Enigmail is a mailer plugin to encrypt/decrypt mails (using GnuPG).

Enigmail uses GnuPG (also called GPG), so make sure GPG is installed.

• Debian: apt-get install gnupg
• Windows: get it from GPG4Win

Then, make sure your mailer is supported by Enigmail. At the time I write this article, Outlook is not supported

The rest of this article applies to Enigmail with Thunderbird.

Download Enigmail. For Thunderbird, it's a (extension .xpi). Use a right-click to download it (if you click on it with Firefox, you'll install the plugin in Firefox which is quite useless !).

• Then, install the plugin in Thunderbird: Tools → Extensions → Install
• Restart Thunderbird

Enigmail is configured directly from within Thunderbird. There are two menus to check out:

• OpenPGP → Preferences:
  • Basic settings: check or set GPG's executable path. If you don't have a clue where it is:
    • On Linux, locate gpg (whereis gpg, which gpg, locate gpg…). Typically, it'll be in /usr/bin.
    • On Windows, search for gpg.exe. Typically, something like c:\program files\gnupg\gpg.exe
  • If you only see the Basic tab, but no other, check the “expert” mode in the Basic tab.
  • Sending: enable
    • “Encrypt to self” (makes sure that you'll be able to re-read encrypted emails you've sent to your recipients !),
    • “Always trust user ID”,
    • “Always confirm before sending” (I like to make sure I'm sending confidential stuff to the right person !),
    • “Rewrap signed HTML before sending”,
    • “allow empty subject” (just to avoid the warning when subject is empty)
  • Key selection: display selection when necessary (only shows the key selection window when it does not know which key to choose)
  • Advanced: encrypt if replying to encrypted message (seems a good thing)

• Edit → Account Settings → OpenPGP Security
  • Enable OpenPGP support (enigmail) for this identity
  • Use email address of this identity to identify OpenPGP key.

Thunderbird → OpenPGP → Key Management → Generate → New Key Pair

For example:

• Choose expires in 5 years (I do not recommend “does not expire”)
• Choose your passphrase. A passphrase is a long password, a sentence. Choose something you can type easily, but don't choose anything too short: your key pair might get compromised, and then the attack can sign under your Id, decrypt your emails etc.
• You can use default settings for other parameters, though I prefer using an RSA key than DSA (in the Advanced panel)

From Thunderbird, write a new message. Click on the message's OpenPGP menu: “attach my public key”. That's all.

Now, if you insist on doing it the hard way :

• Thunderbird → OpenPGP → Key Management

• Select your key
• Then File → Export Keys to File.

• When it asks “Do you want to include your secret key…” of course, you answer No (IMPORTANT !).
• Then you include the resulting file in your mail.

• Right click on the attached key in the mail → Import OpenPGP key

• Thunderbird → OpenPGP → Key Management → File → Import keys from file
• Select the file containing the keys to import

A key pair is made of a private key (private meaning “secret” - do not send this to anybody) and a public key (this one is not confidential). Both keys are related so that when an operation is done with the private key, you need the public one to reverse the operation, and reciprocally if you use the public key, you need the private one to revert.

Encrypting a document is about its confidentiality. When I send a document to my husband, I don't want Pico to read it. So I encrypt it in a way that only my husband can read it. Now, just think two seconds how to do that… it's easy: I encrypt it with my husband's public key. Indeed, my husband keeps his private key safely, Pico does not have that key. So my husband will be able to decrypt the document but not Pico ! A common mistake is to encrypt a document with your own public key. Actually, this is really silly, because you're the only one to be able to decrypt the document. Your recipient does not have your private key !

Signing a document has a different use: it's about document's authenticity. Now imagine I want to send a nice recipe to my husband. How can he be sure this recipe is authentic and hasn't been modified (with arsenic ?!) by Pico ? To guarantee this, I sign the recipe with my private key. If I am able to use my private key successfully, it means I really signed (i.e approved) the document. When my husband gets the document, he verifies my signature using my public key. If that works, he's guaranteed the document was signed by someone owning my private key… if I keep my private key secret, he's guaranteed this is really me.

You can skip this if you're out of time.

Now, actually, if you really have a close look to my last scenario, there's something nasty Pico could do. How does my husband retrieve my public key ? Can he really be sure it's mine ? Just imagine Pico sends him a fake email with his own public key instead, signs a bad recipe with his private key and sends the signed recipe (using another fake email) to my husband… My husband's going to verify a valid signature and he'll think it comes from me… though it's only really an authentic recipe of Pico's !

To counter this problem, people commonly use certificates. A certificate can basically certify anything, but here we're interested in certifying public keys. A certificate certifies that my public key (for e.g id=01298) really belongs to me (and not Pico). This is usually certified by a third party (hoping that third party asks for the adequate proof of my identity). I'm not getting into details here as to how certificates are generated and how they are verified, but it's just to let you know that they do exist and are really useful…

Very easy:

• Write a message (as usual)
• Click on the small key on the bottom right corner of the message window
• Send the message, that's it !

Depending on your configuration, another window may be displayed asking you confirm/select your recipient's key. This also happens if Enigmail can't find the right key to use for your recipient. If the key isn't in your keyring, import it. Sometimes it's already there, but not for the right email: you can still use that key. A key is attached to an end-user , not to an email. Email is just a common way of naming a key.