The Ultimate Guide to Email Encryption with OpenPGP

This guide provides a comprehensive, “terminal-first” approach to setting up robust end-to-end email encryption. By creating your cryptographic keys directly with GnuPG, you build a universal and secure foundation. We will then show you how to integrate this setup seamlessly with both Thunderbird, a user-friendly graphical client, and Neomutt, a powerful terminal-based client.

Changelog

Part 1: Pre-Flight Check – Your System’s Foundation

Before we create any keys, we must ensure your system is correctly configured.

1.1. Install GnuPG

This is the core encryption engine.

• Debian/Ubuntu: sudo apt update && sudo apt install gnupg
• Arch Linux: sudo pacman -Syu gnupg

1.2. Install and Configure pinentry

When a program needs your key’s passphrase, GPG uses a helper application called pinentry to display a secure prompt. On minimal systems like Arch Linux, this might not be installed by default, leading to failures.

1. Install the correct pinentry package for your desktop environment:

   • GNOME: sudo pacman -S pinentry (or sudo apt install pinentry-gnome3)
   • KDE Plasma: sudo pacman -S pinentry (or sudo apt install pinentry-qt)
   • If unsure, the standard pinentry package is usually a safe bet.

2. Tell the GPG Agent which program to use. We will use the simple terminal editor nano for this. Open the file by running:

   nano ~/.gnupg/gpg-agent.conf
   

3. Inside the nano editor, add the following single line. This is the entire content of the file.

4. Save the file and exit nano by following these steps: a. Press Ctrl + X to exit. b. Press Y to confirm you want to save the changes. c. Press Enter to confirm the filename.

5. Reload the agent to apply the new configuration:

   gpg-connect-agent reloadagent /bye
   

Part 2: Creating Your Master Key in the Terminal

We will now create your OpenPGP key using the recommended interactive process.

1. Start the key generation process:

   gpg --full-generate-key
   

2. Follow the prompts. The recommended choices are secure and robust:

   • Key Type: Select (1) RSA and RSA.
   • Key Size: Enter 4096 bits.
   • Expiration Date: Enter 2y (for 2 years). Keys should expire. This is a critical safety net that limits potential damage if a key is ever lost. Don’t worry, you can easily extend the validity before it expires, as shown in Part 3.5.
   • Confirm that the expiration date is correct by typing y.

3. Provide Your User ID:

   • Real name: Enter your full name.
   • Email address: Enter the email address for this key.
   • Comment: You can leave this blank.
   • Confirm your details by typing O (for Okay).

4. Set Your Passphrase: A secure prompt will now appear (thanks to pinentry!). This will be the master password for your new private key.

   ⚠️ PASSPHRASE QUALITY IS CRITICAL

   A weak passphrase makes your encrypted data vulnerable. Consider using a method like Diceware to generate a sequence of random words. If you lose this passphrase, you lose access to all data encrypted with this key permanently.

Congratulations, you have successfully created a secure, command-line-native OpenPGP key!

Part 3: Essential Security Practices (Don’t Skip This!)

Immediately after creation, you must secure your new key for long-term use.

3.1. Identifying Your Key: The Key-ID

From this point forward, we will use your key’s unique Key-ID to refer to it. This avoids any confusion if you ever have multiple keys for the same email address.

1. Find Your Key-ID: Run the following command.

   gpg --list-secret-keys --keyid-format LONG
   

2. Identify the ID: In the output sec rsa4096/YOUR-KEY-ID ..., the YOUR-KEY-ID is the long string of characters you will use in all subsequent commands.

3.2. Backup Your Private Key

A backup is not a backup until it’s tested. Use your newly found Key-ID here.

1. Create the Backup:

   umask 077 && gpg --export-secret-keys --armor YOUR-KEY-ID > private-key-backup.asc
   

2. Verify the Backup:

   gpg --dry-run --import private-key-backup.asc
   

   If this command runs without errors, your backup is valid. Now, store the .asc file in one or more extremely secure, offline locations.

3.3. Create a Revocation Certificate

This is your emergency button. Use your Key-ID to specify which key to revoke.

umask 077 && gpg --gen-revoke --armor YOUR-KEY-ID > revocation-cert.asc

Store this file as securely as your private key backup.

3.4. Verify Keys and Build Your Web of Trust

To trust a key from a contact, you must verify its fingerprint. Use the Key-ID to be specific.

• Find your fingerprint: gpg --fingerprint YOUR-KEY-ID
• Verification: Meet your contact in person or on a trusted channel (video call) and read your fingerprints aloud to each other.
• Web of Trust: Once verified, sign their key (gpg --sign-key contact@email.com). This builds the “Web of Trust” and tells GPG that you vouch for that key’s authenticity.

