GPA on Cebulka Blog

PGP compendium - Encryption and popular PGP tools use guides (2024)

Sat, 17 Aug 2024 12:07:00 +0000

A collection of guides for the popular PGP tools: GPG4USB (Linux & Windows), GPA (Linux), Kleopatra (Linux & Windows), GPGSuite (macOS), OpenKeyChain (Android) and PGPro (iOS).

What is PGP / OpenPGP #

GnuPG (GPG, GNU Privacy Guard) is an open-source encryption software for secure End-to-End communication between two parties. It enables users to communicate securely by providing tools to encrypt and decrypt messages using the OpenPGP (Open Pretty Good Privacy) non-proprietary standard.

OpenPGP uses public key cryptography. To use OpenPGP, you must first generate a pair — public and private keys using GPG software. You can then share your public key with others, keeping your private key secret. Anyone who has the public key can use it to encrypt and verify information that only the holder of the private key can decrypt and sign.

Installation and configuration #

The basic GPG program runs from the command line but there are various front-ends such as GPG4USB, graphical interfaces for different operating systems. The portable GPG4USB program is cross-platform and easy to use but is no longer developed and has an outdated version of GPG. The GNU Privacy Assistant (GPA) tool is available on the Whonix-Workstation system. The Tails system as of version 5.0 has the Kleopatra tool, also known from the Gpg4win package for Windows systems.

Installation of GPG4USB (Linux & Windows)
Installation of GNU Privacy Assistant (Linux)
Installation of Kleopatra (Linux)
Installation of Kleopatra (Windows)
Installation of GPG Suite (macOS)
Installation of OpenKeychain (Android)
Installation of PGPro (iOS)

Key generation #

The user generates a pair of keys, a public key and a private key. The public key is shared with others, while the private key is kept secret. Private key is stored in GPG program files, so it is recommended to encrypt the operating system.

Key generation in GPG4USB (Linux & Windows)
Key generation in GNU Privacy Assistant (Linux)
Key generation in Kleopatra (Linux)
Key generation in Kleopatra (Windows)
Key generation in GPG Suite (macOS)
Key generation in OpenKeychain (Android)
Key generation in PGPro (iOS)

Private key backup #

A backup copy of the private key should be encrypted with VeraCrypt or TrueCrypt and placed on external media for protection against data loss.

Private key backup in GPG4USB (Linux & Windows)
Private key backup in GNU Privacy Assistant (Linux)
Private key backup in Kleopatra (Linux)
Private key backup in Kleopatra (Windows)
Private key backup in GPG Suite (macOS)
Private key backup in OpenKeychain (Android)
Private key backup in PGPro (iOS)

Importing public keys #

Import public keys of other users for encrypting messages and verifying digital signatures.

Importing public keys in GPG4USB (Linux & Windows)
Importing public keys in GNU Privacy Assistant (Linux)
Importing public keys in Kleopatra (Linux)
Importing public keys in Kleopatra (Windows)
Importing public keys inGPG Suite (macOS)
Importing public keys in OpenKeychain (Android)
Importing public keys in PGPro (iOS)

Message encryption #

The sender uses the recipient’s public key to encrypt the message. This ensures that only the intended recipient can decrypt it.

Message encryption in GPG4USB (Linux & Windows)
Message encryption in GNU Privacy Assistant (Linux)
Message encryption in Kleopatra (Linux)
Message encryption in Kleopatra (Windows)
Message encryption in GPG Suite (macOS)
Message encryption in OpenKeychain (Android)
Message encryption in PGPro (iOS)

Message decryption #

The recipient uses his private key to decrypt the encrypted message. By quoting a sufficient part of it in the reply, also confirms that has access to the private key.

Message decryption in GPG4USB (Linux & Windows)
Message decryption in GNU Privacy Assistant (Linux)
Message decryption in Kleopatra (Linux)
Message decryption in Kleopatra (Windows)
Message decryption in GPG Suite (macOS)
Message decryption in OpenKeychain (Android)
Message decryption in PGPro (iOS)

Signing messages #

The sender can use his private key to digitally sign the message. The signature acts as proof that the message was written by the key owner.

Signing messages in GPG4USB (Linux & Windows)
Signing messages in GNU Privacy Assistant (Linux)
Signing messages in Kleopatra (Linux)
Signing messages in Kleopatra (Windows)
Signing messages in GPG Suite (macOS)
Signing messages in OpenKeychain (Android)
Signing messages in PGPro (iOS)

Verifying messages #

After receiving a signed message, the recipient can use the sender’s public key to verify the digital signature of the message. A valid signature proves that the message was sent by the sender and has not been altered. The slightest change in the original message, even by one character, will cause the verification process to fail.

Verifying messages in GPG4USB (Linux & Windows)
Verifying messages in GNU Privacy Assistant (Linux)
Verifying messages in Kleopatra (Linux)
Verifying messages in Kleopatra (Windows)
Verifying messages in GPG Suite (macOS)
Verifying messages in OpenKeychain (Android)
Verifying messages in PGPro (iOS)

Troubleshooting

GnuPG version update in GPG4USB

Gnu Privacy Assistant for Linux installation and operation guide

Sat, 17 Aug 2024 12:01:00 +0000

GNU Privacy Assistant is a user-friendly interface for managing PGP encryption and PGP signatures. This guide describes how to install and use GNU Privacy Assistant on Linux.

