Set up e-mail encryption
From Sekhet-Maat Lodge
As part of the Key Signing Party at NOTOCON VII, we wanted to provide simple set up instructions for those not yet using encryption.
In this document, we will start with some background about why this is important for O.T.O. activities and what encryption is; but this will only be a very cursory introduction. The primary purpose of this document is to get you up and running so that you can be ready for the key signing party at NOTOCON VII. This document aims to take you through the experience of setting up your e-mail encryption and to will allow the meaning of that experience to be explored later.
At the completion of these instructions, you should have an exported public key which you should immediately attach in an e-mail and send to the security coordinator for NOTOCON via iacchus_teth@sekhetmaat.com so that it can be added to the collection prior to the key signing party.
Why
It is the policy of U.S. Grand Lodge, O.T.O. that all e-mail or files that contain private membership information must be encrypted when exchanged over the Internet:
"Any data which can be used to identify a member (name, address, etc.) cannot be stored on an Internet server or made available through an Internet service; any electronic transmission of confidential information must be encrypted with PGP."
The use of encryption can become an introduction into security culture. This is a topic which this document will not cover, but is worth exploring and understanding. Please check out the references at the end of this document for some beginning steps.
What
Think of encryption as tyling for computers, e-mail and documents. When you want to verify that someone should have access to degree restricted information you can tyle them to check if they are of the degree they say they are. Similarly, public key encryption is a way for identity to be verified by requiring that keys be exchanged before revealing the content of a file or e-mail. Just as tyling allows for some amount of trust and fraternal bond to be assured about degree, so does public key encryption indicate a certain level of trust about the identity of sender and recipient of information. While neither is perfect, given a strong web of trust where people are directly known or can be vouched for by others both can be quite sufficient. Both are best when consistently and confidently used.
You may hear people talking about "encrypting", "signing", "public key", "private key" and other such terms. These possibly unfamiliar terms are in relation to encryption software, especially for files and e-mail that contain personal or sensitive information.
To put it simply, in order to encrypt something for a recipient requires that recipient's public key, which is how one locks the document so that they and only they can read it. So, if one has another person's public key that can be used to lock up documents intended for that person to see, and if that other person has your public key that person can lock documents for you in return.
The process of "signing" a key is a way for one person to vouch for another person's key by adding a note proclaiming that one has trust in a particular key. One typically will sign their own, and have others vouch for their trustworthiness. One can then play six-degrees of separation to find out if an unknown person is trustworthy because that unknown person is trusted by others that one already trusts, and so on.
Setup
For the purposes of this document, we are going to focus on how to encrypt e-mail sent through Google Mail using Firefox and how to encrypt and decrypt files you may get or send through e-mail. Obviously, there are many various ways to use encryption, but we are going to focus on a specific setup on a single machine in order to get you up and running. This document is not a replacement for more advanced documentation or the help of your local computer resource, but it is a very basic document intended only to get you up and running for the first time on a single machine. Anything more advanced than this limited and specific goal is outside the scope of this document.
In the future, as you become more comfortable with the use of encryption, you may find you want to use different tools, multiple machines, and wish to explore the various features of GnuPG and FireGPG; but, for now, let's focus on this setup just for the purpose of sending encrypted e-mail on a single machine through Google Mail using Firefox and how to encrypt and decrypt files that may be sent as attachments.
Consider setting up an e-mail address which you are comfortable having mentioned in public places. For example, if you do not wish your civil name to be connected publicly with your O.T.O. activity, set up an e-mail address for a magical name, baptismal name or motto. By having your O.T.O. key associated with an alias, you can add your public key to key servers, making your key easier to find, without revealing your civil name. In fact, you should consider setting up a separate Gmail account for this alias before continuing.
Don't generate multiple keys. If you're doing this setup on multiple machines, such as both a desktop and a laptop, then you'll simply import your existing key into subsequent installations after the first. You would need to export from one machine and then import to another both private and public keys to do this, and will want to check other documentation for help with that. This document only contemplates helping you get up and running on a single machine.
