Thanks to #efail, email encryption with OpenPGP (and S/MIME) did get quite some attention recently. I do want to take up the opportunity to write a series of round-up articles on OpenPGP usage in my daily work, especially how to set it up and how to use it for maximum benefit including usage of security tokens like Yubikey.
This article is part of our series “OpenPGP On The Job”. Would you like to continue with another article from this series? Here’s an overview.
It gets more and more common for customers to ask for encrypted and / or signed data exchange. Industrial espionage is on the rise. A business's success may very well depend on important data being secured from theft or modification. However I noticed that there are still some people out there in the IT struggling or hesitating to use data privacy techniques. This must not be in 2018. Arguably, tool support was lacking and usability not that high in the past, but this has changed quite a bit. There are no excuses anymore to not use any form of encryption. In my opinion everyone working as a professional IT employee should know the basics and have a working setup available.
OpenPGP is my current tool of choice for this due to its wide spread usage, free availability and ease of use.
There is a huge amount of content available on the internet with all sorts of details about the topic, so I try to simplify things as much as possible:
Again there are tons of information on the topic. Understanding the mathematical basics is quite challenging, but not really required to being able to use it. So here is how it works in a very brief nutshell:
You'll always need a so called pgp client which is an application that performs encryption, decryption and signing.
You'll also need a so called key pair, consisting out of two parts: A private key used for decryption and signing and a public key used for encryption and signature validation.
Security is based on the following two principles:
Keys are locally stored in a so called key ring which is usally managed by the pgp client.
Public keys can be obtained from key servers which are freely accessible throughout the internet.
Private keys are kept secret and stay with their owners.
Encryption of an e-mail is done with the public key of the receiver, thus everyone can encrpyt.
Decryption is done with the private key of the receiver, thus only the receiver can decrypt.
Signatures can be validated with the public key of the sender, thus everyone can validate.
Signatured can be created with the private key of the sender, thus only the sender can sign.
Obviously the privacy of the private key is essential, thus it is additionally "locked" by a passphrase known only to its owner.
GPGTools is a fine client for macOS. The app Mail supports GPGTools and is a good choice. Of course the combination of Thunderbird and Enigmail is also very popular on macOS. On iOS, the GPGTools support is not that good. However, there are various apps that serve the purpose of e-mail en- and decryption and do not require GPGTools, such as iPGMail.
No, it is not. The same holds for S/MIME. Although EFail can be used to break encryption, it does so by exploiting e-mail client's faulty handling of HTML tags and external content. So the bug is in the tools, not in the standard. Tool providers will provide updates soon.
As security precautions it is sufficient to:
For more details see also Protonmail.
The series will continue with some preparatory steps before we start.