be more appropriate to use encrypted message technology like OTR, which offers reliable encryption and authentication.

Sign and encrypt text

—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA1

With PGP you can sign and encrypt pretty much anything. In some software, it is enough to simply write your text in a text editor, then sign or encrypt it with a right-click.

This is what your PGP signature will look like. It can be posted in a Reddit comment, blog post or email, to prove that it is really you making a comment:

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

iQIcBAEBAgAGBQJWVXw0AAoJEIMuYyhAgNc6wKoP/AwSaInjpoSQKUBPukE+TY4vXWnoh1dCiOcLzCsbAz7IvLmtoILlGxfLwi0XUhAUQTKEAHxpWKbUTY/5MNFA1UUscHSH4t+aCtlFxNk4mMCtZO7c3JPh91U1rgN1K9J5YE9flpk+P5F5fdEhF4iD05P67uf4+t/k5cupD+pZv8pGnB+5rpPPe7ODE5ptA3DyI3i8srrvKVkictxYub9RDknqYJAaE/xxFZ7+mAZxM64gnN8Rwf+euDqdrf3PqiIUW6kcdvqJOyx7WZt+ows84kEze8AR3QhS1FBJfP3xAhsibBfy0sUSJopyl9kKIEDCcfGDf9Mthe3kzVUUayxz8AOrGC5ce6isg3YN4Nsi8K7idhPQyPgjBWtKWfuuYSUG+dPObVD+pFUkgOnrm07Qhp4ZVXKbuOnqf4swqc4vnW9C/9ADwk2/fat071fik8ohDzF9l4Cpm+iLj5w7Pv5iivvfe2oz0WCxnr6wj4XX5MsDTNOmMmObCWbnla+uYEJtDlbWse8XOq7q/DiMT9p+ZtHkSwrQ+3TLNHxxJK7UJJFdlfZUZqC06LsSb2yEBh7rJytoN2PrpjB5H7Zx99DC5v+i1klr4hbrLeHtd+fVl1AGrMz+agcO6YQGpHJ0hhJXVrRruJjLJzOhJkzUU3o0rHeHRk69jKdAKpsOqABsunt5=/QHs

-----END PGP SIGNATURE-----

Encrypt emails

When you write private emails it is not a good idea to write them in the draft folder of your email provider. Everything you do in that folder gets saved forever, and you don’t know who has access to it.

An alternative is writing your emails in notepad, encrypt the text, then paste the encrypted text into the email. Writing emails in notepad can be tiring and copy and pasting the encrypted versions even more so. Luckily, there are plugins for mail software like Thunderbird (Enigmail) and Apple Mail (GPGTools) that make the process of decrypting and encrypting smooth. It is a very strong privacy protection against even the most sophisticated adversaries.

One great thing you can instantly do is upload your PGP key to Facebook and receive all updates and notifications in encrypted form. This is especially useful for security sensitive information like resetting a password. Using a PGP on Facebook would prevent a hacker from hijacking your Facebook account through your email account.

PGP doesn’t protect metadata

PGP is designed to hide the content of files and messages, but it does not protect your metadata. Metadata can include file names, file sizes, headers of emails, creation dates, and recipients. A hacker could learn a lot from such knowledge, so it’s important to remain cautious about what you share—even when using PGP.

It is also easy for anybody who possesses an encrypted file to see who it is encrypted for, and who signed it. PGP does not offer forward secrecy, so if your key gets compromised an attacker can access all of your encrypted communications of files. They can decrypt everything, potentially compromising years of emails and file transfers.

This is why you should encrypt your keys with a good password, use multiple keys in multiple situations, and regularly replace your PGP keys.

It is also important to know that PGP does not encrypt the names of files or the headers of emails. So be careful of what you write in them!