Skip to content

PGP Guide for Sending Encrypted Reports

How to verify the fingerprint of the KUTIM-CSIRT PGP key and send encrypted email or files from Windows, Thunderbird, Linux, and macOS.

TLP:CLEAR ·  1 views

Use PGP if your report contains sensitive data, for example logs containing personal data, leaked credentials, or details of an unpatched vulnerability. Emails and attachments encrypted with the KUTIM-CSIRT public key can only be opened with the KUTIM-CSIRT private key.

Key details

UIDCSIRT <csirt@kutaitimurkab.go.id>
Key ID0x57DEB6B955E94D52
Fingerprint3B06 64B5 16FB 69D7 1BB3 5286 57DE B6B9 55E9 4D52
AlgorithmRSA 4096
Created5 November 2024
Valid until5 November 2027
Filecsirt-kutim-publickey-new.asc

Compare the fingerprint through two channels

A public key can be forged if it is taken from only one place. Before using the key, compare the fingerprint shown on your device with two sources:

  1. The RFC 2350 page on this website, item 2.8 Public Keys and Encryption.
  2. The KUTIM-CSIRT RFC 2350 PDF document, which can be downloaded from the same page.

All 40 hexadecimal characters must match exactly. If even one character differs, do not use that key and contact KUTIM-CSIRT by telephone at (0549) 2021207, Monday–Friday 08.00–16.00 WITA.

Download key

Download the .asc file through your browser from the link in the table or from the RFC 2350 page. This site uses a connection check page, so downloading directly with curl or wget may return an HTML page instead of the key file. The same key is also registered on the keys.openpgp.org keyserver with a verified email address. Whichever source the key comes from, the fingerprint must still be compared.

Windows: Gpg4win and Kleopatra

  1. Download and install Gpg4win from gpg4win.org. Kleopatra is installed along with it.
  2. Open Kleopatra, choose File > Import, then select the file csirt-kutim-publickey-new.asc.
  3. Double-click the CSIRT certificate in the list and compare the Fingerprint value with the two sources above.
  4. If they match, you can right-click the certificate and choose Certify so that Kleopatra marks it as verified. This step requires your own key pair (File > New OpenPGP Key Pair).
  5. To encrypt a file, choose File > Sign/Encrypt, select the file, tick Encrypt for others, then choose csirt@kutaitimurkab.go.id. Kleopatra creates a new file ending in .gpg or .asc.
  6. For text, use the Notepad in Kleopatra: write the message, choose the recipient, click Sign/Encrypt Notepad, then copy the result into the body of the email.
  7. Send the encrypted file or text by regular email to csirt@kutaitimurkab.go.id.

Thunderbird (built-in OpenPGP)

  1. Thunderbird version 78 and later includes OpenPGP without add-ons. Download it from thunderbird.net if it is not yet installed.
  2. Open Tools > OpenPGP Key Manager, choose File > Import Public Key(s) From File, then select the .asc file.
  3. Open the properties of the CSIRT key, compare its fingerprint, then in the key acceptance section choose Yes, I've verified in person this key has the correct fingerprint.
  4. Thunderbird can only encrypt if your email account has a private key. Create or import one via Account Settings > End-To-End Encryption > Add Key.
  5. When writing an email to csirt@kutaitimurkab.go.id, turn on Encrypt on the OpenPGP button in the compose window. Attachments are encrypted as well.

Linux and macOS: gpg

On Linux, the gnupg package is usually already installed. On macOS, install GnuPG via Homebrew (brew install gnupg) or the GPG Suite package.

# Impor kunci dari berkas yang diunduh lewat browser
gpg --import csirt-kutim-publickey-new.asc

# Atau ambil dari keyserver memakai fingerprint lengkap
gpg --keyserver hkps://keys.openpgp.org --recv-keys 3B0664B516FB69D71BB3528657DEB6B955E94D52

# Tampilkan fingerprint, lalu cocokkan dengan dua sumber di atas
gpg --fingerprint csirt@kutaitimurkab.go.id

Expected output:

pub   rsa4096 2024-11-05 [SC] [expires: 2027-11-05]
      3B06 64B5 16FB 69D7 1BB3  5286 57DE B6B9 55E9 4D52
uid           [ unknown] CSIRT <csirt@kutaitimurkab.go.id>
sub   rsa4096 2024-11-05 [E] [expires: 2027-11-05]
# Bila cocok, tandai kunci sebagai terverifikasi (tanda tangan lokal, tidak dipublikasikan;
# membutuhkan kunci pribadi Anda sendiri)
gpg --lsign-key 3B0664B516FB69D71BB3528657DEB6B955E94D52

# Enkripsi berkas; hasilnya laporan.pdf.asc
gpg --encrypt --armor -r csirt@kutaitimurkab.go.id laporan.pdf

# Tambahkan diri sendiri sebagai penerima agar Anda tetap bisa membuka salinannya
gpg --encrypt --armor -r csirt@kutaitimurkab.go.id -r nama@example.com laporan.pdf

Without --lsign-key, gpg will ask Use this key anyway? when encrypting. Answer y only if the fingerprint matches. Attach the file laporan.pdf.asc to your email to csirt@kutaitimurkab.go.id.

If you want encrypted replies

Replies can only be encrypted if KUTIM-CSIRT holds your public key. Attach your public key to your first email:

gpg --export --armor nama@example.com > kunci-publik-saya.asc

In Kleopatra, use Export on your certificate. In Thunderbird, use the Attach My Public Key option in the compose window. Without your public key, replies cannot be encrypted.

Notes

  • The email subject line is not always encrypted. Use a generic subject, for example "Incident report".
  • The /lapor form only accepts image and PDF attachments. Send .asc or .gpg files by email; you can still fill in /lapor to obtain a ticket number and mention in the description that the evidence was sent encrypted by email.
  • This key is valid until 5 November 2027. After that, get the latest key from the RFC 2350 page and compare its fingerprint again.
  • Never send your private key or password, encrypted or not.

Report to KUTIM-CSIRT Document repository