What is the easiest way to get started for Windows® users?

- In case you don't know the basics about Public-Key Cryptography yet, read introduction B.

- Get Gpg4win for free, install it and restart your laptop or PC.

- Watch one of the many tutorials out there (for example this combined with that that).

- Generate a key pair.

- Practice encryption/decryption.

- Get a free hash calculator like VisualHash.

- Get keys from your friends.

- Verify their keys.

- Encrypt your messages.

Once you understand the basics about public-key cryptography you can use the GnuPG (gpg) client. In case you are using gpg on a Windows® system your fist steps may look like this:

First of all:

(I) I tried to foolproof this thing for inexperienced Windows® users... so readability is somewhat sub-optimal for geeks.

(II) You don't have to use the command line stuff explained in this tutorial, if you resort to graphic user interfaces like Gpg4win or use gpg based tools like the Enigmail add-on for Thunderbird or the OTR plug-in for Pidgin.

(III) However, it may be nice to understand how things actually work and if you're not the fastest typist, you can always paste pre-written command lines into command windows (see below) by right clicking at the end of the current line and selecting »Paste« from the context menu.

Let's get this party started!



The basics

While installing GnuPG make sure you remember its installation directory. Restarting your laptop or PC after the installation will help prevent errors.

In order to pass commands to gpg you will have to open a command window and tell it where gpg.exe can be found. There are two ways to do this:
(1st way) Open the GnuPG installation directory in the windows explorer and go to the »bin« subfolder. Then hold down the shift key, right click on a blank space in that folder and choose from the appearing context menu »Open command window here«.
(2nd way) Hold down the windows key and press R. This will open the run-window. Type in »cmd.exe« and press enter. A new window will open and display a directory. Change that directory to the folder in which gpg.exe can be found, by typing in »cd« and a blank space followed by the directory; something like »cd C:\program files\GnuPG\bin«

You can pass commands to gpg now.



Creating your first key pair

To create your first key pair, type in
»gpg --full-gen-key«
then press enter.

(In some older gpg versions only »gpg --gen-key« will work.)

Gpg will initiate the key generation dialogue in the command window and ask you what kind of key you want (»RSA and RSA« is the recommended option -> type in »1« and press enter). As keysize you should select 4096 bits (type in »4096« and press enter). Next you will be asked how long the key should be valid - aka the key's expiration date. I'll leave that one to you (for example to create a key that lasts for one year type in »1y« and press enter). Confirm the expiration date (type in »y« and press enter). Next you will be asked for your name. In case you're still practicing a pseudonym will do (type in »Testing Tiger« and press enter). Your email adress is next (to practice this, type in »testing@tiger.com« and press enter). You can then add a comment describing what the key pair is for (type in »Practicing key generation« and press enter). You will then be asked to confirm your input (type in »o« and press enter).

Gpg will then start to create a key by generating lots of random numbers. You can help gpg do this by moving around your mouse. Next a dialogue window will open and ask you to type in a passphrase. Create a secure passphrase by making it more than ten characters long, using capital letters, small letters and numbers and not just words, that can be found in a dictionary. For testing purposes something simpler will do (type in »testphrase123« and press enter). You will be asked to confirm the passphrase by typing it in again (type in »testphrase123« and press enter). Key generation may take a few minutes.


The pair of keys is now encrypted and stored in the pgp home directory. Exporting your public key is important to share it with others. Make a simple enough directory on your hard disk for key export (for example »C:\Workbench«). In our example you can then export your public key by typing in

»gpg --armor --output "C:\Workbench\TestingTigerPubKey.asc" --export "Testing Tiger"«
and pressing enter


There are some more things you can do with keys like generating a certificate which allows you to revoke them and backing up your private key. However the resulting files can both be used to compromise your safe communication efforts and have to be kept in a safe place.

Bearing that in mind a revocation certificate can be created by typing in

»gpg --armor --output "C:\Workbench\TestingTigerRevoke.asc" --gen-revoke "Testing Tiger"«
then pressing enter, confirming it again (type in »y« and press enter) and selecting a revocation reason from a list (to choose »Key has been compromised« type in »1« and press enter). You then have the opportunity to add a personal message to the revocation certificate (type in »Uncle Kage tweeted my passphrase« and press enter twice) Confirm your input (type »y« and press enter). A dialogue window will open and ask you to type in the passphrase (type »testphrase123« and press enter).

Private keys can be exported by typing in

»gpg --armor --output "C:\Workbench\TestingTigerPrivateKey.asc" --export-secret-keys "Testing Tiger"«
and pressing enter. A dialogue window will open and ask you to type in the passphrase (type »testphrase123« and press enter).

Keys you generate and export in gpg can also be imported to Enigmail, an elegant Add-on for Thunderbird to encode emails. Enigmail itself can also generate keys, but with more limited options.



Encrypting messages

If you have received the public key from another lifeform and made sure it has not been tampered with (for example by comparing hash-values (tool for that) before and after transmission or using a network of trust) you can encrypt a message to them.

We haven't received any public keys yet. But let's say we did exchange keys with Prancing Puma, got his public key file, saved it to »C:\Workbench\« as »PrancingPuma.asc«, checked its integrity and now want to send him a message. What would we have to do? Import the key to gpg by typing in

»gpg --import "C:\Workbench\PrancingPuma.asc"«
and pressing enter.


As we can't do that yet, we will encrypt a message to ourselves for practicing purposes. To do so you can either send your message to pgp directly via the command line by typing in

»gpg --armor --output "C:\Workbench\practicecypher.asc" --recipient "Testing Tiger" --encrypt«
then pressing enter. After that, you can type in your message and let gpg know, when you are finished by holding down CTRL and pressing C, then releasing CTRL and pressing enter (CTRL+D for Linux users ;).

