pgp

Joel Goguen jgoguen at jgoguen.ca
Tue Aug 11 01:16:16 UTC 2009


On 10 August 2009 21:27:40 Doug Stewart wrote:
> I have a file with a public key block , and a message that is incrypted by
> the same person.
>
> How do I use the key to see the message.
> What software?
>
> Ubuntu 9.04
>
> I know a little about
> seahorse  and pgpgpg
>
> Doug
The way public key crypto works is slightly different for signing and 
encrypting.  In both cases you have a public key (publicly accessible by 
anyone) and a private key (kept secret, only the sender may have this).  For 
the sake of simplicity, let's call the sender "Alice" and the receiver "Bob".  
They both have their own private and public keys.

For signing, Alice will sign the message using her private key.  Anyone on the 
Internet may use her public key to verify the signature and see that it was 
Alice's private key used to sign the message.

Encrypting is basically the opposite.  If Alice wants to send Bob an encrypted 
message, she would encrypt the message using Bob's public key.  At this point, 
no one but Bob can decrypt the message.  When Bob receives the message, he 
will use his private key to decrypt the message.

So, if you have an encrypted message, it must be encrypted with your public 
key, and you would use your private key to decrypt it.  Most mail clients 
(KMail, Evolution, Thunderbird with Enigmail) can do this automatically, but 
if not you can save the encrypted block (including the lines before and after 
starting with dashes) to a file (~/gpg-message.txt) and decrypt with this 
command:

gpg -d ~/gpg-message.txt

This will print the message out on the terminal.  If you don't have a private 
key, or if the message was encrypted using someone else's public key, you 
won't be able to read it.

It's also possible you have a signature - they look similar to encrypted 
messages, except signed messages have a small block of gibberish after a 
plaintext message.  This message right here is signed, so you can look at it 
and see what a signed message looks like.  To verify a signature, simply copy 
the message to one file (~/plain-message.txt) and the signature to another file 
(~/gpg-sig.txt) and use this command:

gpg --verify ~/gpg-sig.txt ~/plain-message.txt

It would of course be preferred to use a mail client that can do this 
automatically, to avoid the chances of errors copying and pasting the 
messages/signatures.

Hope that helps!

-- 
Joel Goguen
Ubuntu User #15951
When we help, we benefit
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.ubuntu.com/archives/ubuntu-ca/attachments/20090810/4d4784dc/attachment.pgp>


More information about the ubuntu-ca mailing list