Install Firefox, Set up Gmail, and install GnuPG
Note: These instructions are for Windows, Mac OS X on Intel and Generic Linux. Special instructions for Mac OS X on PPC are included in a section of its own. More advanced instructions for other Linux installations are outside the scope of this document.
Note: For the following sections, you may find it useful to open the links to downloads in new tabs or new windows. Generally, you can always right click a link and select 'Open in New Window' from the context menu. Also generally you can always, on windows, control-click or scroll-button click a link to open in a new tab. On a mac, command-click or scroll-button click for the same. Also, shift-click will open a link in a new window when using Firefox on any platform. Doing this will open the link without navigating away from these instructions. You may alternatively find it useful to print these instructions out so that you can refer to them on paper, if you are so inclined.
If you are using Mac OS X on PPC skip ahead to #Mac_OS_X_on_PPC. For all others on Windows, Mac OS X on Intel and Generic Linux follow the next two steps, get Firefox and set up Gmail.
Get Firefox
Download and install Firefox from http://www.mozilla.com/en-US/firefox/firefox.html
Set up Gmail
If you do not already have an account at Google Mail that you will be using for this, you will want to set that up now. You can do this by opening your newly installed Firefox browser and browsing to http://mail.google.com/mail/signup
Consider setting up an e-mail address which you are comfortable having mentioned in public places. For example, if you do not wish your civil name to be connected publicly with your O.T.O. activity, set up an e-mail address for a magical name, baptismal name or motto. By having your O.T.O. key associated with an alias, you can add your public key to key servers, making your key easier to find, without revealing your civil name. In fact, you should consider setting up a separate Gmail account for this alias before continuing.
Now, that you have installed Firefox and set up Gmail, you should skip to the section specific to your platform: #Windows, #Mac OS X on Intel. or #Generic Linux. Again, if you are on Mac OX on PPC, you should have already skipped ahead to #Mac_OS_X_on_PPC.
Windows
Get Gpg4win
Step 1 Browse to http://gpg4win.org/download.html and under the heading "Download", click the link anchored with "Gpg4win 1.1.4". Alternatively, you may be able to simply click on this link http://ftp.gpg4win.org/gpg4win-1.1.4.exe to begin the download.
Step 2 Once downloaded, you will see a file on your system, in whatever place you selected in which to download the file. Double-click this icon to start the installer. You may then be presented with a security warning, on which you will click Run to continue.
Step 3 Click Next to continue with the installation wizard.
Step 4 Read the GNU General Public License and rejoice in the freedom this software provides you, clicking Next to continue.
Step 6 Leave all components as selected by default except for the manuals in German, which you may wish to deselect, and click Next to continue.
Step 8 Use the recommended installation location, and click Next to continue.
Step 8 Use the recommended installation options, and click Next to continue.
Step 9 Use the recommended start menu folder name, click Install to continue.
Step 10 When the installation is complete, click Next to continue.
Step 11 If you wish to read the Readme file, leave the box ticked. Either way, click Finish to exit the installation program.
You may now skip ahead in this document to #Install_and_Use_FireGPG
Mac OS X on Intel
Get GnuPG
Download GNU Privacy Guard, GPG Keychain Access, GPGFileTool and GPG Preferences from http://macgpg.sourceforge.net/#files
Step 1 Download GNU Privacy Guard and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GnuPG1.4.9.dmg?download to grab the file.
Step 2 Download GPG Keychain Access and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GPG_Keychain_Access.0.7.0.1.zip?download to grab the file.
Step 3 Download GPG File Tool and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GPGFileTool-1.0.2.tar.gz?download to grab the file.
Step 4 Download GPG Preferences and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GPGPreferences-1.2.2.dmg?download to grab the file.
You may now skip ahead in this document to #Install_and_Use_FireGPG
Generic Linux
Get GnuPG
You should already have this installed as part of your distribution or as a package that you can install. Check to see if you already have GnuPG installed from the command line by checking for the version:
gpg --version
If you do not see the version returned, then you may use your distribution's package manager, such as apt-get or similar, to install the packages. Otherwise, you can go to the GnuPG site itself and download, compile and install.
wget ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.9.tar.gz
tar xvzf gnupg-1.4.9.tar.gz
./configure
make
sudo make install
You may now skip ahead in this document to #Install_and_Use_FireGPG
Install and Use FireGPG
Note: These instructions are for Windows, Mac OS X on Intel and generic Linux. Special instructions for Mac OS X on PPC are included in a section of its own because FireGPG is not available for that platform.
