TweetFollow Us on Twitter

Securing Mail with GPG

Volume Number: 21 (2005)
Issue Number: 8
Column Tag: Programming

Securing Mail with GPG

by Emmanuel Stein

A Graphical Tutorial

Why Use Encryption at All?

Some people think that if they are not doing anything wrong or illegal, they do not need to encrypt their messages. The problem with this argument is that it assumes that one is trying to protect a message from some government authority or law enforcement apparatus and ignores the very real risks associated with theft of intellectual property via corporate espionage. The fact is, that almost anyone with a bit of networking knowledge can easily “sniff” your message off the network and not only read it, but re-write it and send it along to the intended recipient without you ever being aware (this is called the “man in the middle attack”). Using GPG, you can thwart these would-be crackers and do so transparently by using GPG to encrypt your mail messages.

GPG in a Nutshell:

GPG employs public key, as well as symmetric key cryptography, to perform its magic. When setting up GPG you have several options for generating your keys. The default option uses DSA to generate your primary keypair for signing, and then generates a second (also called subordinate) keypair that uses ElGamal for encryption.

Although we are using the more sophisticated primary and subordinate designations to explain what gets generated in GPG, both the primary and subordinate keychains are usually, for practical purposes, thought of as a single keychain. In this scheme, you have a public and a private key. Your private key is secret and should be treated as such. Take precautions, and do not lose it as you will have to regenerate the key and will not be able to read mail encrypted with your original public key. You do, however, have the ability to revoke a key that is compromised. Unlike your private key, your public key should be widely distributed, allowing others to send you an encrypted message that only you can decrypt with your private key.

GPG uses the same approach to key management as PGP, which is to say via a “web of trust.” Rather than employing a centralized certification authority such as Verisign, GPG allows individual users to act as their own certification authority. There is an infrastructure in place for the GPG community of well-maintained keyservers that facilitate exchange of public keys among users.

GPG and Apple Mail: Two Great Tastes That Go Great Together!

For this tutorial, we will focus on enabling GPG in Apple Mail 2.0 using the GPGMail plug-in. Links to sites where one can obtain GPG mail extensions for other popular mail clients will also be included.

How GPG-Enabled Mail Works?

Before we dive into setting up mail for GPG, I will take a moment to review how GPG works in the context of email communications. When you want to send an encrypted message to a colleague or friend, you encrypt the message using their public key, which may be obtained directly from that individual or via a keyserver. The recipient then will decrypt your message using their private key. Signing is also an important part of GPG-enabled mail communications, and involves using your private key to create a digital signature that guarantees to your recipient that the message came from you and has not been tampered with.

GPG Install How-To

What you need:

Go to http://macgpg.sourceforge.net/ and download the following required applications:

  • Gnu Privacy Guard (aka GPG)
  • GPG Keychain Access

We will not be covering the excellent suite of file utilities also available at this site. Nonetheless, you are encouraged to explore these binaries at your leisure, as they may prove extremely useful for non-mail GPG operations.

In order to enable GPG in Apple Mail, you will also need to obtain the GPGMail application at http://www.sente.ch/software/GPGMail/English.lproj/GPGMail.html">.

If you are a security conscious person, and are deploying this package for a mission critical application, then you may want to check each packages authenticity via its MD5 checksum using the openssl command in the terminal.

Installing Gnu Privacy Guard

Double click on the GnuPG .dmg file in order to mount the contents of the archive. To install GPG, double click on the GPG .mpkg file to invoke the installer.

Once GPG has installed successfully, we will need to generate our keypair. To simplify the process, we will use the GPG Keychain Access application rather than the terminal. This application is modeled after the intuitive Keychain application in OS X and is very easy to use. Simply unzip the folder called GPG Keychain Access and drag it into the Applications folder.

To generate your keypair, open the GPG Keychain Access application. The application will notify you that you do not yet have a keypair and offers you the option to generate one (Figure 1). Also, this dialog gives you the option to import your secret key. This is useful when you want to configure a second computer with GPG. Your private or secret key will be created in your home folder under the hidden .gnupg directory.


