Today, we live in a world of rapidly diminishing privacy. If you use your employer's email system, it is possible that every message you send or receive is logged and intercepted without your knowledge. This may have unintended or even disastrous consequences if an intercepted email message contains sensitive personal information. Unless your email goes through Secure Socket Layer (SSL) protected connections, your email is vulnerable to what is known in the IT security field as man-in-the-middle attacks, where an attacker can intercept your message as it flies to its intended recipient.

Email is sent in a format that is easily readable if an attacker can grab and reconstruct enough pieces (packets) from the data transmission with packet sniffing software. Technologies like deep packet inspection make it theoretically possible that any given message that goes over the internet can be sniffed and read by third parties who have the right software and know-how. (the feds, your ISP, etc.) While no one may have a real reason to spy on you, relying solely on security through obscurity has always been a poor policy to live by. Because of this, encryption is the only real option you can trust. We teach you how to put your emails in a lockbox before sending them off to their destinations.

Public key encryption overview

Public key encryption works by having two separate keys: a public key and a private key. The whole concept can be compared to a padlock. When a padlock is open, anyone can lock it (public key) but the lock can't be opened again without its key or combination (private key). For this reason, your private key and its password should never be shared with anyone else, whereas your public key may be freely distributed so people can use it to send encrypted messages to you. 

GNU Privacy Guard

On Linux, the most notable public key encryption program is the GNU Privacy Guard. (GPG) Originally created as the open source descendant of OpenPGP (Pretty Good Privacy), GPG became a popular encryption tool and maintains full compatibility with PGP. GPG is a text-only command line application in its most basic form, but various frontends like kGpg exist for it. Once you have GPG installed, you must generate a key pair (CTRL+N in kGpg) to create a public and private key for yourself. For maximum security, you should use a strong password (at least seven random uppercase and lowercase letters, numbers, and symbols without dictionary words) and a 4096 bit key.

 

4096 bit encryption is extremely strong by today's standards, to the point where cracking is completely impractical. Breaking a single 4096-bit key would literally take millions of years even with modern distributed computing technology working on it around the clock, and an attacker would have to steal your private key first to even make an attempt. This situation is not likely to change unless there is a revolutionary breakthrough in quantum computing and the technology becomes readily available.

Once your key pair has been generated, you should upload your public key to the various key servers around the world so people and email applications will be able to find it. kGpg has a built-in list of the most popular servers to make the process easier.

GPG is platform-independent, and GPG software exists for practically every operating system in common use. Encrypted messages can be shared between operating systems, so once someone has your public key, you can receive encrypted messages from them, and vice versa. While this article is geared towards Linux, you can also apply it to any other operating system that has an implementation of GPG or OpenPGP.

Using GPG with popular email software

Many popular Linux email clients (Like Evolution and Kmail) have built-in features that allow them to interact with GPG. To enable encryption in Mozilla Thunderbird, you must install Enigmail.

If you are using Evolution, you should compose your message as you normally would and then select PGP Encrypt from the Security menu in the message composition window. Once you do this, Evolution will query the keyservers. If Evolution is able to find a key that matches the email address of the recipient, your message will be automatically encrypted as it is sent.

 

Kmail and Thunderbird handle encryption in much the same way. Unlike Evolution, Kmail or Thunderbird will not automatically query the keyservers to match the recipient email address with, but will only allow you to use the public keys you have installed on your computer. After you have chosen a key, the message will be encrypted with it and sent. While this encryption process is not as automated as Evolution's, it does prevent the small possibility of automatically encrypting with an old or expired key that the recipient no longer uses.

Other ways to use GPG

If you use a web-based email client like Gmail or an email application with no native GPG support, you can still benefit from encrypted email. This method of encryption is not as elegant as those described in the previous section, but it will work regardless of the email client you are using.

The first thing you must do is compose your message. For this purpose, you should use the editor component of the kGpg frontend. (located in the kGpg file menu) This will present you with a simple text editor. Once you have written your message, click the encrypt button and choose a key from the list. kGpg requires an “ultimate” trust level on a public key in order to encrypt with it.

Once your message has been encrypted, copy everything, (including the -----BEGIN PGP MESSAGE----- and -----END PGP MESSAGE----- header and footer) paste it into your email client, and send the message. The recipient should be able to decrypt your message with his or her private key once he or she receives it. If any part of the encrypted message is omitted, decryption will not work.

If someone sends you a message encrypted using this method, you can decrypt it by copying everything, (including the header and footer) pasting it into kGpg, and clicking the decrypt button. If your private key is present and valid, you will be asked for your password. Once you provide the correct password, the decrypted message will be shown.

Sending encrypted email attachments

Sometimes it is more practical to send encrypted attachments rather than encrypting an entire message. GPG can do this, but it is rather inefficient since each file must be encrypted individually (encrypted files can be recognized by a .asc extension) or packaged into a tarball or zip file and then encrypted. Fortunately, a program called Truecrypt offers a better solution.

Truecrypt uses AES (Advanced Encryption Standard), a different encryption algorithm than GPG. With AES, there is no public or private key; rather there is a single password. 256-bit AES encryption is at least as strong as that offered by GPG, since some experts claim that cracking 256-bit AES encryption with modern computing power would take longer than the current age of the universe.

Truecrypt's main purpose is to encrypt entire hard drives to greatly boost operating system security, but Truecrypt also has the ability to create encrypted files of a predefined size. (Anywhere from a few megabytes to a few gigabytes) These files (when unlocked) operate like small virtual hard drives, so any files written to them are automatically encrypted and decrypted on the fly. Unlike GPG-encrypted files, Truecrypt archive files have no predefined extension, so you can easily disguise a Truecrypt file by assigning a false extension. If anyone intercepts your file, the interloper would likely think that it is merely a corrupt file. Since AES-encrypted files appear to be random data, a well-trained professional with a hexadecimal editor may notice something unusual, (since most files have some sort of structure) but this scenario is highly unlikely in most situations. Your main goal with the false extension tactic is to protect the file from casual suspicion, not detailed analysis.

Staying safe

All the encryption in the world isn't going to do you any good if you cannot trust your own computer. Any computer used for encryption should be fully patched and malware free to create a sanitary environment. Rather than attempt to crack encryption by brute force, attackers usually try much less resource-intensive tactics, such as stealing your private key and password when you use them. Passwords are frequently stolen through the use of keyloggers, which are hardware or software-based devices that capture your keystrokes.

Hardware-based keyloggers are easy to locate; they are plugged into a computer through a PS/2 or USB port and the keyboard plugs into the keylogger. Some must be retrieved to be read, whereas others can transmit collected data over your internet connection when called for. You are very unlikely to find one of these on your home computer, but paranoid users may want to check their cases every so often. Generally, it is a bad idea to run a decrypt on any public or work computer that you do not fully trust and have fully inspected, since these computers are most likely to have a hardware keylogger installed.

Software-based keyloggers are far more insidious and can be picked up like any other malware, so your otherwise secure home computer can potentially be infected. A competent attacker will often try to hide the presence of the keylogger with a rootkit, so get in the habit of checking for rootkits every so often. Windows users can use RootKitRevealer, and Linux users can use Chkrootkit or Rootkit Hunter. This process is easily automated by setting a Cron job (under Linux) and writing the scan output to a log file, emailing it to yourself, or both. If you find a rootkit, you should immediately deep-format your hard drive (Darik's Boot-and-Nuke is good for this) and reinstall your operating system.