Is there a good website on this subject? Or, can someone explain how these things work?
Here’s what I found on a website:
The sender encrypts his message with his PRIVATE key, then sends the message to the receiver. The receiver then decrypts the message using the PUBLIC key.
Well hell, if the key is PUBLIC then anyone can decrypt the message. Right? I think there might be some typos on that website, and that really confuses the issue.
When done this way it is not supposed to keep the message secret.
Think of it as a signature. If you get a message that can be decrypted with a particular public key, you know that it was encrypted by someone who has the “other half” of the key.
If you want to keep a message secret, you do it the other way round, you encrypt with the public key and need the private key in order to decrypt.
(In reality there is an additional layer, the public key algorithm is usually applied to short digests of the message or session-specific keys, but the principle remains the same)
That’s not how it normally works. You sign messages with your private key. That way, anyone who sees the message can use your public key to verify that you did, indeed, send the message.
If you want to send an encrypted message, you sign it with the recipient’s public key. That way, only the recipient can decrypt the message.
Or, if you’re being really secure about things, you do both. Sign a message with your private key, and then encrypt it, signature and all, with the recipient’s public key. You could encrypt first and then sign, too, but then anyone who sees the encrypted message (and has your public key) can discover who sent it.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
By the way, if you’d like to test PGP encryption and signing, you can
download the PGP Freeware software. To give you something to start
with, you can save the following to a text file, and then import it
as a public key:
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP 8.1
mQGiBEEtcB0RBADhH2fJc4QQ6SxBFdkndFRqSSHjdBycrzQmOfHzNpLmrwlm5BYI
tArv1hc8vS3QZb1No46AwY31PJqre9pFV7hFaDdcDUVECMqqziQ/dz7a5vuyXYAv
5fQpLHL+NoHyV4Yw/3uBjgYYw2FMrBD4pQg9AlD/PTeUlHBrMz+3Dra4KQCg/zFL
IZi2TMfHScIcsR5KIkycNI8D/ircBI0w5XXvS7QFp5dcq6YM4gM9gNY+N3Qvem2q
nWOpF28mrMKsaGG6iqBjuenxlyfmg/ew6Vrvr6y/vJa/iwl738Gykj6tENb2BnlR
0E03OS+jwByRIZ6WFUqCekCzAKfhztvmWHQ1Z780cONHUVSsi4lu7tnpz9jXRy4R
ojM+A/9ufz+bfXD6W4pNTdvlSC3xDgleKzOZlEHdTTc6gcrj/EOAYAeKODekfdse
FE2EhqNunbqSPzOvpmbewqn3RhZDrlK+O6IlNo0FuMAWPm2YGEBkFrMFrHs3gLoS
e4zxMxnaRkRqBAx/YyF1VJuKVmPD7tLoajmcs1X6IkjqcADhqLQKSm9lIFJhbmRv
bYkAXQQQEQIAHQUCQS1wHQcLCQgHAwIKAhkBBRsDAAAABR4BAAAAAAoJEOz6CkMx
esnHbHcAnRkh0JdHC4yvfk8qKPkXaKKgHa9QAJ94bmdWXHEFWnDOKL9/9VK/+y5n
6rkBDQRBLXAfEAQAxPGTVHK7pKX0tPtxxmSyv5g8QOdG/RZsnoLe7uCrcHOEYns7
frm2fQsBQTPaglFrH9Vap8O2FdheBjqQmx4FAr7f6BvOdzHOQ88bwO1EXAttvWlo
jwNTsN1aOyK648u79O9grstmcLj0q5hxWwZIIvYWdgisvo38i/Ei4qoOkKcAAgID
/ibiIRI0WVb0twbkX7bAj9nK66QOMaFvjur4BT/aumUnAFz2Hyv31IgnKlTmd8Rw
E+UrduH8vplV1wUInDRlc5uD5W8hSuPW1GxefS7XCbIb4IqyQ2xL8tZ2t2UhhpjY
CRe3/o+d4Ulrs0Xe67i7UN9h5i1nrb4GjaY+CmorCuIPiQBMBBgRAgAMBQJBLXAf
BRsMAAAAAAoJEOz6CkMxesnH850AoLyhJPlctMsY6ycGhXypzwFlmOSPAJsH4K3V
FCJCHVgjFsCygiM+qdk+XA==
=MjAZ
- -----END PGP PUBLIC KEY BLOCK-----
You can then copy this entire post to the clipboard, and verify that
the signature (which can only be generated by my private key) matches
the public key in the post. Of course, since the key is in the post,
it’s a fairly trivial example.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQA/AwUBQS1z1Oz6CkMxesnHEQLNrQCgqv8+zfSuCO/PMf2TMYG/+jngtzUAoLgM
wPnRDs0i9DkEpqJQorgHE6Ux
=qBJN
-----END PGP SIGNATURE-----
:smack: You encrypt the message with the recipient’s public key.
So if you and I are going to do “secret” business, we exchange PRIVATE keys to each other?
No. You should never share your PRIVATE key with anyone. What you do is exchange PUBLIC keys in such a way as to be certain that the public key came from the person in question. Usually email will work, although you could put the key on a floppy disk and trade them in person, if you wanted to be all cloak-and-dagger about it.
Then, when you want to encrypt a message to be sent to that person, you encrypt it with their PUBLIC key. The only thing that can decrypt the message will be their PRIVATE key. That’s the beauty of Asymmetric Encryption; You have two keys, and what is done with one key can only be undone by the other key.
So as long as you keep your private key secure, anyone with your PUBLIC key can verify that a message signed by your PRIVATE key is legit, since the PUBLIC key is the only thing that can verify data that has been signed or encrypted by the PRIVATE key. On the flip side, encrypting a file with someone’s PUBLIC key will ensure that only the holder of the PRIVATE key can decrypt it.
I should also mention the difference between encrypting and signing. Encrypting a message makes it unreadable to everyone except whoever has the mate to the key that did the encrypting. Signing, on the other hand, leaves the message intact and plainly visible to all, and simply appends a signature to the end of the message. Like encryption, this signature can only be verified by the mate of the key that did the signing.
Great info, thanks. I think I have it figured out now. 
However, note that signing and encrypting use the same algorithm. The differences between encrypting a message and signing it lie in what gets encrypted, which key is used for the encryption, and what gets sent to the recipient. When you want to send a private email, you use the recipient’s public key to encrypt the cleartext message, then send him only the encrypted message. When you just want to sign an email, you use your own private key to encrypt a hash of the message, then send him the cleartext message along with the encrypted hash.
In that sense, the OP was correct… almost. You could encrypt a message with your private key, and then anyone would be able to use your public key to decrypt it. It would serve the same purpose as signing the message. But typically, only a hash is encrypted; the recipient uses the sender’s public key to decrypt it, and verifies that it matches the calculated hash of the message (proving both that the sender had the right private key and that the message hasn’t been changed since it was sent).