Figure 1. Keypair Generation and Import Dialog

To create a new keypair, select the Generate option in the dialog (Figure 1) to invoke the install wizard. You will be given several options for generating a key (Figure 2). It is recommended that you select the default option, DSA and ElGamal as it offers the most flexibility and is required for use with mail since the other options only allow for signing and not encrypting.


Figure 2. Key Generation Wizard: Algorithm Selection

Once you have selected your algorithms (basically the functions used to scramble and de-scramble your data), you will be asked to choose a key-length. The general rule is, the longer the better. Without getting into the details of encryption math, the security of your key increases exponentially with key length. The only potential down side to a longer key is the additional time it takes to generate and to perform its encryption operations. Nevertheless, with a Mac of recent vintage you should not notice more than a minimal lag when performing any GPG operations like encryption and decryption, even using the longest available key.

Following the selection of a key length, you will be presented with the option of specifying an expiration date. While this may be useful in some environments, it is rather limiting and therefore not recommended unless you have a specific need.

Next you will be asked to provide your identification data such as Name, Email Address and an optional comment. It is good form to use your real name as you are taking the responsibility of a self-certifying authority. So be honest.

You will then be prompted for the passphrase to protect your private key. Check over your configuration options, and correct them via the Go Back button, or simply press Continue to generate your keypair. A lengthy keypair may take 30 minutes or more to generate, so a coffee break may be in order.

When your keypair generation has completed, you will see you new public key in the GPG Keychain Access Application (Figure 3). You can see the sub-key we spoke of earlier, by clicking on the disclosure triangle.


Figure 3. View of Sub-Keys Using the Disclosure Triangle

To install the GPG Preference Pane, select the Preferences option in the Application Menu. Click yes in the dialog box that pops up (Figure 4).


Figure 4. “GPG Preference Pane Not Installed” Dialog

The GPG Preferences installer will then walk you through the installation of the GPG System preference pane (Figure 5).


Figure 5. GnuPG Preferences Installer Invoked via the GPG Keychain Access Application

Once the GPG preference pane has successfully installed, fire up the System Preferences application and click on the GPG Preference pane to explore the various configuration options. When you first open the GPG preference pane, you will be asked to choose UTF-8 for string encoding (Figure 6). Select the default Please Do option to ensure proper GPG operations.


Figure 6. GnuPG Preferences Pane and UTF String Encoding Dialog

You may use this preference pane to customize GPG. Don’t let all these available options overwhelm you, though, and keep in mind that the defaults are fine for most folks.

Managing your GPG Keychain

GPG relies on a centralized key management system of keyservers. Upload your public key to a GPG keyserver (private key not accepted!) to enable others to send you encrypted messages.

In the GPG Keychain Access application, click on your public key to highlight it and then select Key > Send to keyserver (Figure 7).


Figure 7. Send To Key Server Menu Option

Upon selection of this option, a terminal window will pop up and automatically run the terminal commands for sending the key to a keyserver for you (Figure 8).


Figure 8. Invoked Terminal Session: Sending Public Key to a Keyserver

Now that you have made you public key available to others, you will need to download your correspondent’s public keys using the GPG Keychain Access application. You can also download public keys via the mail interface, which will be covered in the next section.

Click Key > Search for Key (Figure 9).


Figure 9. Search For Public Key Menu Option

You will be prompted to enter a search parameter (Figure 10), which is typically your friend’s email address.


Figure 10. Search For Public Key Dialog

Once you have entered the email address and clicked on the OK button, a new terminal will appear and automatically execute the required GPG command. If your search turns up a public key, you will be prompted to download it to your GPG keychain. This step will require you to select the public key(s) for download, from within the terminal. In the illustrated example (Figure 11), we see Ed Marczak’s public key associated with the email address we used in the search field. Once you make your selection, you will see output in the terminal confirming the download (Figure 11).


Figure 11. Invoked terminal Session: Downloading Ed’s Public Key

To view the newly imported public key in the GPG Keychain Access application, go to Window > Refresh.

Once you have uploaded you public key to the GPG keyservers and downloaded your correspondent’s public key(s), you are ready to install GPGmail plug-in for Apple Mail.

Apple Mail With a Side of GPG(Mail)

Double-Click on the GPGMail .dmg file to reveal the mail bundle and install script. If Apple Mail is open, be sure to quit the application before continuing. Proceed by double-clicking on the Install GPGMail AppleScript and click Run in the dialog that pops up. Once the installer finishes, a dialog box will appear. Click on the Launch Mail to start the Apple Mail.