Note: These screenshots for FireGPG tasks are from a Windows machine. The tasks and what you will see are mostly identical to these images.
Now that you have installed Firefox, set up Gmail and installed GnuPG for your platform, you the instructions for Windows, Mac OS X on Intel and generic Linux are all the same as you will be working within Firefox on all these platforms. Again, if you are on Mac OX on PPC, you should have already skipped ahead to #Mac_OS_X_on_PPC.
Get FireGPG
Step 1 Using your installed Firefox web browser, browse to http://getfiregpg.org/install.html and click on the "Download FireGPG" image.
Step 2 Firefox may prevent the software install, click Allow to continue.
Step 3 Click Install Now to continue.
Step 4 Wait for the installation to complete, then click Restart Firefox to continue.
Step 5 You may be presented with a dialog about restoring your tabs and windows when Firefox restarts, click Restart to continue.
Configure FireGPG
If you are using Windows you will probably have to tell FireGPG where to find the GPG program. For both Mac OS X and Linux you can probably skip this step unless FireGPG complains, because the program is installed in a place where the system should find it without needing to specifically tell FireGPG where to look.
Step 1 Start Firefox, and go to Tools > FireGPG > Options.
Step 2 Click on the GPG tab in the Options window.
Step 3 Specify the path where GPG is installed. Especially for Windows, enter the appropriate path for your platform. Remember, if you are on Mac OS X or Linux you can probably skip this step, but if you find that FireGPG complains you can come back to this step.
Windows: You should be able to use C:/Program Files/GnuPG for Windows/gpg
Mac OS X: You should be able to use /usr/local/bin/gpg, but if you need to search use which gpg or locate gpg in a terminal
Linux: You should be able to use /usr/local/bin/gpg, but if you need to search use whereis gpg or locate gpg in a shell
Step 4 Click OK.
Step 5 It is possible that FireGPG will not use this new configuration unless Firefox is restarted, so go ahead and close Firefox now.
Generate Key
Step 1 Start Firefox, and open Tools > FireGPG > Key manager.
Step 2 Click the "New Key" button. (However, don't generate multiple keys. If you're doing this setup on multiple machines, such as both a desktop and a laptop, then you'll simply import your existing key into subsequent installations after the first. If you've already generated a key once, you would want to import that instead of generating a new one here. You would need to export from one machine and then import to another both private and public keys to do this, and will want to check other documentation for help with that. This document only contemplates helping you get up and running on a single machine.)
Step 3 Fill out this dialog with the name and e-mail address you use for O.T.O. correspondence. If you do not associate your civil name with your O.T.O. work, then here is where you would enter your alias name and alias e-mail address.
Step 4 Leave the "Comment" field blank.
Step 5 Select a passphrase that you will remember but that will not be guessed by even someone that knows you well. You may wish to use a random password generator to generate a strong password, but this must be something you will remember. You will need your passphrase every time you encrypt or decrypt files or wish to send or read an encrypted e-mail, so it's very important. Additionally, losing your passphrase means that nothing encrypted with your key can be accessed again. So, I say again this must be something you will remember but must also not be guessed by even someone that knows you well. Type this passphrase into the "Password" field and the same passphrase again in "Repeat password".
Step 6 Do not tick "The key never expires" but do set "Key expires in" to 5 years in the future.
Step 7 Do not tick "Advanced options".
Step 8 Click Generate key, to continue.
Step 9 When the key generation is complete, you will see a dialog which says "Key generated!". Click Ok to continue.
Step 10 You will be returned to the Key manager window, where you will now see your new key.
Note: You should backup your new key pair, including a revocation key. It is a good idea to do so, but that's beyond the scope of this document.
Export your public key
In order for someone else to send you a file or e-mail encrypted for your use, they must have your public key. You can export your key as a file and simply send that file to any contacts with whom you will be exchanging files or e-mail in encrypted form.
