Pretty Good Privacy (PGP)

Today we will try to tell you about what pgp is and how to use it for your own purposes in the Cannazon market onion.

What you need to know about PGP

When you use darknet markets, you have to disclose your personal data, such as the name and address of delivery of the goods. You can also exchange other information that does not directly identify you, but this information is valuable to you and should be stored in a safe place. To make the exchange of this information secure, you need to encrypt your messages.

The Pretty Good Privacy (PGP) program allows you to encrypt the message you need quite easily. In addition to encryption, PGP can also be used to sign messages that can be used for verification and identification.

Let’s see how PGP works

PGP has two types of keys used to encrypt and decrypt messages:

  • Public key used for encryption (must be shared and visible to other users).
  • The private key is used for decryption and signing (you should have access to this key only).
Pretty Good Privacy

To put this in the context of our market, you will encrypt your personal information, such as the delivery address, with the provider’s public key. This public key can be found directly when creating an order, or in the supplier’s profile. The seller can decrypt your message with his private key.

The message can only be decrypted by the provider, since it owns the private key for the corresponding public key with which you encrypted the message. It is important to know that a simple message is never processed by any third party (as in the market), since it is encrypted and decrypted locally. For the same reason, we do not recommend using automatic PGP encryption for orders.

You are probably interested in how you can do this. Continue to the next section to learn how to use PGP on Tails.

How to use PGP in OS Tails

If you use OS Tails, then you have nothing to configure and install on your computer, everything will be ready to use.

Key pair generation

At the first step, you are required to generate a key pair (public and private).

 

  • Click on the clipboard icon on taskbar at the top-right of your screen and select the option “Manage Keys”.
  • On the new window that appeared, click on “File” at the top and select the “New…” option.
  •  From the list of items you can create, choose “PGP Key” and click “Continue”.
  • Then you can enter your “Full Name”. Obviously do not use your real one because everyone who has your public key can see that name later. It is advised to choose the same username that you already have on a market because it will make it easier for your vendor. You can leave the field for “Email Address” blank. Click on “Advanced key options” and set the “Key strength (bits)” to 4096. Finally, confirm the data by clicking on “Create”.
  • You now get asked to set a password which is, in combination with your private key, necessary to decrypt messages that were encrypted with your public key. Make sure to choose a strong password, but do not forget or lose it either.
  • After you clicked on “OK” you will have to wait a bit (usually no longer than a few seconds) and you will see your key in the list of GnuPG keys (click on “GnuPG keys” on the left sidebar).

If you want to use the new PGP key pair, you need to get your public key. Just select your key in the “GnuPG keys” list and press CTRL + C. Now you have the copied public key and you can paste it anywhere.

Saving PGP public key in your account settings

Before you can make your first order at the Cannazon market link, you must save your PGP public key in your account settings.

    • Click on the clipboard icon on taskbar at the top-right of your screen and select the option “Manage Keys”.
    • On the new window that appeared, click on “GnuPG keys” on the left sidebar. Select your key and copy it with CTRL + C.
    • Paste the key with CTRL + V in your account settings. Click on “Update Settings”.
    • Copy the displayed encrypted message with CTRL + C.
    • The clipboard icon should now show a padlock, meaning that the clipboard contains encrypted text. Click on it and select “Decrypt/Verify Clipboard” from the menu.
    • Enter the passphrase for your private key and click “OK”.
    • The decrypted text appears in a new window. Copy it with CTRL + C.
    • Paste the code in the input field and save your public key by clicking “Save PGP Key”.

Importing a public key

To encrypt a message, you must import the seller’s public key (or the one to whom you want to send the message).

  • Copy the public key that is displayed at the checkout page by clicking in the textbox below “Vendor’s Public Key”. Hit CTRL + A to select everything and CTRL + C to copy the public key.
  • Click on the clipboard icon on your taskbar at the top-right of your screen and select the option “Manage Keys”.
  • Click on “GnuPG keys” on the left sidebar and press CTRL + V to paste and import the public key. Click on the “Import button” in the popped up window.
  • You should now see your vendor’s public key in the list.

If you get a pop up with the following error: “Could not display ‘Clipboard text’ Reason: Unrecognized or unsupported data”, then there was a formatting problem with the key you copied into the clipboard. Make sure that you are copying all of the key including the five dashes at the beginning and end of the key and the “BEGIN” and “END” statements. PGP is very picky about formatting errors.

Encrypting a message

To encrypt the message using the public key, follow the instructions below.

 

  • Open a text editor (gedit) by clicking “Applications” and “Text Editor”.
  • Write your message and press CTRL + A and then CTRL + C to copy the message.
  • After that click on the clipboard icon and select “Sign/Encrypt Clipboard with Public Keys”.
  • On the new window, select the public key of the user you want to encrypt the message for (e.g. your vendor) by checking the checkbox in front of the list entry. Click on “OK” to proceed.
  • You will get asked if you trust these keys. Click on “Yes”. Then the windows closes automatically and the encrypted message is stored in your clipboard.
  • Paste the encrypted message e.g. in the order checkout by pressing CTRL + V.

After your message has been encrypted, only a person with the corresponding key (in our case, the seller) can decrypt it.

 

Decrypting an encrypted message

If you receive an encrypted message there is an easy way in Tails to decrypt it. 

  • Select the encrypted text that you want to decrypt. Include the lines “BEGIN PGP MESSAGE” and “END PGP MESSAGE”. Then copy it to your clipboard with CTRL + C.
  • The clipboard icon should now show a padlock, meaning that the clipboard contains encrypted text. Click on it and select “Decrypt/Verify Clipboard” from the menu.
  • Enter the passphrase for your private key and click “OK”.
  • The decrypted text appears in a new window.