3.5. Extending Your Key’s Validity (Key Renewal)

An expiring key is a feature, not a problem. You do NOT need to start over. You can easily extend its life before it expires.

1. Start the Key-Editing Process:

   gpg --edit-key YOUR-KEY-ID
   

2. Extend the Expiration Date: Inside the GPG prompt, type expire, enter a new duration (e.g., 2y), and confirm.
3. Save Your Changes:

   gpg> save
   

4. Distribute Your Updated Key: You must re-publish your updated public key.

   gpg --keyserver hkps://keys.openpgp.org --send-keys YOUR-KEY-ID
   

   Also, send a newly signed email with your updated public key attached to your most important contacts.

Part 4: Integration with Thunderbird

1. Open Account Settings and go to the End-To-End Encryption tab for your email account.
2. Click Add Key… and select “Use an existing OpenPGP Key”.
3. Thunderbird will scan your GPG keyring and find the key you just created. Select it and click “Continue”.
4. Confirm that you want to use this key for your account.

That’s it! To allow others to find your public key, upload it to a modern keyserver as shown in Part 3.5.

Part 5: Integration with Neomutt

5.1. Neomutt Configuration

Add these settings to ~/.config/neomutt/muttrc. Here, it is crucial to use the Key-ID to be unambiguous.

# --- GPG/PGP Settings for Neomutt ---
set pgp_verify_sig = yes
set pgp_good_sign = "✅ Good OpenPGP signature from"
set pgp_autosign = yes
set pgp_replyencrypt = yes
set pgp_replysign = yes
set pgp_replysign_encrypted = yes
# Use the Key-ID followed by an exclamation mark!
# This tells GPG to use *exactly* this key.
set pgp_sign_as = "YOUR-KEY-ID!"
set pgp_timeout = 300
set pgp_show_unusable = no

Part 6: Advanced Topic: Handling Multiple Accounts

For maximum security, use separate OpenPGP keys for each email account. This provides strong separation between your digital identities.

1. Create Keys: For each identity (e.g., private, work), repeat the process in Part 2 to generate a new, dedicated key. Make sure to use the correct name and email address for each.

2. Thunderbird Integration: For each account you have set up in Thunderbird, follow Part 4 to assign the correct existing key to the corresponding email address. Thunderbird handles the mapping automatically.

3. Neomutt Integration: Use folder-hook to switch configurations automatically as you navigate your mailboxes.

   • Structure: First, create a directory for your account configurations: mkdir -p ~/.config/neomutt/accounts

   • Main muttrc: Your main ~/.config/neomutt/muttrc will now act as a loader.

     # --- Main muttrc ---
     # General settings (editor, etc.)
     
     # --- PGP Defaults ---
     set pgp_timeout = 300
     set pgp_verify_sig = yes
     set pgp_good_sign = "✅ Good OpenPGP signature from"
     set pgp_show_unusable = no
     set pgp_replysign_encrypted = yes
     
     # --- Account Hooks ---
     # Load a specific config file when you enter an account folder.
     folder-hook 'imaps://private@mail.com/' 'source ~/.config/neomutt/accounts/private.muttrc'
     folder-hook 'imaps://work@company.com/'   'source ~/.config/neomutt/accounts/work.muttrc'
     # Load a default account on startup
     source ~/.config/neomutt/accounts/private.muttrc
     

   • Account Files: Create a separate file for each account inside ~/.config/neomutt/accounts/.

     Example: private.muttrc

     # --- Account: Private ---
     set from = "private@mail.com"
     set realname = "Your Name (Private)"
     set pgp_sign_as = "YOUR-PRIVATE-KEY-ID!"
     set pgp_autosign = yes
     # ... your private imap_user, smtp_url, etc. go here
     

     Example: work.muttrc

     # --- Account: Work ---
     set from = "work@company.com"
     set realname = "Your Name (Work)"
     set pgp_sign_as = "YOUR-WORK-KEY-ID!"
     set pgp_autosign = yes
     # ... your work imap_user, smtp_url, etc. go here
     

Part 7: Quick Troubleshooting

Part 8: Conclusion

By starting with a solid foundation—creating your keys directly in the terminal—you have built a robust and universal encryption setup. This method not only avoids platform-specific pitfalls but also equips you with a deeper understanding of how PGP works. By performing essential maintenance like backups and key renewals, you ensure your digital identity remains secure for the long term.

📚OPENPGP DOCUMENTATION 🛡️GNUPG DOCUMENTATION