Copyright 2024 - OS2World - Contact us

News

Secure Email with OpenPGP

This article will show you how to encrypt or receive encrypted email with Thunderbird, how to setup GnuPG 1.47 and create your key-pair for OpenPGP. The OpenPGP key-pair is used for signing and encrypting your email. After you create your key-pair, the first key or file that is created is a private key that you keep secret. The second key or file is a public key that may be given to anybody.

By Greggory Shaw


*** NOTE: There have been reports that there are problems when using eCom beta 4 or RCx. I am using eCom 1.2R and have not tested OpenPGP with eCom v2.0.


In order for somebody to send you an encrypted email they must have your PUBLIC KEY. You will send them your Public key (file). They will use your PUBLIC KEY to encrypt an email and then send it back to you. This will plug into your Private key and you can read the message.

The exact opposite will happen if you want to send an encrypted email to someone, you must have their PUBLIC KEY. Do not worry if you did not fully understand it the first time. Once it is installed all you have to do is select sign or encrypt.

However, it is very important to eventually learn the concept of public-key ciphers. Else it will eventually lead to your security being compromised by carelessness on your part.


Private Key <==> Public Key
{mosimage}


Installing Enigmail 0.95.3 and GnuPG 1.4.7 for PmW-Tb-2.0.0.5


1.) Download Enhanced Thunderbird ported by Peter Weilbacher. Thunderbird requires C runtime DLLs from ftp://ftp.netlabs.org/pub/gcc/libc-0.6.2-csd2.zip to run.


2.) Download GnuPG and make sure to get the zip file. GnuPG allows you to encrypt or sign your data and communications. GnuPG was ported to OS/2 by Tobias Hürlimann. The GNU Privacy Handbook has the complete documentation on GnuPG.


3.) Install Thunderbird and create a directory in the Thunderbird installation directory called x:\Thunderbird\GnuPG


4.) Unzip: gnupg-1.4.7-os2-bin.zip and copy the following files into the GnuPG directory: x:\Thunderbird\GnuPG


* usr/bin/gpg.exe

* usr/bin/gpgv.exe

* usr/bin/gpgsplit.exe

* usr/lib/gnupg/rndos2.dll

* usr/share/book/gpg.inf

* usr/share/gnupg/FAQ

* Optional: plug-in DLLs


*** Note: You can also download the Warpin package if you do not mind creating a unix style directory on the root of your drive. Use the Warpin package if you need localization or see Note (1) at the end of this page.


5.) Set the HOME variable in your CONFIG.SYS, eCom 1.2 has it set by default.

Example: Create the directory: C:\Home\default
and SET HOME=C:\Home\default

Create the subdirectory ".gnupg", in your HOME directory
Example: C:\Home\default\.gnupg  (***Note: there is a (dot) in front of .gnupg)



GnuPG stores the personal options and keys in the subdirectory .

For localization support see Note (1)
For variables used see Note (2)


6.) Install Enigmail and setup Preferences

a) Enigmail is an extension to the mail client of Mozilla Thunderbird and Mozilla Seamonkey which allows users to access the authentication and encryption features provided by GnuPG. Enigmail was built by Walter Meinl.

Download Enigmail 0.95.3 from enigmail.mozdev.org. In Thunderbird open the Add-on window under the main menu Tools and make sure Extensions is selected. Then hit the install button and browse to where you downloaded enigmail-0.95.3. Select the file and hit Ok.

You may not see the file because of the dots in the file name. Just select show all files and then it will show up.

{mosimage}


b) Open preferences under the OpenPGP main menu and check mark the "Display expert settings option. Then use the Override path option to browse to the directory where you install GnuPG and select gpg.exe

{mosimage}


Creating your Key Pair for GnuPG 1.4.7

7.) Creating a key pair and its revocation certificate

a) Before you think about creating a key, you need to decide what your passphrase is going to be. I recommend taking the time to create a passphrase that you can remember easily but is unique and may not be guessed easily. If you forget or lose your passphrase there is no way to recover it and a new key pair will have to be created.

b) To create your key pair open the "Key Management" window under the OpenPGP main menu.

{mosimage}


c) Click on: New Key Pair

{mosimage}


d) Make sure you have the right Account / User ID, if you have more than one account in Thunderbird. Enter your passphrase that you selected in step 7a, the comment is optional. Check: "Key does not expire" and click on "Generate Key" to create your key.

{mosimage}


Creating your Revocation Certificate

8) Create a Revocation certificate for your Key Pair

{mosimage}


And save it in: .GNUPG directory under your HOME directory that you set in step 5

{mosimage}


I recommend that you make one or more copies of your keyrings and the revocation certificate and save them to a CD or USB Stick or print out your revocation certificate. (Yes, you would need to type in most of it, but there is nothing better than a hard copy- Ask VP Gore about that.)