Step 1 Start Firefox, and open Tools > FireGPG > Key manager.
Step 2 Click on your key to highlight it.
Step 3 Click the Export to file button to continue.
Step 4 Navigate to some place where you would like to store your keys, or create a new folder.
Step 5 In the File name field, type "email-public.asc" where "email" is the part of your GPG contact e-mail to the left of the @ sign. So, you might type "myotoname-public.asc" or "magicmotto-public.asc" which identifies the file as your exported public key in ASCII format. This file is what people need before they can to send files that are encrypted for you. Click save.
Step 6 On the "Key exported!" dialog, click ok to finish.
At the completion of these instructions, you should have an exported public key which you should immediately attach in an e-mail and send to the security coordinator for NOTOCON via iacchus_teth@sekhetmaat.com so that it can be added to the collection prior to the key signing party.
Import someone else's public key
In order for you to send to someone else a file or e-mail encrypted for their use, you must have their public key. You can import their key from a file they send to you. Simply request that your contacts send their public key file to you.
Step 1 Once you have someone's public key, start Firefox and open Tools > FireGPG > Key manager.
Step 2 Click Import from file to continue. Then, navigate to the place where you saved your contact's public key file and click open.
Step 3 On the "Import successful." dialog, click Ok to finish.
Send encrypted e-mail
Once you have someone else's public key, you can encrypt a file for them. You can also select multiple recipients for a single encrypted message if you are sending to multiple people for whom you have a public key. However, if you do not have all the public keys for the recipients on a single message, encrypting a message would make it unreadable to the recipient for whom the message was not encrypted. Only those people's public keys you select during the encryption process will be able to read the message.
In order to send an encrypted message, compose your message as usual, but then click on the encrypt button.
Decrypt an encrypted message
If someone else has your public key, they will be able to send an entire message or even just a portion of a message which is encrypted for you to decrypt before being able to read it. If the whole message is encrypted, then you can simply click on the button to decrypt the message.
However, if there is a portion of an otherwise unencrypted message, you should see an option to decrypt the encrypted portion of the message.
Encrypt a file
At some point, you will have a file, perhaps a list of members and contact information, which you will want to share with another member or that you need to send to Grand Lodge. This file could be of any type containing information you need to protect, such as a simple text file or a spreadsheet.
In order to send an encrypted file as an attachment, compose your message as usual, but then click on the button to attach an encrypt a file.
Decrypt a file
At some point, you will be sent a file, perhaps a list of members and contact information, which is being shared with you and is encrypted. When you receive a document with an attached file that is encrypted, you need merely click on the decrypt link next to the file in the message.
You will then be asked for the passphrase for your public key and then where you'd like to save the unencrypted file.
Mac OS X on PPC
Note: FireGPG is not available for Mac OS X on PPC. So, instead of using FireGPG and Firefox, you will be doing things quite a bit different than the other examples in this document for all the basic tasks, such as generating your key and sending and receiving encrypted files.
Get GnuPG
Download GNU Privacy Guard, GPG Keychain Access, GPGFileTool and GPG Preferences from http://macgpg.sourceforge.net/#files
Step 1 Download GNU Privacy Guard and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GnuPG1.4.9.dmg?download to grab the file.
Step 2 Download GPG Keychain Access and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GPG_Keychain_Access.0.7.0.1.zip?download to grab the file.
Step 3 Download GPG File Tool and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GPGFileTool-1.0.2.tar.gz?download to grab the file.
Step 4 Download GPG Preferences and install. You may be able to simply click on http://prdownloads.sourceforge.net/macgpg/GPGPreferences-1.2.2.dmg?download to grab the file.
Get GPGMail
Download the GPGMail plugin from http://www.sente.ch/software/GPGMail/English.lproj/GPGMail.html#Download
Step 1 Download GPGMail and install. You may be able to simply click on http://sourceforge.net/project/downloading.php?group_id=222344&filename=GPGMail-1.2.0.dmg to grab the file.