To configure your GPG mail preferences simply go to Mail > preferences > PGP (PGP and GPG are often used interchangeably by the application’s developer) shown in Figure 12.


Figure 12. GPGMail Preference Pane

The default configuration should get you started, although, as you use the GPG mail bundle you may want to change several parameters to suit your use of encryption.

Changes to the Mail Interface

Once you install GPGMail for Apple Mail, you will notice three new menu items. These include GPG Keys under the View menu, which control the display of GPG attributes in Mail. (Figure 13)


Figure 13. PGP Keys submenu in the View Menu

The second menu addition, PGP is located in the Message menu. This submenu can be used to access common GPG operations as detailed in Figure 14.


Figure 14. PGP Submenu in the Message Menu

A final added menu items is the PGP Key Search function in the Window menu, which lets you search and download public keys. This tool also pops up when you attempt to encrypt a message and send it to a recipient for whom you have not yet downloaded a public key (Figure 15).


Figure 15. PGP Key Search Menu Option and Accompanying Dialog

The results will be returned in a PGP Key Search dialog box, from which you will be able to download the required key (Figure 16).


Figure 16. Downloading a Public Key in the PGP Key Search Dialog

The public keys that you download using PGP Key Search will be available globally to all GPG key management interfaces, such as the GPG Keychain Access application.

One of the most obvious changes to the mail interface is the addition of checkboxes (Figure 17) for signing and encrypting that appear in each new message window.


Figure 17. Check Boxes for Signing and Encrypting in an Apple Mail Message Window

When sending an encrypted mail, by default, the message will be encrypted with the public key of the recipient. However, you can explore the encryption options in the Keys drop down menu next to the Encrypted checkbox to generate, for instance, a message password, which uses symmetric key encryption to scramble the message and for which the recipient must know the password.

Although, I encourage you to explore all the available options, you can effectively use GPG without ever having to touch the drop-down menu or GPGMail preference pane. Just use the checkboxes, to sign and/or encrypt your communications as needed. By default, GPGMail automatically turns on the signing and also turns on encryption when it detects a recipient whose public key is in your keychain.

When you send an encrypted mail, you will be prompted for your passphrase, created during the generation of your keypair. Once it is entered, (Figure 18) your message will be encrypted and then sent.


Figure 18. Message Encryption

When you receive an encrypted message, press the decrypt button in the message window (Figure 19). You will be prompted to enter your passphrase in order to decipher the message contents.


Figure 19. Message Decryption

Notice that in Figure 20, the disclosure triangle has been expanded to display the time and date when the message was either signed or both signed and encrypted. You may use the signing information to verify the authenticity of the message.


Figure 20. Decrypted Message Contents

GPGing Other Mail Clients

Although we have focused on Apple Mail 2.0 for Tiger, there are several good mail client extensions available for popular Mac mail clients. Please find the URLs listed below:

Final Thoughts

The right to privacy has come a long way since 1991, when PGP was first released. With the nation in the midst of the first Gulf War, government attempts to curtail privacy and free speech threatened to suppress emerging mass encryption technologies like PGP. In fact, the Senate passed the omnibus anti crime bill (S.266) in 1991, which effectively banned the use of high-grade public key cryptography altogether!

Only through the efforts of the brave few who leaked PGP onto the Internet in 1991, partly in protest of the Senate bill banning the use of strong cryptography, did government attempts to stifle innovation and invade personal privacy become moot. So, next time you send an encrypted message (or use Apple’s FileVault for that matter), tip your hat “to the crazy ones, the misfits, the rebels, the trouble makers, the round pegs in the square holes, the ones who see things different. They are not fond of rules and have no respect for the status quo, because the people who are crazy enough to think they can change the world are the ones who actually do.” -Apple Corp., 1999


Emmanuel Stein has been an avid Mac user since 1984. He honed his cross-platform skills while working at France Telecom, Time Magazine and Reed-Elsevier. He recently started his own Mac-centric consulting company, MacVerse, which offers secure network deployments, system administration, and development services for the enterprise. A diehard Linux fan from the early days, Emmanuel enjoys hacking open source software on the Macintosh and giving lectures on the use of open source technologies on OS X. You can reach him at macverse@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

