5

I have a requirement to encrypt a file, get it to an external partner who will then decrypt the file using a key.

My "basic" understanding is that I can generate the public and private keys, encode the file using the public key and our partner can decrypt using the private key we give them. But this sounds a bit strange to me that we would be sharing the private key. There is just one trusted partner.

Am I missing something?

  • 2
    No; You generate 2 keys; Your friend generates 2 keys; They send you the public key; you send them your publix key; Now you encrypt the file with their public key, and they decrypt it with their private key, and send you an encrypted message with your publix key and you decrypt it with your private key any other method isn't secure.... – Ramhound May 19 '16 at 23:19
  • Beginners’ Guide To PGP – DavidPostill May 19 '16 at 23:33
  • You share your public key only and this is what they encrypt data with before they send it to you. You encrypt data for them with their public key before you send it to them. The public key is just that, public so anyone can have it safely to encrypt files-never the private it always stays private. It's like you give them the lock to lock the file but only you have the key; the public key is like a lock (anyone can use the lock) and the private key is like the key that only the ones meant to unlock it can unlock it with; so with PGP file-level encryption at least that's a simple analogy. – Pimp Juice IT May 20 '16 at 0:18
  • Why was this downvoted? Honest question - my understanding was incorrect - thats why I posted and it may prevent others making a mistake. Thanks to those that offered a constructive response. – Steve Ward May 20 '16 at 0:19
  • @JUICED_IT Could you add your comment as an answer, it is correct. – Paul May 20 '16 at 0:37
11

PGP Encryption - How public and private keys work

You share your public key only and this is what they encrypt data with before they send it to you. You can also encrypt data for them with their public key before you send it to them.

The public key is just that [public] so anyone can safely have it to encrypt files but never the private as it always stays private with the person that needs to decrypt the files.

Typically you will configure your PGP software and generate a key pair. Essentially you will have a private key and a public key and this is the key pair.

You should keep the private key in a secure place with limited access, and you can share the public key with other entities that have PGP encryption/decryption functionality on their end that you wish to exchange files with this technology.


PGP File-Level Encryption Simple Analogy

It's like you give them the lock to lock the file (your public key) but only you have the key to unlock it (your private key).

  • The public key is like a lock and anyone can use the lock to [encrypt] lock files
  • The private key is like the key to the lock and only the ones meant to [decrypt] unlock it can and have the private key to do so.

Examples

  1. They encrypt files with your public key and then send those files to you and only you have the private key from that key pair to decrypt these files.
  2. They encrypt files with your public key and then send those files to some company that was not supposed to get the data. This company does not have the private key to decrypt this data so the data was not exposed.

  3. You encrypt files with another entity's public key and then send them the files afterwards and only they can decrypt these files with their private key from their key pair.

  4. You encrypt files with another entity's public key and then send the files to the wrong company but they cannot decrypt the data as they do not have the private key to do so and therefore no data is exposed.


Further Reading

5

Consider the private key and actual key, and the public key a padlock. Whoever you hand over the padlock can close something (for example, a vault containing the secret message), and only you (keeping the private key safe) can open it again.

Example for public/private key cryptography

And remember the padlock is digital: it is easy to replicate it an unlimited number of times. In fact, you often share it in some public directory to everybody who wants to have it.

My "basic" understanding is that I can generate the public and private keys, encode the file using the public key and our partner can decrypt using the private key we give them. But this sounds a bit strange to me that we would be sharing the private key. There is just one trusted partner.

It's the other way round: The recipient generates the key pair, and passes the public key ("padlock") to you. Now, only the recipient can decrypt the message, as he's the only one holding the private key.

Additionally, you don't have to care on a man in the middle getting hold of the private key -- and if he intercepts the public key, he still cannot read messages. Just make sure to verify the fingerprint after receiving the public key (for example by phone), to make sure the public key was not replaced during transmission.

Additionally to encryption, you can also sign messages, so the other party can verify the sender. In this case, also you would generate a public/private key pair. Signing pretty much works the other way round (the analogy with the padlock doesn't work out any more for signing), consider it encryption with the private key (which only you can do, as it is kept secret). If the recipient can decrypt the message (or usually, a hash sum of the message) using your public key, he knows it must have been you that signed the message.

2

Additional usage: 5: you (additionally) encrypt the file with your private key. It can only be decrypted with your public key. The receiver can be sure you are the sender.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.