Welcome to part six of this module.
Now it's time to take a look at P G P which stands for Pretty Good Privacy.
This video is actually broken into two parts.
First we'll look at how to use P GP to send encrypted messages and talk about how it can be used as
a way to create an anonymous yet verifiable identity.
In the next video we'll look at how to use GP G for Windows to verify the author's authenticity of files
that we download.
All of this is going to be important as we move on into Tau and the deep web.
This first look is going to be just the basics of how to use P GP and what it is.
We'll be diving a lot deeper into it when we get to the video covering the tables operating system.
So if you find this presentation to be a little bit oversimplified please refer to that video for more
detailed instructions.
Again this is meant to be an introduction to get the concepts down because it seems like people have
a hard time with this and it is actually very easy.
The first thing that we need to do is download GP G for windows from the Web site.
We'll want the latest version.
They make this look a bit confusing but all you really have to do is click 0 dollars.
If you do not wish to donate and then click the download link once download it will just go ahead and
install it like any normal file.
Just follow the prompts and make sure that GPA is checked.
All of these should be checked and we will be looking at Cleopatra in the next video so make certain
that that is checked as well.
Browser integration is optional when you're ready click next.
We're not going to run Cleopatra just yet so we'll uncheck this click finish.
So with the installation complete let's go ahead and launch GPA key manager and the first thing it's
going to do is it's going to say that it hasn't detected any private keys.
And do we wish to generate one we're going to see do it later because we want to do this on the fly
to start us off.
We want to generate what is called a key pair for a little explanation.
We are about to use our key manager to create two keys.
These two keys are like two halves of the same coin.
We will have a public and a private key.
The public key is the one that we're going to give out to everybody and make available to anybody who
wants to write encrypted messages to us.
The private key.
We're going to keep secret the private key will allow us to decrypt any messages that used the public
key that is associated with it.
To encrypt them might be a little easier to show this rather than to try to explain it.
So let's go up to keys and select new key.
Now you need to supply a name.
This could be your personal real life name.
If you don't wish to remain at all anonymous but simply want your communications to be encrypted it
could also be an alias a handle or a code word.
If you do not wish your real world identity to be tied to the key that you are about to generate for
this demonstration I'm just going to say demo key one.
And press forward.
Next were prompted to give an email address.
I want to stress you don't need to supply a real address here.
You can type in gobbledygook and it will work just fine.
Whether or not you supply a real account will depend largely upon your intentions for this demonstration
I'm just going to type in a string of useless nonsense.
Keep in mind that we can generate as many keys as we would like you may in fact have dozens of different
keys that you use for different online identities and accounts.
Now we're being asked if we wish to create a backup copy of our key.
We can do this later.
It is your choice.
I recommend that you make sure your backup is saved to a secure location.
You may wish to create a very crypt or True Crypt file container to store your keys in rather than having
them unencrypted on your computer.
Some people even go so far as to store their G.P.S. installation on an encrypted non system partition
or an encrypted U.S. B device or something like that.
Now we're prompted to enter a password for our private key.
This will be used whenever we use that private key to decrypt messages that were sent using our public
key.
You want this to be a strong password once don't press.
Okay.
And re-enter the password for verification.
One thing to notice here.
Although it isn't immediately obvious when you generate a key pair they are listed in the key manager
as a single entry.
But notice that the icons for that entry are a gold and silver key.
A Gold Key is your private key and a silver key is a public key.
You may also use the import button to import someone else's public key for your key manager.
In which case the icon should only be a single silver key.
So let's go ahead and create our first secret message.
The simplest way to do this is going to be to open up the clipboard and will type out our super secret
message and now say we want to encrypt this message.
We press the encrypt button and we select the private key that we wish to use from our key manager list.
Keep in mind there might be several and that's one of the reasons why you do need to name your key something
that you will recognize press OK and now our secret message has been transformed into this seemingly
nonsensical text.
Our message is now encrypted.
We now highlight all of this copy it and then we're ready to paste it into our email or our other messaging
service.
Anyone with access to the public key associated with the private key we just used to encrypt this message
will be able to decrypt it.
So let's say that we just got this encrypted message from someone else who used our public key.
We paste the message into the clipboard we press the decrypt button and we would normally be prompted
to select the key.
But since there's only one we will enter our passphrase for that private key
and the message is decrypted.
Great.
But sending a message to ourselves isn't really all that useful.
What if we want to send a secret message to let's say Satoshi Nakamoto the creator of bitcoin.
Well all we need to do is find his public key online and import it into our key ring a key can come
in one of three forms a file with a dot PPA extension a file with a dot a S C extension or a block of
text that looks like this.
