PGP encryption help

[Homerboy]

We have a client who is wanting to do PGP encryption for emails between us and them. As I am new to PGP, I had to do a lot of digging/reading and I figured there would be a 'universal way" to set up that ANY email heading out of our email server to domain XYZ.com would be encrypted using a PGP key for our entire domian (ABC.com) and in turn vice versa on them sending us emails... however this "universal" set up doenst seem to exists.

From what I can tell an email has to be manually clicked in the email client to encrypt before sending it to whatever recipient. (sadly my offices use Outlook)

#1 is what I jsut stated above all true?
#2 In this case, is it best to set up 1 company PGP key for my company and have everyone here use that single key to encrypt to the client XYZ.com so that one 1 set of key(s) is needed, rather than 1 key for every user on each end.

Any and all info is appreciated.

Thanks.

 

[Mark R]

There are a number of UNIX programs that connect PGP to mail servers allowing automatic encryption of mail - though I don't know how well easy they would be to integrate into a windows based server back-end. As some of them are open source, it should be possible to recompile as required.

If you are using PGP for windows, then the Outlook plugin does have an option to encrypt by default outgoing mail. I have version 6.5.8 and it certainly has that option. If your recipient doesn't have PGP (or you don't have their key) then the setting is ignored.

You also misunderstand how PGP works - to send a message from your domain (ABC.com) to your client (XYZ.com) - you need to have a copy of XYZ.com's encryption key. If within XYZ.com each employee has their own key (the only sensible option) then you will need to have copies of each one that you wish to send to. This is made easier by multiple publicly available PGP key servers to which you can send your keys. Should someone wish to correspond securely with you, their PGP can automatically retreive your key from the server when needed.

Similarly, you should issue individual keys to each of your employees - because that way you should your messages be digitally signed, you can prove beyond reasonable doubt that one specific employee wrote that message - not just the company.

There are options available to add a second password to a users key in case they forget their password or if they leave and they have encrypted e-mails which need to be accessed by a third party.

PGP is a useful tool, but it needs to be setup and used correctly - it can be counterintuive, but if you want to use encryption you need to use it properly as one mistake can cost you all your security. There are some excellent online references, and the PGP manual itself is excellent. You should also strongly consider getting some good reference books, and most importantly make sure you understand how PGP works before you deploy it.

 

[Homerboy]

Wow thanks for your detialed response Mark. Helps a ton and the "authentication" aspect is a great point.

However, I think you miss-understood my understnading though... I DO understand I need XYZ.com key(s) and vice versa... but my point was that why not have that BUILT INTO the sending or recieivng server. Remove the possible point of failure of having the person writting the email even have to THINK of hitting "encrypt" before sending. You should be able to say (on the email server) "ANY email being sent FROM msmith@abc.com AND is destined for XYZ.com (or LMNP.com etc etc) should be encrypted with msmith's Key". ..and in return, on the receiving email server just check ANY incoming email from msmith@abc.com for encryption and use (the stored) msmiths key too decrypt.

Does that make sense? I guess Im trying to skip that "encrypt" button within the senders email client. It just seems like it could be all done automatically. IE: I dont trust my users to think that much

 

[Mrburns2007]

We just use hushmail.com to send mail back and forth cause it's easier for the noobs.