# When is each key used when encrypting an email using OpenPGP?

When you send an email using PGP to encrypt emails, is the recipients public key used to encrypt the email, or is your private key used? Are they both used?

At what points do each of the four keys from the two key pairs get used?

• A private key is used for signature or for decrypting (preferable you should have a separate for both), never for encrypting. (Although signature looks a bit like encrypting with private key, it is something different.) Oct 1, 2012 at 20:45

## 2 Answers

Let Alice have a key pair (PubKeyA, PrivKeyA), where the first is public, the second private, and similarly for Bob (PubKeyB, PrivKeyB). Alice and Bob know each other's public keys in a reliable way (from a key server, or because they received them in person etc.) If we use RSA keys, e.g., then they could use just one pair, so I'll assume this first.

When Alice sends Bob a signed message (signing is optional in PGP, but good practice), the following happens, simplified:

1. Alice generates a key K for some symmetric cipher algorithm, say AES (i.e. the program does, using a good random number generator, etc.)
2. Alice encrypts the message M using K, to get AES-Enc(M,K).
3. Alice encrypts K using PubkeyB, to get RSA-Enc(K, PubKeyB).
4. The 2 parts RSA-Enc(K, PubKeyB) and AES-Enc(M) are combined in an unambiguous way (so they can be split later) into an encrypted message M' = Enc(M, K, PubKeyB).
5. Alice uses her PrivKeyA to cryptographically sign M' (which mostly means hashing M' and "encrypting" the result with that private key, in the case of RSA), which gives us Sign(M',PrivKeyA)
6. Enc(M, K, PubKeyB) and Sign(M',PrivKeyA) are combined in an unambiguous way into the message that Alice sends.

Note that we need a secure mode of operation to AES to encrypt M using K, a secure way to encrypt the key K using PubKeyB (using a secure padding scheme, like OAEP), a secure hash function and way to sign (also using a padding scheme) and a good file format to unambiguously pack all the data in. Read up on the standards involving them...

Bob does the following (simplified) when he receives the message:

1. Split the message into M' = Enc(M, K, PubKeyB) and Sign(M', PrivKeyA).
2. Check, using PubKeyA, that Sign(M', PrivKeyA) is a valid signature for M'. Stop if that fails. If it succeeds Bob is confident that M' is intact and indeed sent by Alice.
3. Then split M' into RSA-Enc(K, PubKeyB) and AES-Enc(M).
4. Using his PrivKeyB, decrypt K from RSA-Enc(K, PubKeyB) and PrivKeyB.
5. Using K, decrypt M from AES-Enc(M) and K.

Now Bob has M too, and is confident it is the actual message Alice wanted to send, and was not tempered with in transit.

Like I said, the devil is in the details, but this is the essence of it.

Now, in practice, PGP creates 2 pairs per user, an encryption pair and a signing pair. Also the programs sends key-identifiers with the message to indicate which ones are used (in general, a user could have more public keys etc.)

• So it's possible to only sign or only encrypt a message as well. The reason is I'm wondering what I can do with a sender which has keys and recipient who does not (and vice versa). Oct 2, 2012 at 19:17
• You can sign your message using only your own (private) key (it could be a public message, say) but your public key should be known to someone that wants to verify your signature. You cannot encrypt for someone without knowing that person's public key, in a scheme like this. Oct 2, 2012 at 20:29
• So if I only had a user's public key - I could encrypt a message just for them (but they won't know if it actually came from me). Likewise, if the person I was sending the message too didn't have a key-pair, all I could do would be sign the message assuming they can get a copy of my public key. Oct 3, 2012 at 17:31
• @Xeoncross Indeed. Oct 7, 2012 at 14:41

Here's a mnemonic and metaphor for you.

Someone's public key is like their phone number. You have to have their phone number to call them and you use their phone number to call them. Other people use your number to call you.

From a crypto aspect, you encrypt to a public key and then decrypt with the private key.

Jon