Label it and put them somewhere VERY safe AND secure that you will remember even after years!


Signing Emails Only

9) Most of the time emails are signed only and not encrypted. Signing your emails will give you proof that an email you sent has not been altered.

{mosimage}


a) This is an example of a signed email using GnuPG v1.4.7

{mosimage}


b) This is the same email verified by GnuPG 1.4.7 and is the default display.

{mosimage}


Sending your Public key and Importing friends keys

10) In order for somebody to send you an encrypted email they must have the public key you just generated. You can send them your public key by composing a new email and click on the main menu OpenPGP => Attach My Public Key.

{mosimage}


11) In order for you to encryted an email to someone you must have them send you their public key. Open their email and right click on Attachments then select Import OpenPGP Key

{mosimage}


Signing Public Keys that you Import

12) After you import a public key from someone, you will see a message like this on their emails, if they signed it.

{mosimage}


a) That message is telling you that the signature is good, but does not know if the public key is actually from the right person. So how do you find out if the Public key is legitimate?


* The best way is to actually have the person physical give you their Public key.

* The easiest way is to have them email you their key and verify the Key Finger Print over the phone. After you import a public key you can view the key properties under the main menu OpenPGG => Key Management. Right click on the the key you just imported and select KEY PROPERTIES to view the key's FINGERPRINT

* If you download a key from a public key server, you should always verify that key.


b) After you have verified their Public Key then you should sign it. Under the main menu OpenPGP => Sender's Key => Sign Key.


c) You should also set your Trust for the key under => Sender's Key => Set Key Trust

{mosimage}


d) After you have signed their key or set key trust in OpenPGP this dialog should pop up now instead of the dialog stating UNTRUSTED.

{mosimage}


Signing and Encrypting Emails

13) Start a new email and under and OpenPGP menu select Sign Message and/or Encrypt Message.

{mosimage}


14) If you have signed their key or set key trust in OpenPGP this dialog should NOT pop up when encrypting email to that person.

{mosimage}


The passphrase window will come up, asking for your Passphrase. Enter the passphrase that you selected in step 7a and that's it.

{mosimage}



Conclusions

Most people do not need the encryption features provided by GnuPG. However, if you need to have authentication for your emails, then GnuPG is an excellent way to prove that your emails have not been altered in anyway.


Thanks to Tobias Hürlimann for GnuPG 1.4.7, Walter Meinl for Enigmail 0.95, and Peter Weilbacher for all the great Mozilla ports! Tobias is looking for someone to take over the porting of GnuPG to OS/2 in the future. There is also an article on OS/2 e-Zine written by John Bijnens that covers the same subject of setting up GnuPG and Enigmail. The GNU Privacy Handbook has the complete documentation on GnuPG.



References

Thunderbird - PmW-Tb-2.0.0.5
Enhanced Thunderbird ported by Peter Weilbacher.


GnuPG v1.4.7 for OS/2 Homepage:
www.tobiashuerlimann.de/software/GnuPG/ ported by Tobias Hürlimann.


Enigmail 0.95.3 for OS/2
Latest versions: enigmail.mozdev.org built by Walter Meinl.


GnuPG Homepage:

www.gnupg.org
GNU Privacy Handbook has the complete documentation on GnuPG.


Enigmail Homepage:
enigmail.mozdev.org/help.html



Notes: copied from GnuPG for OS/2 website

(1) If you need localization and do not want to use the Warpin package, create a subfolder named "locale" and copy all subfolders of usr/share/locale/ into it. Then make sure that the UNIXROOT environment variable is NOT set and define the environment variable GPGDIR instead, e.g. SET GPGDIR=C:\Programs\GnuPG.


(2) The following environment variables are used by GnuPG:


* HOME - HOME points to the user's home directory. GnuPG stores the personal options and keys in the subdirectory ".gnupg". If you do not have a home dir, you may choose C: for example:

SET HOME=C:\Home\Default

* UNIXROOT - The env var UNIXROOT should point to the directory, in which a unixish filesystem hierarchy exists. Example: set UNIXROOT to G: and gpg.exe will be located in G:\usr\bin

SET UNIXROOT=G:

* LANG - LANG should already exist at most OS/2 installations because it is also used be OS/2 itself. It is used to determine the language GnuPG will use. Example: if you want GnuPG to 'speak' italian, you set:

SET LANG=it

OS/2-eCS-ArcaOS General News

OS/2-eCS-ArcaOS Software News

Latest Forum Posts

WarpStock and OS/2-eCS-ArcaOS Event News

Site News

f t g m