Encryption For The Uninitiated

With governments poking their nose into people’s affairs and the increased prevalence of spying on their population it seems more encryption is needed to keep one’s communications private.

But how one wonders. The FBI, CIA and almost all of the worlds ‘secret’ agencies have a back door into the standard social platforms, LinkedIn, Facebook, Twitter and most of the others.

There are platforms such as Telegram and a few other relatively small platforms they do NOT have a back door in but that will change very quickly as pressure mounts on the owners of such platforms to provide a back door. So far Telegram has been successful and even the Russia Government could not get a back door in. But Telegram is the hot topic for the agencies at the moment and they are fighting to get into that using security as a justification for poking their nose into your affairs. Citing the old adage, “If you have nothing to hide why are you worried?” Well of course that is not the issue. The issue is that each individual has a right to privacy.

So how do you keep your personal communications PRIVATE?

There is a simple way and you do not need to be a nerd to use it. It is called Open PGP (Open Pretty Good Privacy) (https://www.openpgp.org/) and it was developed by Phil Zimmermann in 1991 and was designed to be used for data encryption and digital signatures. PGP can be used for signing, encrypting, and decrypting texts, emails, files, directories, and whole disk partitions and to increase the security of email communications. There are variations, for business for example as well as personal but the basic Open PGP is fairly easy to use.

The concept is very simple: you can encrypt text, making it unreadable to anyone who doesn't have the key to decode it. First, PGP generates a random session key using one of two (main) algorithms (algorithms: In mathematics and computer science, an algorithm is a finite sequence of well-defined, computer-implementable instructions, typically to solve a class of problems or to perform a computation. Algorithms are always unambiguous and are used as specifications for performing calculations, data processing, automated reasoning, and other tasks.Wikipedia) This key is a huge number that cannot be guessed, and is only used once. Next, this session key is encrypted. When you send a message using PGP, the message is converted into unreadable ciphertext on your device before it passes over the Internet. Only the recipient has the key to convert the text back into the readable message on their device.

In fact you can use PGP to encrypt emails for several people at once, provide messages with digital signatures and encrypt images and other files. In the version of PGP for companies there is a kind of back door: you can set up the program so that it also encrypts each message with the public key of the company.

So How does PGP actually work?

It is described very well at freecodecamp.org. ‘PGP is very easy to understand, on the surface. Imagine you want to send your credit card information to a friend and you write it on a piece of paper. You then put the paper in a box and send it by mail.

A thief can easily steal the box and look at the paper that contains your credit card information. What could you do instead?

You decide to put a key lock on the box, but you realize that you have to send the key along with the box. That’s no good.

What if you meet your friend in person to share the key beforehand? That could work, right? It could, but then both of you have a key that allows to unlock the box. You, as the sender, will never need to open the box again after closing it. By keeping a copy of a key that can unlock the box, you are creating a vulnerability.

Finally, you found just the right solution: you’ll have two keys. The first key will only be able to lock the box. The second key will only be able to open the box. That way, only the person who needs to get the content of the box has the key that allows them to unlock it.

This is how PGP works. You have a public key (to lock/encrypt the message) and a private key (to unlock/decrypt the message). You would send the public key to all your friends so that they can encrypt sensitive messages that they want to send to you. Once you receive an encrypted message, you use your private key to decrypt it.’

The references below provide a number of sites to learn more but also to set up and run a PGP.

No more noses stuck into your private matters!









30 views0 comments