Browse by Topic: Security & Reliability
What is a digital signature?
Last modified on 28 December 2017 04:29 AM

StartMail supports the capability to digitally sign your message to another user using your PGP key pair.

Your digital signature serves a similar purpose as a hand-written signature. It authenticates the source of a message.  Additionally, it timestamps and certifies that the content of a message has not been modified. It provides a way to verify the sender's identity by guaranteeing that the person sending the encrypted email is the owner of a private key that matches the sender's email address. More information can be found in our Technical White Paper here.

A user’s private PGP key is used to sign a message. The signature is verified with the user’s public PGP key. In order to verify the authenticity of the sender’s signature, the receiver must have the sender’s legitimate public PGP key.

If I have access to your private PGP key, I can impersonate you in an electronic message.  Likewise, if you have an altered version of someone’s public PGP key rather than the legitimate public PGP key, I can impersonate that person with that altered key pair.

StartMail provides a setting to digitally sign every email, or you may choose to digitally sign an email while composing it.

1. To enable a digital signature on every email sent via web browser, follow these steps:

  1. From a web browser, log in at https://startmail.com
  2. Click the Settings link from the top right corner of your StartMail page.



  3. From the Settings menu, select Mail Encryption.



  4. Check the box to Always uniquely sign mail.



  5. Click the Save changes button at the bottom of the page.
  6. A confirmation message will be displayed.

2. To choose to digitally sign an email while composing it, follow these steps:

  1. From a web browser, log in at https://startmail.com
  2. Click the Compose button at the top of your StartMail page.



  3. Enter your recipient(s) in the "To:" text box provided; optionally, enter a subject.
  4. Check the Sign with my key pair and Encrypt this email boxes below the subject.



  5. Enter your message in the text box provided and then click the Send button at the top of your StartMail page.
 

NOTES:

- If a sender has digitally signed his or her email, an icon will be displayed next to the sender's name in the email.

  • A green check-mark icon indicates that StartMail has authenticated the sender, using the sender's public PGP key stored in the receiver's PGP keyring.
  • A yellow question-mark icon indicates that StartMail could not authenticate the sender.
  • A red X icon indicates that, although there is a public PGP key stored in the receiver's PGP keyring, the digital signature is invalid. Therefore, the email may have been compromised.
- When you choose to attach your public key to your email, the recipient will receive it in the form of an .asc attachment. The .asc file contains your public key information. For more information, please visit this Support Center article.
-
For more information on PGP encryption, please click here.
(3 vote(s))
This article was helpful
This article was not helpful

Still haven't found the answer to your question? Click here to contact support.