If you're dealing with a file all you need to do is press the import button and select the file.
The key will be imported normally and appear in your key manager as a silver public key.
If on the other hand you have a big block of text like this you simply highlight it copy it and then
we'll go ahead and we're going to paste it into a notepad file or leaf pad or whatever else you might
like to use.
And then we're going to save the file
as Satoshi ki dot.
And we could save it as either SC or PDP so here you can see we've saved Satoshi is key onto our desktop.
Gonna close the clipboard for now and we're gonna click the import button we'll select the key and open
it one public keys have been red and one have been imported.
Now the key appears on our list the time and date it was created.
Satoshi Nakamoto and his email he chose to include those in this particular key.
Now you may receive a message at this point some versions and programs do give you a message and some
do not.
It will warn you that although you have just imported this key the owner trust level is not yet set.
We don't really know for certain that the key came from the real Satoshi so the default level is going
to be unknown keys that you create yourself will have the ultimate trust level.
We'll be talking at greater lengths about signing keys and trust levels when we get details.
For now we are just going to keep things simple.
So let's go ahead and pretend that we're going to write Satoshi an email.
We'll open up our clipboard and we'll say hello.
Toshi thanks for creating Bitcoin.
We might even wish to include our own public key so that he can write us back either by exporting the
key
and then attaching this file either the PDP or AFC as an email attachment.
Or we might select our own public key copy it and then paste it into the body of the message.
These are just different ways we can do this.
Then we click the encrypt button and we select Satoshi is key and again we will be given this warning
because the trust level of this key has not yet been set.
However in this case we do happen to know that it is from Satoshi so we're going to click yes.
And now the message along with our own public key has been encrypted.
So anyone with Satoshi is private key which will hopefully only be the real Satoshi we'll be able to
decrypt this message in the way that we've seen by entering the password and then they will see our
public key either in the message itself or as I said attached as a file to the email and we'll be able
to write back using BGP encryption then we can decrypt using our private key.
So in this case we would just highlight the entire encrypted text from top to bottom leaving nothing
out copy it and then paste it into the email PDP keys are not only a way of sending secret messages
they are also a way of verifying an identity while also remaining anonymous.
Let's say that someone on a web forum uses the alias Zero Cool there could be a million people out there
using that same alias.
And if all you know about that identity is the name Zero Cool then you have no way of knowing that you're
actually talking to the quote unquote real zero.
Cool but if Zero Cool uses PDP you can always be sure you're communicating with the correct person if
they can decrypt the messages that you send them using their public key in this way zero.
Cool can always verify that he or she is the real zero.
Cool without having to give up any information that could link back to their real world identity.
The person behind the Zero Cool persona might have dozens of such online personas each with its own
private and public key pseudo review.
You have a private and a public key.
You keep your private key secret and you use it to decrypt the messages that other people send you using
your public key which you freely give out to everyone.
You can have as many private and public key pairs as you like and these keys are useful to verify the
identity of the person or persons with whom you are communicating.
Alright I realize this was all very oversimplified.
We will be taking a much closer look at TGP key managing signing keys and trust levels and all of that
fun stuff when we get to the tail's operating system.
As I said for right now it is absolutely essential that you understand the basic concept of the public
and private keys before moving on to Tor and the deep web.
Since these keys are one of the principal ways in which people communicate and verify their personas
while also remaining anonymous for now I encourage you to practice with just these basics create some
keys send a few messages to yourself for a friend and decrypt them and just get your feel for it.
PDP is important for one other reason.
In the 21st century there are many forms of mass data collection and surveillance being employed by
government agencies and corporations.
Generally speaking you can never be 100 percent sure that communications that you send over the Internet
particularly via email or instant messenger are not being scooped up and processed in route.
This can even be true or more true when you're using a service that claims to be encrypting your data
and keeping it safe using an email or instant messenger application or other communication method that
employs its own encryption is all well and good but can you really trust it completely.
Adding P GP is an additional layer of security for both you and the person with whom you are in communication.
There are many forums of open GP.
This key manager that we're looking at here is just one of those such programs.
It is also possible to download browser extensions and while these do make life a little easier when
you're dealing with a lot of emails because they make things more automatic it is up to you to do your
due diligence and make certain that they are actually trustworthy.
Some of them are not.
Finally it is worth pointing out that you could edit your keys by clicking on the key and pressing the
edit button.
You can change your password and you can also add an expiration date if you wish.
Again we are going to be talking about owner trust levels and how to sign keys get to tales as well
as looking at tales built in key management system for right now.
It is enough to understand the basic concepts of public and private keys and how they work.
Thank you for your attention.
I hope this was all clear.