PGP encryption

You encrypt and sign your messages end to end with OpenPGP. Only the recipient can open the encrypted content; not even the server administrator can read it.

If your organisation enabled itFirst setup ≈ 3 minutes

1. Creating your key (once)

1. Click PGP in the Zimlets panel at the bottom left. The PGP Keys window opens; if you have no key yet it says No PGP key found.
2. Type a key passphrase different from your webmail password in Passphrase.
3. Press Generate key pair and wait a few seconds.

PGP (1), the key passphrase (2) and Generate key pair (3)

1. When you see PGP key active (fingerprint: …), note the fingerprint and close the window with OK.

Do not forget your key passphrase

The passphrase is not stored on the server. If you forget it, your old encrypted messages can never be opened again.

2. Unlocking in every session

Your key is stored on the server, locked with your passphrase. Each time you sign in or reload the page:

1. Click PGP in the Zimlets panel.
2. Type your key passphrase and press Unlock.

3. Sending an encrypted message

1. Make sure the key is unlocked, then press New Message.
2. Type the recipients in To (and Cc if needed). Do not use Bcc.
3. Put confidential information in the body; the subject line is not encrypted.
4. Click Encrypt on the toolbar; the button turns into Encrypted.
5. Press Send.

To (2), Encrypt (4) and Send (5)

The message is encrypted with the recipients' keys and signed with yours. If anything goes wrong, the message is never sent unencrypted; it stays on screen and tells you why:

Message	What to do
No PGP key found for: …	An internal recipient must create a key; import an external recipient's key (below), or switch Encrypt off and send in plain text.
Key is locked. Unlock the PGP key from the zimlet panel, then Encrypt is available.	PGP › Unlock, then Encrypt and Send again. If you have no key yet, generate one first as in step 1.
Bcc is not supported for encrypted sends.	Remove the Bcc recipients.
"Send later" not supported	Remove the schedule.

4. Reading an encrypted message

Open the message; if your key is locked you see Unlock your PGP key (PGP panel) to view this message. After unlocking, the message is decrypted and the signature status is shown:

• Green: Signed by … — signature valid.
• Red: the signature is invalid or the sender's key is unknown. The content was opened but the sender could not be verified.

When replying, switch Encrypt on again in each window; it starts off.

Recipients outside your organisation

To write encrypted mail to someone at another organisation (using GPG or Thunderbird), import their public key:

1. Ask them for the public key block that starts with -----BEGIN PGP PUBLIC KEY BLOCK-----.
2. In the PGP window, scroll down to Recipient keys (outside this server).
3. Paste the block into Recipient public key (armored) and press Import key. If you leave Recipient e-mail empty, the address is read from the key.

The recipient keys section (2), the key field and Import key (3)

1. Confirm the fingerprint with the other person by phone or in person.
2. Copy your own public key with Show my public key and send it to them so they can reply encrypted.

Limits

Attachments and the subject line are not encrypted. Drafts saved while Encrypt is on are stored as plain text and deleted after a successful send. Outlook and phone apps do not decrypt these messages; use webmail.