Hi, and welcome back to Bitcoin or how I learn to stop worrying and love of crypto. This is a bonus lecture I've decided to make on PGP and secure email. So, since the Prism incident got leaked by Edward Snowden, a lot of people have become much more aware of just how insecure typical communication and activity online is. And actually, in response to this, I'm making an entirely new class called Breaking Out of Prism, Hacker's Guide to the Internet. Uh in this class we'll uh go ahead and discuss many topics such as uh how anonymity works and the darknet uh virtual operating systems and uh USB operating systems like tails. It's going to be a very big very in-depth course and a lot of fun. But until then this is kind of a sneak peek of some of the things that we'll be discussing and uh we'll be discussing how email works. So let's start with an email message. Okay. So, email really has three separate things going into it. First, you have a header, then you have a body, and then you have attachments. Okay? And email really behaves like a postcard. So, postcards have a stamp, they have an address, and then on the back of the postcard, usually you have a little area to write, that's your body, and then you send a message to somebody through the mail. Well, here's the problem. Every person who handles that postcard, unless it's been placed into an envelope, usually they're not, can read the body. So maybe most people are okay with the recipients being known, although there's some problems with that. Most people are not okay with their communications being read or their attachments being viewed. So the purpose of this lecture is to go ahead and discuss how to secure these guys in a way that makes sense. And the thing we're going to do to secure them is use something called PGP. It was invented in 1991 by Philip Zimmer. And PGP stands for pretty good privacy. Very pragmatic title. Privacy. Okay. And basically how PGP is going to work can be best explained by discussing traditional encryption with email. So let's say we have Alice and Bob, our two favorite people in cryptography. So here's Bob. And let's say Bob's a working professional. So, let's give him a tie. There we go. That's my version of a tie. Very fat one. And here's Alice. And we'll give Alice a dress. Okay. Some buttons on that dress. Maybe some glasses. Okay. And because I'm having my Bob Ross moment, we'll put a happy tree right here. Okay. Happy tree. All right. So here's Alice. All right. So if you wanted to use traditional cryptographic techniques to encrypt your message, what you would do is you'd take your email, you'd encrypt it using some sort of block cipher like AES, for example, send it to Alice and this would be very secure. There's no way to break that unless they had that secret key that you use to encrypt it. K. Problem is Alice does not have that secret key K. So, what Alice and Bob would have to do is meet in a park or something like that or maybe meet over by this happy tree and share that secret key. Well, obviously this is not very good because let's say Bob lives in America and Alice lives in Europe. It'll be here and it'll lay here. Well, then that means that there's just no way for them to meet up. So, they can't share the key. So, the whole scheme falls apart. So, pretty good privacy was Zimmerman's attempt and success of creating something a little bit better than just a pre-shared key. What Zimmerman said is, "Okay, what we're going to do is we're going to say that Alice and Bob want to communicate." And we don't even have to assume that Bob has ever met or will meet Alice. Instead, what we do is we say that Alice has something called a public key, and she also has a corresponding private key. So, how the public key works is it's something that's generated. It's a bunch of letters and text. And we're actually going to see what one of these public keys looks like in just a minute. And Bob is going to take his email message that he wants to send to Alice. He's going to find her public key. It's public because she broadcasts it to everybody. Maybe she has a blog or a web page or she posted on her Facebook page. It's going to take that public key, encrypt the body of the email, this guy, and send it to Alice. Okay. Alice is the only person in the world who should have that private key. And because she has that private key, she can break the encryption. And that's basically PGP in a nutshell. And if Alice wants to send an encrypted email to Bob, Bob also needs a public key and a private key. So basically, PGP requires a mechanism to generate a public and a private key pair and it requires you to have the ability to broadcast the world your public key. And in theory, this is very easy in practice. Very few people actually do it. Now, if you want to get a proper really strong awesome implementation, you can go ahead and go to GNU gnupg uh gnu pg.org. And this has a lot of great software that you can download to go ahead and build a public private key pair. But I'd like to tell a story of why this is not so feasible or practical. When Edward Snowden decided to go ahead and leak classified information to the Guardian, he contacted the particular journalist that he