Sending Encrypted Email

In previous blog entries I've created GnuPG keys and decrypted a message encrypted with my public GnuPG key. In this entry I show how I respond with an encrypted email using Enigmail and how I encrypt a file using gpg at the command line.

You'll remember Bob sent me an encrypted email. I decided to send Bob an encrypted email in return. The first task was to find his public key. I used the key search feature. You may remember Bob included pgp.mit.edu in his signature as a hint for where to look for his public key, so I pass that site as the keyserver.

orr:/home/richard$ gpg --keyserver pgp.mit.edu
 --search-keys rgrabowsky_at_rasecurity_dot_com
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
gpg: searching for "rgrabowsky_at_rasecurity_dot_com" from hkp server pgp.mit.edu
(1)     Bob Grabowsky bob_at_infotech-nj_dot_com
        Bob Grabowsky robertg_at_InfoTech-NJ_dot_com
        Robert Grabowsky rgrabowsky_at_rasecurity_dot_com
        Bob Grabowsky rgrabowsky_at_rasecuritysystems_dot_com
          1024 bit DSA key 7932C9E3, created: 2001-05-27
Enter number(s), N)ext, or Q)uit > 1
gpg: requesting key 7932C9E3 from hkp server pgp.mit.edu
gpg: key 7932C9E3: public key "Robert Grabowsky " imported
gpg: Total number processed: 1
gpg:               imported: 1

That was easy. Because I found the key and selected it, GnuPG imported it automatically. I can verify that.

orr:/home/richard$ gpg --list-keys
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
/home/richard/.gnupg/pubring.gpg
--------------------------------
pub   1024D/752B57C7 2005-04-23
uid                  Richard Bejtlich richard_at_taosecurity_dot_com
sub   2048g/8BA44991 2005-04-23

pub   1024D/7932C9E3 2001-05-27
uid                  Robert Grabowsky rgrabowsky_at_rasecurity_dot_com
uid                  Bob Grabowsky bob_at_infotech-nj_dot_com
uid                  Bob Grabowsky robertg_at_InfoTech-NJ_dot_com
uid                  Bob Grabowsky rgrabowsky_at_rasecuritysystems_dot_com
sub   1024g/8F0D6977 2001-05-27

Another alternative is to check a Web-based keyserver search form. I visited www.pgp.net/pgpnet/wwwkeys.html and searched on Bob's last name. Here are the pertinent results, with email addresses altered slightly to spoil harvesters.

pub  1024D/7932C9E3 2001-05-27 Bob Grabowsky bob_at_infotech-nj_dot_com
                               Bob Grabowsky robertg_at_InfoTech-NJ_dot_com
                               Robert Grabowsky rgrabowsky_at_rasecurity_dot_com
                               Bob Grabowsky rgrabowsky_at_rasecuritysystems_dot_com

Notice the key ID of 7932C9E3. This is the same value that appeared in Bob's signature in the message he sent to me. This must be the right public key. I've already imported the key with GnuPG, but if I wanted to use the key stored on this Web-based keyserver, I would download the key linked to these results. I would then use the import command.

So how did I respond to Bob's email? Enigmail made it easy. I decided to reply, and Enigmail asked if I wanted to configure Enigmail to import Bob's public key. In a second window I confirmed that I wanted Enigmail to use Bob's email address to locate his public key. When I selected 'send', I briefly saw my message in ASCII-armored format like this.

-----BEGIN PGP MESSAGE-----
Charset: ISO-8859-1
Version: GnuPG v1.4.0 (FreeBSD)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

hQEOAzf/9vKPDWl3EAQAqmMHJKxFtj1oN2NV0wUGvNmYTXvazSSiWg3iPzNix+n0
i5qajeTQ+v6PSlY5SvMwDaW6Ojp6MtsQ90O5IrrE1TBfSeDpO6EbQ2Vd0xhdGNtT
...truncated...

Then it was on its way, and it appeared in clear text in my Thunderbird window. Because I also asked Engimail to sign the message for me, I saw a signature and key icons in the Thunderbird window indicating gpg had signed and encrypted my reply.