Generate Key
Step 1 When you first start MacGPG, you will be greeted by a dialog indicating that you do not yet have any keys. Click on the Generate button. (However, don't generate multiple keys. If you're doing this setup on multiple machines, such as both a desktop and a laptop, then you'll simply import your existing key into subsequent installations after the first. If you've already generated a key once, you would want to import that instead of generating a new one here.You would need to export from one machine and then import to another both private and public keys to do this, and will want to check other documentation for help with that. This document only contemplates helping you get up and running on a single machine.)
Step 2 Tick use the assistant to generate keys, and click continue
Step 3 Select DSA and ElGamal, and click continue
Step 4 Select 2048 for your key size, and click continue
Step 5 Tick key has expiration date, and set the date to 5 years in the future. Click continue.
Step 6 Type in the name and e-mail address you use for O.T.O. correspondence. If you do not associate your civil name with your O.T.O. work, then here is where you would enter your alias name and alias e-mail address. Click Continue.
Step 7 Select a passphrase that you will remember but that will not be guessed by even someone that knows you well. You may wish to use a random password generator to generate a strong password, but this must be something you will remember. You will need your passphrase every time you encrypt or decrypt files or wish to send or read an encrypted e-mail, so it's very important. Additionally, losing your passphrase means that nothing encrypted with your key can be accessed again. So, I say again this must be something you will remember but must also not be guessed by even someone that knows you well.
Step 8 Confirm that your selections are correct, going back to make changes if necessary. Click continue.
Step 9 GnuPG will now generate your key. You should use your machine to watch a movie or do some other activity as that actually helps the key generation process create more randomness. This process can take some time, so pick a movie or activity you will enjoy. When the key generation is complete, click finish.
Step 10 Open GPG Keychain Access, and you will see your new key.
Step 11 Start Firefox and verify that FireGPG has automatically found your new key by going to Tools > FireGPG > Key Manager. You should see your new key in the list.
Note: You should backup your new key pair, including a revocation key. It is a good idea to do so, but that's beyond the scope of this document.
Export your public key
In order for someone else to send you a file or e-mail encrypted for your use, they must have your public key. You can export your key as a file and simply send that file to any contacts with whom you will be exchanging files or e-mail in encrypted form.
Step 1 Open GPG Keychain Access, select your public key. Click export.
Step 2 Tick ASCII armored, and change the file name to "email-public.asc" where "email" is the part of your GPG contact e-mail to the left of the @ sign. Click save.
Step 3 You can now attach the file you just saved as "email-public.asc" to an unencrypted e-mail sent to anyone else you wish to have send encrypted files to you. They will import your public key and use it to send e-mail or files that are encrypted specifically for you.
At the completion of these instructions, you should have an exported public key which you should immediately attach in an e-mail and send to the security coordinator for NOTOCON via iacchus_teth@sekhetmaat.com so that it can be added to the collection prior to the key signing party.
Import someone else's public key
In order for you to send to someone else a file or e-mail encrypted for their use, you must have their public key. You can import their key from a file they send to you. Simply request that your contacts send their public key file to you.
Step 1 Once you have someone's public key, open GPG Keychain Access and click Import. Then, navigate to the place where you saved your contact's public key file and click open.
Configure Apple Mail to use Google Mail
Step 1 Open up Mail.app and press Command+Comma to invoke the Preferences window.
Step 2 Switch to the "Accounts" pane and press the + button in the lower-left corner.
Step 3 Under "Account Information", fill out the following information:
Account Type: POP
Email Address: username@gmail.com
Incoming Mail Server: pop.gmail.com
Username: username@gmail.com
Password: password
Step 4 Select "Add Server..." from the "Outgoing Mail Server (SMTP)" pop-up menu. Here are the details for it:
Outgoing Mail Server: smtp.gmail.com
Server port: 465 or 587
Use Secure Sockets Layer (SSL): Yes
Authentication: Password
User Name: username@gmail.com
Password: password
Step 5 Dismiss the window by pressing "OK."
Step 6 Back in the "Accounts" pane, switch to the "Advanced" tab and check the box marked "Use SSL" towards the bottom.
Step 7 The rest of the process is short and sweet, and merely involves changing your Gmail preferences to enable POP access.
