Now that we understand how signing works in Pjp and this lecture, I want to show you how to encrypt
messages and sign them as the sender and how to verify the signature as a receiver and then decrypt
the message.
So right here I have John's computer and let's go ahead and send a message to David.
So as we've seen before, the first thing you want to do is open up a text editor and we're going to
type the content of our message.
So I'm just going to say this is a secret side message from John to David.
Now, like we seen before, I'm going to select all of this.
I'm going to copy it.
I'm going to go to my BGP clipboard and I'm going to click on Sign Encrypt Clipboard with public keys.
Next, we want to select the public keys that we want to encrypt the message with.
And like I said, I'm sending this message to David, so I'm going to take him.
You can also take John if you want to be able to decrypt your own message.
And unlike what we did in the previous lecture before clicking on, okay, I'm going to go to sign message.
As if you click on this list, you will see a list of all of the private keys that you have on this
computer.
So this is John's computer.
And as you can see, the only private key that we have is John works.
So I'm going to select that and I'm going to click.
Okay.
It's shown a warning about the key.
It's my own key, so I trust it.
So I'm going to click.
Yes.
And then it's going to ask you to enter the passphrase that you selected when you created this key.
I'm going to hit oak.
And as you can see right here, the icon of the clipboard changed to a lock, which means that now in
my clipboard, I have the encrypted message along with the signature.
So I know in my diagrams in here, when we were sending the message, I said, we're going to send a
message with its signature.
But in reality, both the message content and the signature is all going to be one block of text.
So if I'm back here at my text editor and just paste whatever that is in my clipboard, you'll see.
We'll just get one block of text that contains the content of the message and the signature.
So as we did before, I'm going to go to my email, I'm going to compose a new message, and I'm sending
this to David Smith.
And I'm going to paste the message along with its signature, like I said, and I'm going to click on
Send to send the message.
Now let's go to David's computer, refresh our inbox.
And click on the new email.
We have the message content.
So again, we're going to select all of it right click copy.
And as you can see right here, we can see the lock on the BGP applet one.
Click on this and we're going to click on Decrypt Verify Clipboard.
So the steps are very, very similar to what we did in the previous lecture.
Now it's going to ask me to enter the passphrase for my own key.
For David Smith's key.
And as you can see, we see the content of the message, again, very similar to what we seen in the
previous lecture.
But at the same time, you can see at the bottom in here, it's telling us that this message has been
signed with a good signature of John Wick.
We can also see the key ID and the key fingerprint.
So right now we're sure that the person that encrypted this message, the sender is actually John Wick
and it's not someone else that is pretending to be John Wick.
Not only that, but we're also sure that the contents of this message was not modified as it was transmitted
to us.
Because, like I said, when data is sent over the Internet or over a lot of methods of communications,
it passes through a number of hubs, and each one of these hubs could be modified.
Not only that, it can also be intercepted by a number of methods, and when hackers or agencies intercept
them, they can modify them, implant data or remove some data.
Therefore, when the signature checks out, as we can see in here, if it's verified, that means that
the message was not modified since it was signed by John's private key.
Now you can also see that there is a warning sign saying the key is not certified with a trusted signature.
This is fine.
You can actually ignore the message.
It's just because the key is not set to be trusted.
But what's really important in here is to see if this is a good signature.
Because like I said, if it says it's a good signature, that means that the message was signed by John's
private key and it did not get modified since it got signed by his key.
So right now we have a method to send data in a way so that even if it gets intercepted by any party,
they won't be able to read it.
The only person that will be able to read it is the receiver.
Not only that, but the receiver will be able to verify that this was sent from the person that they
want the message from so they can verify the sender and verify that the message did not get modified
as it was being sent.