What is standard email encryption practice?

Question

So I've recently got an email client set up with an encryption plugin, but I'm not sure what's happening behind the scenes.

What I haven't been able to find anywhere online is what is the standard way to encrypt emails? Do I encrypt with my private key, then your public key? The other way around? Do I encrypt with your public key, then sign with my private key? There's so many different options, and I can't seem to find what people consider the 'standard'.

While setting up the plugin, it automatically detects my keys stored with GPA and associates those with email addresses. I can also import keys from keyservers for contacts. However, if I email someone that I don't have a public key for, it warns me and wants me to download their public key before proceeding, so I know that it is using it in the encryption process.

If I were to encrypt a message by hand, ie using GPA, what steps would I need to take?

Answer 1

Step 1: Generate your key pair

First you would generate your OpenPGP key pair e.g. with gnupg. The key generation format of pgp keys is complex, but you should know that the key pair consists of a public key, which is used by the sender to encrypt for the recipient(you) and the private key, which is used by the recipient to decrypt the message.

Step 2: Share your public key and collect public keys

In the next step a sender needs the public key of every recipient. To do this step, you can give your public key to the other person using an usb stick or you upload it to a public key server.

You also collect the public keys of users you want to send encrypted mails to.

Step 3: Encrypt and send message

You write your message and encrypt it for the recipients. You might also sign the message, which guarantees that the recipient can verify that the message has been created by you. After the encryption you send the message to the recipients.

Step 4: Decrypt message and verify signature

If you recieve a message you decrypt it and if the message is signed, you verify the signature to be sure the message is sent by the sender to whom you have the public key.

Overview: Encryption process

If you encrypt a symmetric session key is generated. With this session key your message is encrypted. After the message encryption is completed you encrypt the session key with the public key of the recipient. After that you can optionally create a hash of the encrypted message and sign this hash with your private key, this is called a signature. After these things are done the message gets saved in the OpenPGP format.

Notes:

This is a simplified answer, which does not exactly match all details of openPGP e.g. there is an encryption key pair and a signing keykey pair, but it should give you a general overview about how hybrid encryption works and openPGP works.