PGP Encryption
detailed guide

🔐 How PGP Works

PGP uses asymmetric encryption with two keys: a public key (shared freely) and a private key (kept secret). Messages encrypted with someone's public key can only be decrypted with their private key.

• Public Key: Share this with anyone who wants to send you encrypted messages
• Private Key: Never share this - it decrypts messages and signs your identity
• Encryption: Use recipient's public key to encrypt messages to them
• Signing: Use your private key to prove a message is from you

💻 Command Line (Linux/Tails)

Generate a new key pair:

Export your public key:

Encrypt a message:

Decrypt a message:

📤 Sending Encrypted Messages

• Import the recipient's public key into your PGP software
• Write your message in plain text (address, instructions, etc.)
• Encrypt the message using their public key
• Copy the encrypted block (starts with -----BEGIN PGP MESSAGE-----)
• Paste the encrypted message into the market messaging system

📥 Receiving Encrypted Messages

• Copy the entire encrypted message block
• Paste it into your PGP software's decrypt function
• Enter your private key passphrase when prompted
• Read the decrypted message

✍️ What Are PGP Signatures?

PGP signatures prove that a message came from a specific person and hasn't been tampered with. Markets and vendors use signatures to authenticate official announcements, mirror lists, and communications.

• Vendor signatures: Verify that messages truly came from the vendor you're dealing with
• Market announcements: Confirm official market communications aren't phishing attempts
• Mirror lists: Ensure .onion links are genuine before accessing them
• 2FA challenges: Many markets use PGP-signed challenges for two-factor authentication

🔍 How to Verify a Signature

• Import the signer's public key into your PGP software
• Copy the signed message (includes -----BEGIN PGP SIGNED MESSAGE-----)
• Use your PGP software's "Verify" function
• Check that the signature is valid and matches the expected key
• A valid signature confirms authenticity and integrity

🚫 Mistakes to Avoid

• Not encrypting at all: The most common mistake. Always encrypt sensitive data like addresses and order details, even if it seems inconvenient.
• Using the wrong key: Make sure you're encrypting with the recipient's public key, not your own. Messages encrypted with your key can only be decrypted by you.
• Weak passphrases: Your private key passphrase should be strong and unique. A weak passphrase makes your private key vulnerable to brute force attacks.
• Storing keys insecurely: Never store private keys unencrypted on your main computer. Use encrypted backups on separate storage devices.
• Using outdated key sizes: Always use 4096-bit RSA keys. Older 1024-bit or 2048-bit keys are considered less secure.
• Trusting unverified keys: Always verify vendor keys from multiple sources. Phishing sites may provide fake public keys to intercept your messages.

✅ PGP Best Practices

• Use 4096-bit RSA keys for maximum security
• Never share your private key with anyone
• Use a reliable, unique passphrase for your private key
• Verify vendor public keys from multiple sources
• Always encrypt shipping addresses and personal information
• Keep backups of your private key in a secure location
• Generate new keys if you suspect compromise

❓ Common Questions

• Why can't I decrypt a message? You can only decrypt messages encrypted with your public key. If a vendor encrypted with someone else's key, or with the wrong key, you won't be able to decrypt it.
• What's the difference between PGP and GPG? GPG (GNU Privacy Guard) is a free implementation of the OpenPGP standard. For practical purposes, they're interchangeable when discussing encryption.
• How long do PGP keys last? Keys can have expiration dates or last forever. For darknet use, most users create keys without expiration and replace them if compromised.
• Can I use the same key for multiple markets? Yes, but consider using separate identities (and thus separate keys) if you want complete compartmentalization between markets.
• Is PGP encryption breakable? With proper key sizes (4096-bit RSA), PGP encryption is effectively unbreakable with current technology. The weak point is usually operational security, not the encryption itself.
• Should I encrypt every message? Encrypt all messages containing sensitive information. For general inquiries, encryption is optional but recommended as a good habit.