wanted to leak to and said, "I have a big story for you. Let's communicate over PGP. Let's encrypt each other's emails and uh let's have that kind of correspondence." Well, the journalist actually did not understand how to implement Open PGP and as a result, he kind of blew off Edward Snowden. And Snowden even sent a kind of a crude tutorial on how to use PGP and the journalist still did not do it. So even people who ought to understand how PGP works, especially journalists who communicate with anonymous informants in practice almost never use it. Most emails sent over 99% are sent unencrypted and are sent without using PGP. So it's a great system. Unfortunately, people just don't use it because it's very hard and it's not very userfriendly. So I'm going to teach you the easy way of using PGP and it presupposes two things. First you are using the Chrome browser which is accessible for Mac, Windows and Linux. Second, you're using Gmail and we're going to use a plugin into the Chrome browser which makes PGP very easy. This plugin is called my mail. All right. So how you find my mail is you go ahead and open a new tab in Chrome. You click on apps and you go to the Chrome app store. You can also copy this web link if you so desire. Okay. So, go ahead and just type in my mail and you'll see this nice little browser extension that's right here. Click on it. And I've already installed it, but if you didn't install it, it will have this little add to Chrome button. Okay? And you'll see it's added right here. All right. So once my mail has been installed, how you access my mail, you click in the upper right hand corner, you click down here on tools and then you'll see extensions. Okay? And if we look right here, you'll see my mail for Gmail. This guy right here. So click on options. Okay? And it'll have this nice little user interface. And what we're going to do is actually construct one of those private public key pairs. and we're going to encrypt and send an email. So, if you click on my keys, you'll notice that I have two keys that I've generated here. One for Satoshi Nakamoto. Oo, that's exciting. And another one is for me, Charles Hoskinson. So, how we generate these keys? So, we click on generate a new key. And I'll just enter a name, John. Actually, let's do Bob. There we go. Email bobhotmail.com. Password 1 2 3 4 5 6 7 8 9 10. Okay. By default, you want to select the 2K key length. You can do a 1K, but those are insecure. Click okay. And you have to wait a moment. And then click on my keys again. Okay. So now Bob has a key. Pretty cool. And if you click on show key, this is actually the private key block. So going back to our picture, that private key that we were discussing that Alice and Bob have, this would be Alice's private key. I guess in this case it's Bob, but this would be the private key. Okay? And that horrible mess of letters, you're not supposed to share this with anybody. And this will be embedded into your browser in a secure folder using JSCrip. And it's uh it works fairly well. Uh actually, it's openp.js. JS is the file that they're using for this implementation. Okay. Now, if you click on friends keys, you can see all the public keys. So, for example, this is my public key and this is Satoshi Nakamoto's public key, and this is the new one that we just generated. Okay. Now, you can also add new public keys by copying and pasting it here, and it'll automatically store it. Now, so far this seems fairly asinine and arcane, but the beautiful thing is once you've done all of this, now you have a public private key pair and we can do interesting things with it. So, let's send Satoshi Nakamoto an email. So, if you click on the show key, this is his PGP key. And what you're going to do is just copy and paste the entire thing. And I'm going to go to my email account and I'm going to send Satoshi an email. Okay? Okay. And I'm going to call it test email. And you copy the block here. You'll notice that this plugin actually modified your Gmail a little bit. There's now this encrypt and sign. Encrypt and assign. So let's just start with the encrypt. Okay. So let's type some sort of message. You'll never read this ever. And let's just go ahead and encrypt it. Okay. And now it's just some sort of horrible message that nobody really can understand or read. And let's send it. Cool. All right. So, I have my Satoshi archive open here. I click inbox and there's our test email. So, notice when we were talking about that header, body, and attachment. So, here's your header, here's your body, and then your attachment. Well, here's the problem. You cannot offiscate the header. That's hard to do because you wouldn't know where to send the email to. So, I can read the subject and I can see who sent me the message, but it's garbage right now. The beautiful thing about this program though is that I can just enter in that password. That's the same password that we went ahead and entered here when you clicked on my keys and you wanted to um generate a new key. That password that you entered to generate, which I recommend writing down because you cannot recover it. We're going to enter that same password right here. And you'll notice something. This