GraphicConverter 10.5.4 - $39.95
GraphicConverter is an all-purpose image-editing program that can import 200 different graphic-based formats, edit the image, and export it to any of 80 available file formats. The high-end editing... Read more
Dash 4.1.3 - Instant search and offline...
Dash is an API documentation browser and code snippet manager. Dash helps you store snippets of code, as well as instantly search and browse documentation for almost any API you might use (for a full... Read more
Microsoft OneNote 16.9 - Free digital no...
OneNote is your very own digital notebook. With OneNote, you can capture that flash of genius, that moment of inspiration, or that list of errands that's too important to forget. Whether you're at... Read more
DEVONthink Pro 2.9.17 - Knowledge base,...
Save 10% with our exclusive coupon code: MACUPDATE10 DEVONthink Pro is your essential assistant for today's world, where almost everything is digital. From shopping receipts to important research... Read more
OmniGraffle 7.6 - Create diagrams, flow...
OmniGraffle helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use Graffle to... Read more
iFinance 4.3.7 - Comprehensively manage...
iFinance allows you to keep track of your income and spending -- from your lunchbreak coffee to your new car -- in the most convenient and fastest way. Clearly arranged transaction lists of all your... Read more
Opera 50.0.2762.58 - High-performance We...
Opera is a fast and secure browser trusted by millions of users. With the intuitive interface, Speed Dial and visual bookmarks for organizing favorite sites, news feature with fresh, relevant content... Read more
Microsoft Office 2016 16.9 - Popular pro...
Microsoft Office 2016 - Unmistakably Office, designed for Mac. The new versions of Word, Excel, PowerPoint, Outlook and OneNote provide the best of both worlds for Mac users - the familiar Office... Read more
SoftRAID 5.6.4 - High-quality RAID manag...
SoftRAID allows you to create and manage disk arrays to increase performance and reliability. SoftRAID allows the user to create and manage RAID 4 and 5 volumes, RAID 1+0, and RAID 1 (Mirror) and... Read more
OmniGraffle Pro 7.6 - Create diagrams, f...
OmniGraffle Pro helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use... Read more

Latest Forum Discussions

See All

Around the Empire: What have you missed...
Around this time every week we're going to have a look at the comings and goings on the other sites in Steel Media's pocket-gaming empire. We'll round up the very best content you might have missed, so you're always going to be up to date with the... | Read more »
The 7 best games that came out for iPhon...
Well, it's that time of the week. You know what I mean. You know exactly what I mean. It's the time of the week when we take a look at the best games that have landed on the App Store over the past seven days. And there are some real doozies here... | Read more »
Popular MMO Strategy game Lords Mobile i...
Delve into the crowded halls of the Play Store and you’ll find mobile fantasy strategy MMOs-a-plenty. One that’s kicking off the new year in style however is IGG’s Lords Mobile, which has beaten out the fierce competition to receive Google Play’s... | Read more »
Blocky Racing is a funky and fresh new k...
Blocky Racing has zoomed onto the App Store and Google Play this week, bringing with it plenty of classic kart racing shenanigans that will take you straight back to your childhood. If you’ve found yourself hooked on games like Mario Kart or Crash... | Read more »
Cytus II (Games)
Cytus II 1.0.1 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0.1 (iTunes) Description: "Cytus II" is a music rhythm game created by Rayark Games. It's our fourth rhythm game title, following the footsteps of three... | Read more »
JYDGE (Games)
JYDGE 1.0.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0.0 (iTunes) Description: Build your JYDGE. Enter Edenbyrg. Get out alive. JYDGE is a lawful but awful roguehate top-down shooter where you get to build your... | Read more »
Tako Bubble guide - Tips and Tricks to S...
Tako Bubble is a pretty simple and fun puzzler, but the game can get downright devious with its puzzle design. If you insist on not paying for the game and want to manage your lives appropriately, check out these tips so you can avoid getting... | Read more »
Everything about Hero Academy 2 - The co...
It's fair to say we've spent a good deal of time on Hero Academy 2. So much so, that we think we're probably in a really good place to give you some advice about how to get the most out of the game. And in this guide, that's exactly what you're... | Read more »
Everything about Hero Academy 2: Part 3...
In the third part of our Hero Academy 2 guide we're going to take a look at the different modes you can play in the game. We'll explain what you need to do in each of them, and tell you why it's important that you do. [Read more] | Read more »
Everything about Hero Academy 2: Part 2...
In this second part of our guide to Hero Academy 2, we're going to have a look at the different card types that you're going to be using in the game. We'll split them up into different sections too, to make sure you're getting the most information... | Read more »

