Quote from: MAbtc on December 06, 2013, 01:00:43 AM

Sorry in advance for the book. As I thought about it, it felt easier just to go through the motions of thinking about why this is important and how it works.

OK, on PGP. Yes, it is complicated, but I doubt it is beyond your skill set. Simply a new process to learn. Before thinking about encryption, it would be good practice now to consider learning how to ensure that what you think you are downloading is what you are actually downloading. This is especially important when dealing with software that could potentially target your wallet(s).

This is a taste of what it means to verify the integrity of and to authenticate certificates for files downloaded. In turn, that will necessitate creating a PGP keypair, and may prime you for working with PGP keys to encrypt your files.

So, a Windows user would go to http://gpg4win.org/ and download the full version. You can google the site for its web reputation. You can verify the integrity of the download using Microsoft's fciv utility found here: http://support.microsoft.com/kb/841290

When you unzip fciv, drop fciv.exe into C:\Windows. That way you can pull up Command Prompt (Accessories) and run fciv.exe from any location. So to verify the integrity of your gpg4win download, pull up Command Prompt, and enter "fciv [____.exe] -sha1" where [] = the exact file location of the gpg4win binary. This should produce a sha1 checksum that you can compare with the checksum found here: http://gpg4win.org/package-integrity.html

If your binary downloaded properly, these sums should match. That is about the extent of due diligence you can do prior to using encryption/decryption. Now that you have verified the integrity of the download, install gpg4win and run Kleopatra. You can now authenticate the download from gpg4win. You would create a new certificate, select PGP keypair, and input your desired user information and password. Once the certificate has been created, back it up and keep your information safe. You can now use this certificate to certify the earlier download.

You do this by downloading (and subsequently verifying) the release signature of the download, found next to the file you downloaded, here: http://gpg4win.org/package-integrity.html Download the corresponding .sig file into the same folder as the original download.

As stated, the signatures have been created with the following OpenPGP certificate:
Intevation File Distribution Key (Key ID: EC70B1B8) -- if you go to that source, you can scroll down to "Intevation-Distribution-Key" and download it (it is an .asc file). Then you "import certificate" and select that file. Verify that the fingeprints match, then you can certify it with your own key.

Now, you can go to File | Decrypt/Verify. Select the .sig file that you downloaded (you'll see that it corresponds to the .exe file in the same folder) and verify. You should now be able to validate the certificate -- giving you confidence that you have the original and unmodified file and not some malicious replacement.

......So now you know how to verify the integrity of your downloads and create a PGP certificate to authenticate those downloads.

Now, encrypting files with PGP is very easy and only one step away. But before encrypting anything -- make sure that your keypair is backed up and your password is SAFE and will not be lost. (It would be tragic to encrypt the directory housing your wallet without realizing the importance your PGP password in decrypting it later on.) Also, when encrypting, remember to encrypt to your own certificate -- otherwise your private key is useless to decrypt it.

Here is a straight-forward tutorial on signing and encrypting files in Kleopatra: http://www.gpg4win.org/doc/en/gpg4win-compendium_24.html

Again, I know it is a lot to take in. But if you are going to be holding an amount of money significant to you on your machine, another layer of encryption can provide great peace of mind.

Currently downloading Gpg4win; just before I continue, what exactly is this going to do? I'm not sure I understand why I've got to do this.

Because I already have passwords for my Electrum wallet, and the wallet names I was assigned seem pretty complex. Is this whole process just going to add another layer of passwords around the software, the file or both?

Quote

You can set up cold storage on a USB drive, sure. With QT, for instance, just back up the wallet.dat file on the USB -- preferably, the wallet should be generated initially offline, the wallet should be encrypted before stored, and all files on the drive encrypted.

I actually cannot find a wallet.dat file; I did a full hard drive search. It's not on my USB drive either; all that appears on my USB is the Electrum program; and yet there appears to be Wallet ID's under the received tab.