View source for Mitigating eMail Attacks: GnuPG (en)

This module will guide you step by step in securing your email communications using GnuPG (GNU Privacy Guard) encryption in the Thunderbird email client. GnuPG is a powerful and free encryption tool, while Thunderbird is a popular open-source email client. By combining the two, you can protect sensitive information that you send and receive via email from unauthorized parties.

==Module Objectives==

* Understand the basic concepts of asymmetric cryptography and GnuPG.
* Create PGP (Pretty Good Privacy) keys and manage the keyring.
* Configure Thunderbird to use GnuPG encryption.
* Send and receive encrypted emails.
* Verify message integrity with digital signatures.

==Prerequisites==

* A computer with an installed operating system (Windows, macOS, or Linux).
* Thunderbird email client installed.
* A stable internet connection.

==Steps==

===Installing GnuPG and Thunderbird===

* '''GnuPG:''' Download and install GnuPG from the official website ([https://gnupg.org/](https://gnupg.org/)). Follow the installation instructions provided.
* '''Thunderbird:''' GnuPG is currently a built-in add-on for Thunderbird that facilitates the use of GnuPG.

===Creating PGP Keys===

* Open the GnuPG application or use the Thunderbird interface to create a PGP key pair.
* Choose an appropriate key length (minimum of 2048 bits) and enter a strong passphrase. This passphrase is crucial for protecting your private key.
* Store your private key in a safe place. The public key can be shared with others who wish to communicate with you securely.

===Configuring Thunderbird===

* After installing Thunderbird, configure general settings such as keyring location and encryption preferences.
* Import the public keys of others you wish to send encrypted emails to.

===Sending Encrypted Emails===

* When composing a new email, enable the encryption option in Thunderbird.
* Select the recipient and choose their public key to encrypt the message.
* Write your message and send it.

===Receiving and Decrypting Emails===

* When receiving an encrypted email, Thunderbird will automatically prompt you for your passphrase to decrypt the message.
* Enter the correct passphrase, and the message will be decrypted.

===Verifying Digital Signatures===

* In addition to encryption, GnuPG also supports digital signatures to verify the sender's identity.
* Thunderbird will display information about the digital signature when you open a signed email.

==Practical Exercises==

* '''Exercise 1:''' Create your own PGP key pair and share your public key with a friend or family member.
* '''Exercise 2:''' Send an encrypted email to a friend or family member who has your public key.
* '''Exercise 3:''' Verify the digital signature on an email you received.

==Interesting Links==

* [[Forensic: IT]]
* '''GnuPG Documentation:''' [https://gnupg.org/documentation/](https://gnupg.org/documentation/)
* '''Thunderbird Documentation:'''
* '''Basic Concepts of Cryptography:''' Briefly explain symmetric and asymmetric cryptography, as well as the role of public and private keys in GnuPG.
* '''Security Best Practices:''' Provide security tips such as choosing a strong passphrase, protecting your private key, and avoiding phishing.
* '''Advanced Usage:''' Explain advanced Thunderbird features like creating digital signatures, file encryption, and keyring management.