GNU Privacy Assistant on Whonix-Workstation #

The GNU Privacy Assistant tool is installed by default on Whonix-Workstation and no manual installation of the GPG program is required on this system.

For Whonix-Workstation on VirtualBox, search for GNU Privacy Assistant in the menu and click to run.
In Qubes OS, for a created app qube from the whonix-workstation-17 template (for example: default anon-whonix) select gpa in the list of All available applications in the Settings→Applications menu, click > to move the program to the list of Applications shown in App Menu and confirm the changes by clicking OK. A shortcut to the GPA / GNU Privacy Assistant program will be visible in the Qubes system menu for the selected app qube.

Installation of GNU Privacy Assistant with APT (Debian, Ubuntu & Kali Linux) #

For Debian and Ubuntu distributions, in the command console, perform the installation of the GPA package:
```
user@host:~$ sudo apt-get update
user@host:~$ sudo apt-get -y install gpa
```
We can launch the GPA via a shortcut in the application menu or a command:
```
user@host:~$ gpa
```

Installation of GNU Privacy Assistant with Flatpak (other Linux) #

Flatpak utility is installed by default in many recent Linux distributions. If the flatpak command is not available in the console, install Flatpak as instructed for the chosen distribution.

We add the Flathub repository and install package org.gnupg.GPA with commands:

sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
sudo flatpak install -y flathub org.gnupg.GPA

We can launch the GPA via a shortcut in the application menu or a command:
```
user@host:~$ gpa
```

Key generation in GNU Privacy Assistant #

In the pop-up window we click Do it later. We open the window for changing settings from the Edit menu by selecting the Preferences option. In the new window we select Use advanced mode option and click OK.

From the Keys menu, select New key…. In the Name field we enter the nickname we will use on the forum. In the Email field we give the darknet email if we have one, the field can be omitted. The comment field can be omitted. Change the key size in the Key size field to 3072 and click OK.

Enter the secure password twice and click OK.

GNU Privacy Assistant does not allow the creation of keys larger than 3072 bits. However, the unofficial standard of 4096-bit PGP keys adopted in the darknet has no basis in any official recommendations, and the highest recommended value by organizations such as ECRYPT-CSA (2018) and NSA (2016) for the RSA algorithm are the mentioned 3072 bits.

Private key backup in GNU Privacy Assistant #

Right click on the desired key from the list and select option Backup….

We point to the secure location, make sure that in the file name the default path ( e.g. /home/user/.gnupg/ … for Linux systems) does not appear. We click Save, enter the password we set when generating the key and confirm by clicking OK.

We close the window with information about successful export. The file … .asc is a text file that contains both the private key block -----BEGIN PGP PRIVATE KEY BLOCK----- … and the public key block -----BEGIN PGP PUBLIC KEY BLOCK----- …, which can be imported into another GPG program in the same way public keys are imported.

A backup copy of the private key should be encrypted with VeraCrypt or TrueCrypt and placed on external media for protection against data loss.

Importing public keys in GNU Privacy Assistant #

Before encrypting a message, we must have the recipient’s public key. We can get the public key in an email message, in a private message on the forum or from a user profile.

We import the previously copied public key by selecting the Paste option from the Edit menu. We close the window with information about successful export.

The GPA program implements the WOT ( Web Of Trust ) model, so it relies on having other trusted public keys whose owners sign the PGP keys of other users confirming their correctness. To dispense with the attribution of mistrust of the imported PGP key and its owner’s signatures, right click on the imported public key and from the context menu option select Sign keys…. In the new window we select Sign only locally, confirm by clicking Yes and enter the password we set when generating the key.

We should make sure that the public key comes from a reliable source and the key fingerprint ( 0F3F1 DE0E0 75DE9 … in the above example ) is correct. A public key with the same name, email address and creation date can be created by anyone and used for impersonation. In this case, we follow the TOFU ( Trust On First Use ) model, that is, we accept the public key on the first import and later verify future key changes.

Message encryption in GNU Privacy Assistant #

Before encrypting a message, you have to import the public key from the recipient.
We open the editor by clicking the clipboard icon. In the text editor of the GPA program, we type the content of the message to be encrypted. We click the encryption icon, select the recipient’s public key in the list and click OK.

We do not need to import the public key again when encrypting the next messages. The key will be saved in the program files.

Message decryption in GNU Privacy Assistant #

We open the editor by clicking the clipboard icon. In the text editor of the GPA program, we paste the encrypted message. We click the decryption icon and ( if a password prompt appears ) we enter the password we set when generating the key.

Signing messages in GNU Privacy Assistant #

We open the editor by clicking the clipboard icon. In the text editor of the GPA program, we type the content of the message to be signed. We click the signing icon, select our key in the list, click OK and ( if prompted to enter a password ) enter the password we set when generating the key.

Avoid signing messages that seem universal. For example, a signed “I agree” or “It’s me” message can be saved and used to impersonate you in another conversation. Signed messages should be complete sentences describing the purpose and circumstances of the signature.

Verifying messages in GNU Privacy Assistant #

Before verifying a message, you have to import the public key from the author.
We open the editor by clicking the clipboard icon. In the text editor of the GPA program, we paste the signed message to be verified. We click the verify icon.

A valid signature will be marked with Valid status in green in the GPA program. We do not need to import the public key again when verifying subsequent signatures of the same author. The key will be saved in the program files.