Configure Google Mail to allow POP access
Step 1 Sign in to Gmail.
Step 2 Click Settings at the top of any Gmail page.
Step 3 Click Forwarding and POP/IMAP.
Step 4 Select Enable POP for all mail or Enable POP for mail that arrives from now on.
Step 5 Choose the action you'd like your Gmail messages to take after they are accessed with POP.
Step 6 Click Save Changes.
Send encrypted e-mail
Once you have someone else's public key, you can encrypt a file for them. You can also select multiple recipients for a single encrypted message if you are sending to multiple people for whom you have a public key. However, if you do not have all the public keys for the recipients on a single message, encrypting a message would make it unreadable to the recipient for whom the message was not encrypted. Only those people's public keys you select during the encryption process will be able to read the message.
In order to send an encrypted message, compose your message as usual, but then tick the option to encrypt the message.
Decrypt an encrypted message
If someone else has your public key, they will be able to send an entire message or even just a portion of a message which is encrypted for you to decrypt before being able to read it. You can simply click on the button to decrypt the message.
Encrypt a file
At some point, you will have a file, perhaps a list of members and contact information, which you will want to share with another memeber or that you need to send to Grand Lodge. This file could be of any type containing information you need to protect, such as a simple text file or a spreadsheet.
Step 1 Start GPGFileTool, and select File > Open navigating to the file you wish to encrypt; or, you could drag and drop a file to GPGFileTool directly. Tick ASCII armored, and click do it.
Step 2 Select which recipients you wish to have access to this file, one or more. Click ok.
Step 3 Select which key you wish to use to encrypt, and click ok.
Step 4 Enter your GPG passphrase, and click ok.
Step 5 In the Save dialog, you have the option to change the file name, or just click ok.
Step 6 You will be prompted to use the extension ".gpg" for the encrypted file. Click use both.
Step 7 You will then see your newly encrypted file with the double extension. This is the file you will send to your selected recipients.
Decrypt a file
At some point, you will be sent a file, perhaps a list of members and contact information, which is being shared with you and is encrypted.
Step 1 Start GPGFileTool, and select File > Open navigating to the file you wish to encrypt; or, you could drag and drop a file to GPGFileTool directly. Decrypt will already be selected for you, click do it.
Step 2 Enter your GPG passphrase, and click ok.
Step 3 In the Save dialog, you have the option to change the destination file name, or just click ok.
Step 4 You will now have the encrypted file and a decrypted version you can read using whatever application is appropriate, such as a text editor or spreadsheet application.
References
- Why do you need PGP by Phillip Zimmerman
- http://www.pgpi.org/doc/whypgp/en/
- Beginner's Guide to GnuPG
- http://www.queen.clara.net/pgp/art3.html
- Daily use of GnuPG
- http://www.gnupg.org/gph/en/manual/c481.html
- The GNU Privacy Guard
- http://www.gnupg.org/
- Key Signing Party
- http://en.wikipedia.org/wiki/Key_signing_party
- http://cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html
- http://linuxreviews.org/howtos/gnupg/signingparty/
- Security Culture
- http://www.why-war.com/guides/2003/09/security.html
- http://security.resist.ca/personal/culture.shtml
- http://shiftshapers.gnn.tv/blogs/10549/Security_Culture
- Browsing more safely
- https://www.torproject.org/
- http://www.instructables.com/id/Go-Online-without-Getting-Snooped-Tor-The-Onion-/
- Windows & Linux Setup
- http://nukeit.org/gmail-gnu-privacy-guard-gpg-and-firefox-windows-and-linux-howto/
- Linux Setup
- http://www.madboa.com/geek/gpg-quickstart/
- Mac OS X Setup
- http://www.instructables.com/id/Encrypt-your-Gmail-Email/
- http://fiatlux.zeitform.info/en/instructions/pgp_macosx.html
- http://db.tidbits.com/article/10253
- Mac OS X Mail.app
- http://email.about.com/od/macosxmailtips/qt/et_gmailosxmail.htm
- Gmail Enabling POP
- http://gmail.google.com/support/bin/answer.py?answer=13273