Price Scanner via MacPrices.net

Apple restocked Certified Refurbished 13″ Mac...
Apple has restocked a full line of Certified Refurbished 2017 13″ MacBook Airs starting at $849. An Apple one-year warranty is included with each MacBook, and shipping is free: – 13″ 1.8GHz/8GB/128GB... Read more
How to find the lowest prices on 2017 Apple M...
Apple has Certified Refurbished 13″ and 15″ 2017 MacBook Pros available for $200 to $420 off the cost of new models. Apple’s refurbished prices are the lowest available for each model from any... Read more
The lowest prices anywhere on Apple 12″ MacBo...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more
Apple now offering a full line of Certified R...
Apple is now offering Certified Refurbished 2017 10″ and 12″ iPad Pros for $100-$190 off MSRP, depending on the model. An Apple one-year warranty is included with each model, and shipping is free: –... Read more
27″ iMacs on sale for $100-$130 off MSRP, pay...
B&H Photo has 27″ iMacs on sale for $100-$130 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 27″ 3.8GHz iMac (MNED2LL/A): $2199 $100 off MSRP – 27″ 3.... Read more
2.8GHz Mac mini on sale for $899, $100 off MS...
B&H Photo has the 2.8GHz Mac mini (model number MGEQ2LL/A) on sale for $899 including free shipping plus NY & NJ sales tax only. Their price is $100 off MSRP. Read more
Apple offers Certified Refurbished iPad minis...
Apple has Certified Refurbished 128GB iPad minis available today for $339 including free shipping. Apple’s standard one-year warranty is included. Their price is $60 off MSRP. Read more
Amazon offers 13″ 256GB MacBook Air for $1049...
Amazon has the 13″ 1.8GHz/256B #Apple #MacBook Air on sale today for $150 off MSRP including free shipping: – 13″ 1.8GHz/256GB MacBook Air (MQD42LL/A): $1049.99, $150 off MSRP Read more
9.7-inch 2017 WiFi iPads on sale starting at...
B&H Photo has 9.7″ 2017 WiFi #Apple #iPads on sale for $30 off MSRP for a limited time. Shipping is free, and pay sales tax in NY & NJ only: – 32GB iPad WiFi: $299, $30 off – 128GB iPad WiFi... Read more
Wednesday deal: 13″ MacBook Pros for $100-$15...
B&H Photo has 13″ #Apple #MacBook Pros on sale for up to $100-$150 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 13-inch 2.3GHz/128GB Space Gray... Read more

Jobs Board

*Apple* Store Leader - Retail District Manag...
Job Description: Job Summary As more and more people discover Apple , they visit our retail stores seeking ways to incorporate our products into their lives. It's Read more
Sr. Experience Designer, Today at *Apple* -...
# Sr. Experience Designer, Today at Apple Job Number: 56495251 Santa Clara Valley, California, United States Posted: 18-Jan-2018 Weekly Hours: 40.00 **Job Summary** Read more
Security Applications Engineer, *Apple* Ret...
# Security Applications Engineer, Apple Retail Job Number: 113237456 Santa Clara Valley, California, United States Posted: 17-Jan-2018 Weekly Hours: 40.00 **Job Read more
*Apple* Solutions Consultant - Apple (United...
# Apple Solutions Consultant Job Number: 113384559 Brandon, Florida, United States Posted: 10-Jan-2018 Weekly Hours: 40.00 **Job Summary** Are you passionate about Read more
Art Director, *Apple* Music + Beats1 Market...
# Art Director, Apple Music + Beats1 Marketing Design Job Number: 113258081 Santa Clara Valley, California, United States Posted: 05-Jan-2018 Weekly Hours: 40.00 Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.