Managing PGP Keys
Your keys, other people's keys, and signing and encrypting from the composer.
Two Kinds of Encryption
CodaMail offers PGP in two places, and they solve different problems:
- Manage PGP Keys (this page) is end-to-end encryption between you and a correspondent who also uses PGP. You sign and encrypt messages you send, and decrypt and verify messages you receive, in the webmail.
- Auto-Encryption encrypts incoming mail to your own key as it arrives, so even mail that was sent in the clear is stored encrypted and readable only with your private key. Encrypted mail cannot be searched by content, so it is usually applied to selected aliases rather than everything.
Turn the webmail side on under Settings → Preferences → Encryption (Enable message encryption and signing, signatures verification, decryption). The options there are explained in Preferences Explained.
Your Key Pair
Open Settings → Manage PGP Keys. If you do not have a key yet, click Create a new key pair: pick the Identity (address) the key is for, a Key type (RSA 2048 bits, RSA 4096 bits, or ECC elliptic curve; RSA 4096 or ECC are the stronger choices), and a Password that protects the private key. The pair is generated and stored in your CodaMail keyring.
If you already have a key from another program, use Import key(s) and upload the exported file, which may contain the private key too. Export key(s) downloads your public key to give to others; the export prompt also offers Export Secret Keys to include the private key when you are moving to another device. Guard that file.
The key's password is what the webmail asks for when it decrypts or signs. Keep private key passwords for in the Encryption preferences decides how long it is remembered.
Other People's Keys
To encrypt to someone you need their public key. Three ways to get it:
- When a message arrives with a key attached, the message view says This message contains attached PGP key(s) with an Import key(s) button.
- Ask them to send you their public key file, and import it on the Manage PGP Keys page.
- Import a file you downloaded from their website, or use Search on key server(s) on the toolbar to look a key up by name or address and import it directly.
Click any key in the list to see its ID, fingerprint, user IDs, subkeys and expiry. Compare the fingerprint with one the owner gave you by another channel before trusting a key that arrived by email. Remove deletes a key from your keyring.
Sending and Receiving
In the composer's options panel (the sliders icon), tick Digitally sign this message, Encrypt this message, or both. Encryption requires a public key for every recipient; the composer tells you if one is missing. Attach my public key includes your key so the recipient can reply encrypted. Defaults for all three are in the Encryption preferences.
Incoming signed mail shows a verification result above the message: valid, invalid, or signed by a key you do not have. Incoming encrypted mail asks for your key password, then shows the decrypted text. Encrypted messages are stored encrypted; the webmail decrypts them for display only.
If you prefer to keep your private key in your browser rather than on the server, the Mailvelope extension is supported: install it and tick Use Mailvelope main keyring in the Encryption preferences.