Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When you send an email using PGP to encrypt emails, is the recipients public key used to encrypt the email, or is your private key used? Are they both used?

At what points do each of the four keys from the two key pairs get used?

share|improve this question
    
A private key is used for signature or for decrypting (preferable you should have a separate for both), never for encrypting. (Although signature looks a bit like encrypting with private key, it is something different.) –  Paŭlo Ebermann Oct 1 '12 at 20:45
add comment

2 Answers 2

up vote 4 down vote accepted

Let Alice have a key pair (PubKeyA, PrivKeyA), where the first is public, the second private, and similarly for Bob (PubKeyB, PrivKeyB). Alice and Bob know each other's public keys in a reliable way (from a key server, or because they received them in person etc.) If we use RSA keys, e.g., then they could use just one pair, so I'll assume this first.

When Alice sends Bob a signed message (signing is optional in PGP, but good practice), the following happens, simplified:

  1. Alice generates a key K for some symmetric cipher algorithm, say AES (i.e. the program does, using a good random number generator, etc.)
  2. Alice encrypts the message M using K, to get AES-Enc(M,K).
  3. Alice encrypts K using PubkeyB, to get RSA-Enc(K, PubKeyB).
  4. The 2 parts RSA-Enc(K, PubKeyB) and AES-Enc(M) are combined in an unambiguous way (so they can be split later) into an encrypted message M' = Enc(M, K, PubKeyB).
  5. Alice uses her PrivKeyA to cryptographically sign M' (which mostly means hashing M' and "encrypting" the result with that private key, in the case of RSA), which gives us Sign(M',PrivKeyA)
  6. Enc(M, K, PubKeyB) and Sign(M',PrivKeyA) are combined in an unambiguous way into the message that Alice sends.

Note that we need a secure mode of operation to AES to encrypt M using K, a secure way to encrypt the key K using PubKeyB (using a secure padding scheme, like OAEP), a secure hash function and way to sign (also using a padding scheme) and a good file format to unambiguously pack all the data in. Read up on the standards involving them...

Bob does the following (simplified) when he receives the message:

  1. Split the message into M' = Enc(M, K, PubKeyB) and Sign(M', PrivKeyA).
  2. Check, using PubKeyA, that Sign(M', PrivKeyA) is a valid signature for M'. Stop if that fails. If it succeeds Bob is confident that M' is intact and indeed sent by Alice.
  3. Then split M' into RSA-Enc(K, PubKeyB) and AES-Enc(M).
  4. Using his PrivKeyB, decrypt K from RSA-Enc(K, PubKeyB) and PrivKeyB.
  5. Using K, decrypt M from AES-Enc(M) and K.

Now Bob has M too, and is confident it is the actual message Alice wanted to send, and was not tempered with in transit.

Like I said, the devil is in the details, but this is the essence of it.

Now, in practice, PGP creates 2 pairs per user, an encryption pair and a signing pair. Also the programs sends key-identifiers with the message to indicate which ones are used (in general, a user could have more public keys etc.)

share|improve this answer
    
So it's possible to only sign or only encrypt a message as well. The reason is I'm wondering what I can do with a sender which has keys and recipient who does not (and vice versa). –  Xeoncross Oct 2 '12 at 19:17
    
You can sign your message using only your own (private) key (it could be a public message, say) but your public key should be known to someone that wants to verify your signature. You cannot encrypt for someone without knowing that person's public key, in a scheme like this. –  Henno Brandsma Oct 2 '12 at 20:29
    
So if I only had a user's public key - I could encrypt a message just for them (but they won't know if it actually came from me). Likewise, if the person I was sending the message too didn't have a key-pair, all I could do would be sign the message assuming they can get a copy of my public key. –  Xeoncross Oct 3 '12 at 17:31
    
@Xeoncross Indeed. –  Henno Brandsma Oct 7 '12 at 14:41
add comment

Here's a mnemonic and metaphor for you.

Someone's public key is like their phone number. You have to have their phone number to call them and you use their phone number to call them. Other people use your number to call you.

From a crypto aspect, you encrypt to a public key and then decrypt with the private key.

Jon

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.