right here decrypted. We actually can read it. That's pretty cool, isn't it? All right. So, there's one other thing I'd like to go ahead and do. Um, you'll notice when we click compose, not only do we have this encrypt, we have this encrypt and sign. So, if we go over here and we take a look at that test email, when we go ahead and decrypt it, you'll notice that there's this little my mail crypt for Gmail was unable to verify this message. What does that mean? So, let's go back to our drawing board and let's finish the lecture by discussing signing. So, we know that Bob here, he has a private and a public key. The whole world knows Bob's public key. Anybody can see it. Anybody can use it. It's very fun and interesting. But only Bob knows the private key. So, wouldn't it be really cool if we could take the private key, take an email message, encrypt that email message with the private key, and then somebody can go ahead and use the public key to decrypt that. Ah, now we're on to something. This is interesting because only Bob has the private key and the whole world has the public key. It stands to reason that only person in the world that would be able to do a decryption that would work with the public key would be Bob. This is what's called identity verification. So known as signing a message. So how assigning basically works is that you'll take a message something like send something to Satoshi's archive say signed message from Charles and you don't have to include sign or anything like that and what you would do is you go ahead and say hi I've been signed You'd enter in your password, the same one you created the key with, and click sign. Okay, great. Now, I'm going to go ahead and send this. Check my email. And you'll notice that the message actually has a signature. And I'm able to actually verify that signature with the program. The easiest way of verifying with this particular program is to both encrypt and sign if somebody has a PGP. So let's go ahead and do that. So let's go ahead and send another email to Satoshi's archive. We have the PGP key. And let's see here. sign and encrypt. All right. And I'll write in a message. Hello world from Charles. Okay. So, I'll click encrypt and sign. And voila, we have some sort of hideous message. Okay. We send it to the Satoshi archive. Click inbox sign and encrypt. I get this horrible thing here. Let's go ahead and try to decrypt. Not only was it able to decrypt the message and say hello from Charles, but you'll see this nice little green thing up here that says MailCry for Gmail was able to verify this message. Basically means that the message was signed. Tells you that hey, not only did this person take the time to use my encryption key, used his own key that we happen to know to verify that's his identity. Here's the problem behind signatures. The flaw in the system is that both parties have to know each other's keys. So, if I'm signing this for Charles and you're you, then you're going to have to actually know my public key because that's the only way you're going to be able to verify that private key. So, I'm going to show you one of the most famous of all public keys. This is Satoshi Nakamoto's public key, the creator of Bitcoin. So if you ever wanted to send an encrypted message to him, we could actually go ahead and take this public key, we could go ahead and import this public key into the extension. Where is it? I guess we'll just have to go back to options. Go to friends keys and insert public key. Paste. Submit. Okay. And now we have a new Satoshi Nakamoto public key. And this is the proper public key for actual Satoshi Nakamoto. The only person in the entire world that will be able to sign for this particular message would be Satoshi Nakamoto because he's the only person who has the particular private key. So if somebody comes forward saying I am Satoshi Nakamoto, that person would have to probably sign a message with the private key corresponding to this particular public key block. Okay. So what did we learn today? We learned a little bit about email and how it worked. We learned that email is kind of like a postcard. Uh we learned that email has three components, a header, a body, and an attachment. To encrypt the body, you can use PGP. You also can actually encrypt attachments that way. But a better idea is to actually simply just encrypt the message, the body, and include the private the uh shared key for an attachment and use something like AES crypt to encrypt the attachment. Uh then you have pretty good privacy Phil Zimmerman's implementation and we learned about GNU PGP. Uh and we learned how to use uh mail my mail crypt to go ahead and facilitate the entire turnaround process. The encryption decryption very easy to use very easy to share with your friends easy to store and use your public keys and uh encryption and decryption is incredibly simple. Okay. So, that is PGP in a nutshell. I hope you learned some things. Uh, if you have any questions, comments, or concerns, just shoot me an email or go ahead and send me a u send me a comment on the course and I'll try to answer it as quickly as possible. As always, have a wonderful day and thank you so much for listening.