Earlier I mentioned importing a key from a file. As an example I import Bamm Visscher's public key, retrieved from the Web-accessible keyserver.

orr:/home/richard$ gpg --import bamm.asc 
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
gpg: key 593C82C4: public key "Bamm Visscher (Senior
     Engineer/Managed Security Services) rvisscher_at_saball_dot_com" imported
gpg: Total number processed: 1
gpg:               imported: 1

Let's say I wanted to send an encrypted file to Bamm. The file is secret.txt. Here's how I would encrypt it. First I verify his user ID.

orr:/home/richard$ gpg --list-keys Bamm Visscher
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
pub   1024D/593C82C4 2001-06-26
uid                  Bamm Visscher (Senior Engineer/Managed Security Services)
                     rvisscher_at_saball_dot_com
sub   1024g/A3D3321B 2001-06-26

His UID is "Bamm Visscher". Now I encrypt secret.txt.

orr:/home/richard$ gpg -sear "Bamm Visscher" secret.txt 
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information

You need a passphrase to unlock the secret key for
user: "Richard Bejtlich richard_at_taosecurity_dot_com"
1024-bit DSA key, ID 752B57C7, created 2005-04-23

gpg: A3D3321B: There is no assurance this key belongs to the named user

pub  1024g/A3D3321B 2001-06-26 Bamm Visscher
     (Senior Engineer/Managed Security Services) rvisscher_at_saball_dot_com
 Primary key fingerprint: 7FA4 8692 4707 D567 E0D7  5835 416C 0915 593C 82C4
      Subkey fingerprint: 4282 C306 F28B C630 8057  50EC E3E1 FEE5 A3D3 321B

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

The 's' switch signs the file. The 'e' switch specifies encryption. The 'a' switch tells gpg to create an ASCII-armored file suitable for transport via email text. The 'r' switch says a UID follows, e.g. "Bamm Visscher".

You'll notice gpg complained that it couldn't be sure Bamm's public key belonged to him. This is where the key fingerprint and a call to Bamm come into play. If I wanted to verify the authenticity of Bamm's public key, I would call him and ask him to tell me his fingerprint. Since it matches the value posted above, I know he is the owner of this public key. When I trust his key, then I can sign it with my own as follows.

orr:/home/richard$ gpg --sign-key A3D3321B
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information

pub  1024D/593C82C4  created: 2001-06-26  expires: never       usage: CSA 
                     trust: unknown       validity: unknown
sub  1024g/A3D3321B  created: 2001-06-26  expires: never       usage: E   
[ unknown] (1). Bamm Visscher (Senior Engineer/Managed Security Services) 


pub  1024D/593C82C4  created: 2001-06-26  expires: never       usage: CSA 
                     trust: unknown       validity: unknown
 Primary key fingerprint: 7FA4 8692 4707 D567 E0D7  5835 416C 0915 593C 82C4

     Bamm Visscher (Senior Engineer/Managed Security Services)
     rvisscher_at_saball_dot_com

Are you sure that you want to sign this key with your
key "Richard Bejtlich richard_at_taosecurity_dot_com" (752B57C7)

Really sign? (y/N) y

You need a passphrase to unlock the secret key for
user: "Richard Bejtlich richard_at_taosecurity_dot_com"
1024-bit DSA key, ID 752B57C7, created 2005-04-23

Let's say I now want to send Bamm secret2.txt in encrypted form. Does gpg complain after I've signed Bamm's public key?

orr:/home/richard$ gpg -sear "Bamm Visscher" secret2.txt 
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information

You need a passphrase to unlock the secret key for
user: "Richard Bejtlich richard_at_taosecurity_dot_com"
1024-bit DSA key, ID 752B57C7, created 2005-04-23

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   1  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:   1  signed:   0  trust: 1-, 0q, 0n, 0m, 0f, 0u

No problems. If I wanted to upload this signed key to a keyserver, I could use this syntax.

gpg --keyserver [keyserver] --send-key [Key_ID]

I wrote these three blog entries to document how I got GnuPG running and working with Thunderbird. There are many GnuPG tutorials and documents online, and I recommend referencing them for more information. Thanks to Bob for sending a test message.