A more comfortable way to have pgp encrypt a message is to put it in a text file. To do so via notepad, hold down the windows key and press R. Type »notepad« in the appearing window and press enter. Enter your message and save it as »practiceclear.txt« in a directory of your choosing, for example »C:\Workbench«. To encode this message type in

»gpg --armor --output "C:\Workbench\practicecypher.asc" --recipient "Testing Tiger" --encrypt "C:\Workbench\practiceclear.txt"«
and press enter.



Decrypting messages

Say someone has encrypted a message to you with your public key and you want to read it. For practicing purposes we will decrypt »practicecypher.asc« to »practicedecrypted.txt«. In the previous section, we put »practicecypher.asc« in the »C:\Workbench\« directory. So we can now type

»gpg --armor --output "C:\Workbench\practicedecrypted.txt" --decrypt "C:\Workbench\practicecypher.asc"«
and press enter. To confirm we really are the recipient "Testing Tiger", gpg asks us for the passphrase again (type in »testphrase123« and press enter).



Cheers.

about:nerds

For the average furry using encryption and privacy tools means standing on the shoulders of macros. Friendly and helpful macros for the most part, but free spirits who like the GNU prairies better than the backdoored Microsoft® pen. That pen can be more or less patched up against predators, but not against sophisticated attackers or Bill Gates himself.

So why even bother with privacy tools in Windows®? For the same reason as you put a lock on your front door. It won't stop Al Capone, but yellow press reporters... mostly. And maybe even more importantly, with locks on every door criminals will no longer be able to pick valuable targets by just checking for locks. You benefit from the herd.


Usability

Still, macros' tools are not easy to use in a small pen. I certainly paid my dues and here are just a few examples of hilarious realizations after hours on hours of trial and error:
- Restarting your PC after installation will actually solve problems with Gpg4win and Enigmail. It's the 90s all over again.
- The Thunderbird email-client: "Now that this user has downloaded his emails, I'm sure they won't mind me deleting them from the mail-server. Hurr-durr. They could have told me not to during account set-up."
- So to tighten gpg's password management security in Windows® 8.1, I had to create a file named "gpg-agent.conf" containing the lines "max-cache-ttl 5" and "max-cache-ttl-ssh 5" and put it in gpg's home directory in the hidden App-data folder under "C:\Users\USERNAME"? Wouldn't that be something to put in the documentation?
- In order to anonymize your Pidgin chat traffic via an active tor browser, you can change the proxy settings of Pidgin's OTR plug-in to use the "SOCKS5-Proxy" at host address "127.0.0.1" on port "9150". Apparently they thought that was obvious.


Privacy and the authorities

You may wonder if using tools like gpg or tor might attract the attention of law-enforcers or agencies. Personally, I don't think these institutions should be considered a bunch of evil people. They want to do a good job protecting and serving. Of course they hate guys, who abuse anonymity tools to sell drugs online. But they shouldn't resent you for putting your email into a safe envelope.

Seven basic rules...

1. Using RSA with 4096 bits key length is a good idea (as of 2016). Not every app will be able to generate keys of that length, though.
2. Do not use MD-5 or SHA-1 as hash-functions. Use SHA-256 or even better compare the values for multiple hash-functions.
3. Make safe passphrases, for example by using the first letters of a a sentence you remember and throwing in numbers and stuff.
4. Cryptography is about discipline. Human errors break operational security more likely than bad software.
5. Encryption is only as strong as the weakest party involved. If your communication partner runs gpg on Windows®, your live operating system doesn't matter.
6. Trusting proprietary operating systems to protect you from sophisticated attackers is not a good idea. They can and will be forced to cooperate with parties of sufficient influence.
7. When the farm is at stake, only an air-gapped machine with a live operating system will do. Still bear in mind rule number 5 and that 50 years from now some quantum computer might decrypt your messages regardless.

How it works

In short, these days privacy relies heavily on asymmetric cryptography (= Public-Key Cryptography): A message is turned into a random looking code called the "ciphertext", which can only be turned back into the original message by one person. This is achieved by letting that one person make two keys: One public key, that can only be used to lock a message by turning it into the unreadable ciphertext, and one private key, which unlocks the message again by turning it back into a readable form.
The public key has to be shared with the person who wants to send the message, the private key is kept secret. As the private key is never shared, this kind of encryption is extremely hard to break - if done correctly, even impossible with today's computers.
To add an extra layer of security, the private key is stored in an encrypted form. This is why you need a passphrase to use it. The private key is only decrypted, when it's used to decipher a message.


How can I tell if you are, who you say you are?
Does that public key actually belong to the person you want to get the message? To check this, you can either use a network of trust to certify key integrity or do it yourself by condensing the public key file into a short sequence of characters using a hash-function (Link: A tool for that). If your communication partner does the same thing and you compare the resulting sequences (hash-values), you will know if someone tampered with the key. Use different communication channels to send the key and its hash-value. Otherwise an attacker could easily manipulate both.
How can you do this anonymously? If you did all this via tor and don't want to use a second communication channel for fear of deanonymization, you might just use the first messages exchanged to determine your communication partner's identity. For example ask them about a shared secret.


Downfalls

Because of these powerful methods attackers rather try to install backdoors on computers, find errors in software, tamper with key generation, safekeeping or sharing instead of tackling the math behind it. Nevertheless in the future quantum computers are expected to break today's cryptography, which makes it attractive for attackers to just store everything in order to unlock it in the future. Advanced techniques of key generation and key sharing, which implement perfect forward secrecy overcome these shortcomings. However, these techniques appear to have other flaws and there is strong evidence, that their current implementations have been broken. This leads to the paradox situation, that classic asymmetric methods like RSA are the only ones, which can be considered safe in the shortrun.


Further reading

Wikipedia on Public-Key Cryptography