Public and Private Keys

PGP Public Keys

Public keys are non-secret keys that are often widely distributed to other users. To encrypt a file to send to someone, you must have a copy of their public key. If you sign the file, the recipient must have a copy of your public key in order to check the signature.

Typically you import the public keys of several other users into your keyring, and export your own public key to send to other users. There is usually little security risk associated with distributing your public key.

Public PGP keys are those for which you lack a private key.

In Web Admin you can import and export keys

PGP Private/Public Keypairs

Private/public keypairs (also known as secret keys or private keys) are keys that are generated by you and that contain information that must not be given to other users. A secret key also contains a copy of an associated public key. You must export the public component of your private/public keypair to allow others to encrypt files to be sent to you.

Although a password is not required, private/public keypairs are typically encrypted with a password.

As a best practice, minimize the number of different secret keys, even though it is possible to have multiple private/public keypairs.

In MOVEit Automation Admin, private/public keypairs are listed as Private because you have the private keys.

Setting Up PGP Keys

When you first install/configure PGP software, you typically do the following, in the order shown:

1. Create a new PGP key pair.

   This is your key pair (or your company's). It consists of one private key and one public key.

   The private key is password-protected and stored securely on your machine.

   The public key is meant to be distributed to anyone else who needs to exchange PGP-encrypted files with you. Typically this key is exported to an ASCII file and emailed as an attachment.

2. Import the keys of partners and customers with whom you want to exchange PGP-encrypted files. Keys imported this way are put on your keyring.
3. Before going into production, test the exchanging files with PGP.

   To run a test:

   • Make sure that both sides (the recipient and the sender) have each other's public key.
   • The sender encrypts the file with the recipient's private key. Optionally, the sender can sign the file with the sender's private key; doing so provides a method to authenticate the sender.
   • The recipient receives the file and decrypts it using their (the recipient's) private key. If the sender also signed with the sender's private key, the recipient can verify the authenticity of the contents by using the sender's public key.