PGP & Secure Communication
A beginner-friendly guide to understanding, creating, using, and protecting PGP keys.
1. What is PGP?
PGP is a method of encrypting and signing information. It can be used to protect messages and verify that information was signed by the expected key holder.
2. Why Use PGP?
PGP can protect sensitive information from being readable by anyone who does not possess the corresponding private key. Digital signatures can also help verify authenticity.
3. Public Key vs Private Key
- Public key: safe to share with others so they can encrypt messages to you.
- Private key: must remain secret and is used to decrypt messages and create signatures.
4. What is a Fingerprint?
A PGP fingerprint is a short identifier derived from a key. It can be used to confirm that the public key you received is the expected key.
5. How to Create a PGP Key Pair
A PGP key pair consists of a public key and a private key. Your public key can be shared with people who need to send encrypted messages to you. Your private key must remain secret.
Windows
The recommended beginner-friendly option is Gpg4win, which includes GnuPG and Kleopatra, a graphical certificate manager.
- Download and install Gpg4win.
- Open Kleopatra.
- Select the option to create a new OpenPGP key pair.
- Enter the name and email address you want associated with the key.
- Create a strong passphrase when prompted.
- Finish creating the key pair.
- Export or copy only your public key when you need to share it.
macOS
On macOS, GPG Suite provides GnuPG and graphical tools for working with OpenPGP keys.
- Download and install GPG Suite.
- Open the included key management application.
- Create a new OpenPGP key pair.
- Enter your identity information.
- Set a strong passphrase.
- Complete the key creation process.
- Export your public key when you need to share it.
Linux
Most Linux distributions can install GnuPG through the system package manager. A graphical frontend such as Kleopatra can also be used.
After installing GnuPG, you can create a key pair from the terminal with:
gpg --full-generate-key
Follow the prompts, choose the OpenPGP key settings offered by GnuPG, enter your identity information, and protect the private key with a strong passphrase.
To list your keys:
gpg --list-keys
To export your public key in an ASCII-armored format:
gpg --armor --export [email protected]
Share the resulting public key, not your private key.
Android
Android users can use an OpenPGP-compatible application such as OpenKeychain.
- Install OpenKeychain from its official source.
- Open the application and create a new key.
- Enter the requested identity information.
- Protect the private key with a strong passphrase.
- Complete the key creation process.
- Export or copy your public key when needed.
Important After Creating Your Key
- Keep your private key secret.
- Never send your private key to the directory, support staff, or another user.
- Use a strong and unique passphrase for your private key.
- Keep a secure backup of your private key.
- Verify your fingerprint before trusting an important key.
When adding your PGP key to DarkBook.Info, provide only your public key.
6. Adding Your Public Key
When a page asks for your PGP public key, provide only your public key. Never upload or disclose your private key.
7. PGP Verification
Verification can confirm control of a PGP private key by requiring the user to decrypt or sign a challenge using that key.
8. How to Encrypt a Message
Import the recipient's public key into your PGP software, select it as the recipient, and encrypt the message. Only the holder of the corresponding private key should be able to decrypt it.
9. How to Decrypt a Message
Use your private key with your PGP software to decrypt a message that was encrypted for your public key.
10. PGP Signatures
A digital signature can be used to verify that a message was signed by the holder of a particular private key and that the signed content has not been changed.
11. Protect Your Private Key
- Never share your private key.
- Use a strong passphrase to protect it.
- Keep secure backups.
- Do not paste your private key into websites or messages.
12. Common PGP Mistakes
- Sharing a private key instead of a public key.
- Encrypting a message to the wrong recipient.
- Failing to verify a public-key fingerprint.
- Ignoring an unexpected signature or key change.
13. PGP Safety Tips
Protect your private key and passphrase, verify important fingerprints through a trusted source, and do not assume that an encrypted message is authentic unless you also verify its signature where appropriate.