Basic
steps for using PGP
1. Install PGP on your computer.
2. Create a private and public key pair. Before
you can begin using PGP, you need to generate a key pair. A PGP key pair is composed of a
private key to which only you have access and a public key that you can copy and make
freely available to everyone with whom you exchange information. You have the option of
creating a new key pair immediately after you have finished the PGP installation
procedure, or you can do so at any time by opening the PGPkeys application.
3. Exchange public keys with others. After you
have created a key pair, you can begin corresponding with other PGP users. You will need a
copy of their public key and they will need yours. Your public key is just a block of
text, so it’s quite easy to trade keys with someone. You can include your public key
in an email message, copy it to a file, or post it on a public or corporate key server
where anyone can get
a copy when they need it.
4. Validate public keys. Once you have a copy
of someone’s public key, you can add it to your public keyring. You should then check
to make sure that the key has not been tampered with and that it really belongs to the
purported owner. You do this by comparing the unique fingerprint on your copy of
someone’s public key to the fingerprint on that person’s original key. When you
are sure that you have a valid public key, you sign it to indicate that you feel the key
is safe to use. In addition, you can grant the owner of the key a level of trust
indicating how much confidence you have in that person to vouch for the authenticity of someone
else’s public key.
5. Encrypt and sign your email and files. After
you have generated your key pair and have exchanged public keys, you can begin encrypting
and signing email messages and files. PGP works on the data generated by other
applications. Therefore the appropriate PGP functions are designed to be immediately
available to you based on the task you are performing at any given moment. There are several ways to encrypt and sign
with PGP:
• From the System tray (PGPtray). PGPtray
includes utilities to perform cryptographic tasks on data on the Clipboard or in the
current window.
• From within supported email applications
(PGP email plug-ins). The plug-ins enable you to secure your email from within the
supported email application.
• From PGPtools. PGPtools enables you to
perform cryptographic tasks within applications not supported by plug-ins, plus other
security tasks, such as wiping files from your disk.
• From the Windows Explorer File menu. You
can encrypt and sign or decrypt and verify files such as word processing documents, spreadsheets and video clips
directly from the Windows Explorer.
6. Decrypt and verify your email and files.
When someone sends you encrypted data, you can unscramble the contents and verify any
appended signature to make sure that the data originated with the alleged sender and that
it has not been altered.
• If you are using an email application
that is supported by the plug-ins, you can decrypt and verify your messages by selecting
the appropriate options from your application’s tool bar.
• If your email application is not
supported by the plug-ins, you can copy the message to the clipboard and perform the
appropriate functions from there. If you want to decrypt and verify files, you can do so
from the Clipboard, Windows Explorer, or by using PGPtools. You can also decrypt encrypted
files stored on your computer, and verify signed files to ensure that they have not been tampered
with.
7. Wipe files. When you need to permanently
delete a file, you can use the Wipe feature to ensure that the file is unrecoverable. The
file is immediately overwritten so that it cannot be retrieved using disk recovery
software.
