PGP protected messages
PGP protected message basics
About signing and encrypting messages
If your email account uses a BlackBerry® Enterprise Server that supports this feature, you can digitally sign or encrypt messages
to add another level of security to email and PIN messages that you send from your BlackBerry device. Digital signatures are
designed to help recipients verify the authenticity and integrity of messages that you send. When you digitally sign a message
using your private key, recipients use your public key to verify that the message is from you and that the message has not been
changed.
Encryption is designed to keep messages confidential. When you encrypt a message, your device uses the recipient’s public key
to encrypt the message. Recipients use their private key to decrypt the message.
To send an encrypted PIN message, you must have a PIN and an email address for the contact in your contact list. Your device
uses the email address in your contact list to locate a PGP® key or certificate for the contact.
Sign or encrypt a message
You can sign or encrypt email and PIN messages.
1. When you are composing a message, change the Encoding field.
2. If necessary, change the Classification field.
Related topics
Some signing and encryption options are not available on my device, 98
Encrypt a PGP protected message with a pass phrase
By default, your BlackBerry® device uses your PGP® key to encrypt messages.
1. When composing a message, change the Encoding field to one that uses encryption.
2. Press the
key > Options.
3. Change the Use Conventional Encryption field to Yes.
4. Press the
key > Save.
Using a secure method, let the recipient know what the pass phrase is.
User Guide
Messages
99
Attach a PGP key to a message
You can attach a PGP® key to email messages and PIN messages.
1. When composing a message, press the
key > Attach > PGP Keys.
2. Highlight a PGP key.
3. Press the
key > Continue.
Download the PGP key used to sign or encrypt a message
If a PGP® key is not included in a received message or is not already stored in the key store on your BlackBerry® device, you can
download the PGP key. If you use the PGP® Universal Server, you might not be able to download the sender’s PGP key, or your
device might download the sender’s PGP key from the PGP Universal Server automatically.
1. In a message, highlight the encryption status indicator or a digital signature indicator.
2. Press the
key > Fetch Sender’s PGP key.
Add a PGP key from a message
If you use the PGP® Universal Server, you might not be able to add PGP keys from messages.
1. In a message, highlight a digital signature indicator.
2. Press the
key > Import PGP Key.
Add a PGP key from an attachment
If you use the PGP® Universal Server, you might not be able to add PGP keys from attachments.
1. In a message, click the PGP key attachment.
2. Click Retrieve PGP Attachment.
3. Click the PGP key.
4. Click Import PGP Key.
Related topics
I cannot open an attachment in an encrypted message, 98
Attachment indicators in PGP protected messages
Indicator
Description
The message includes a PGP® key attachment.
The message includes multiple PGP key attachments.
The message includes a certificate server attachment.
User Guide
Messages
100
Add connection information for a certificate server from a message
1. In a message, highlight the certificate server indicator.
2. Press the
key > Import Server.
View the PGP key used to sign or encrypt a message
1. In a message, highlight the encryption status indicator or a digital signature indicator.
2. Press the
key > Display Sender's PGP Key or Display Encryption PGP Key.
PGP protected message status
Encryption status indicators
Your administrator sets whether messages that you receive are considered to be strong or weak.
Indicator
Description
The message is strongly encrypted.
The message is weakly encrypted.
Digital signature indicators for PGP protected messages
Indicator
Description
Your BlackBerry® device verified the digital signature.
Your device cannot verify the digital signature.
Your device requires more data to verify the digital signature.
Your device trusts the sender’s PGP® key.
The sender’s email address does not match the email address
in the key, or the sender’s PGP key is revoked, is not trusted,
cannot be verified, or is not on your device.
The key status is not current, or your device requires more
data to verify the trust status of the key.
The sender’s PGP key is expired.
User Guide
Messages
101
PGP protected message options
Change your signing and encryption key
Your BlackBerry® device uses your PGP® key to encrypt messages in the Sent Items folder and includes your PGP public key in
messages that you send so that recipients can encrypt their reply messages.
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > PGP.
3. Change the Default Key field.
4. Press the
key > Save.
Related topics
Some signing and encryption options are not available on my device, 98
Change options for downloading attachments in encrypted messages
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > PGP.
3. Do one of the following:
• To download attachments in encrypted messages automatically, change the Allow encrypted attachment viewing and
retrieve encrypted attachment information field to Automatically.
• To download attachments in encrypted messages manually, change the Allow encrypted attachment viewing and
retrieve encrypted attachment information field to Manually.
• To prevent your BlackBerry® device from downloading attachments in encrypted messages, change the Allow
encrypted attachment viewing and retrieve encrypted attachment information field to Never.
4. Press the
key > OK.
Change the default signing and encryption option
Your BlackBerry® device is designed to use the default signing and encryption option when you send a message to a contact
that you have not sent a message to or received a message from previously. If you have sent a message to or received a
message from the contact previously, your device tries to use the signing and encryption option that was used for the last
message.
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > S/MIME or PGP.
3. Change the Default Encoding field.
4. Press the
key > Save.
Related topics
Some signing and encryption options are not available on my device, 98
User Guide
Messages
102
About message classifications
If your BlackBerry® device is associated with an email account that uses a BlackBerry® Enterprise Server that supports this
feature and your administrator turns on message classifications, the BlackBerry Enterprise Server applies a minimum set of
security actions to each message that you compose, forward, or reply to, based on the classification that you assign to the
message. Your administrator specifies the message classifications that you can use.
If you receive a message that uses message classifications, you can view the abbreviation for the classification in the subject
line of the message and the full description for the classification in the body of the message. You can also view the abbreviation
and full description for the classification for a sent message in the sent items folder.
Change the default message classification
To perform this task, your email account must use a BlackBerry® Enterprise Server that supports this feature and your
administrator must turn on message classifications.
Your BlackBerry device is designed to use the default message classification when you send a message to a contact that you
have not sent a message to or received a message from previously. If you have sent a message to or received a message from
the contact previously, your device tries to use the message classification that was used for the last message.
1. On the Home screen or in a folder, click the Options icon.
2. Click Device > Advanced System Settings > Default Services.
3. Change the Default Encoding field.
4. Press the
key > Save.
Change the size of PGP indicators in messages
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > PGP.
3. Change the Message Viewer Icons field.
4. Press the
key > Save.
Change the encryption algorithms for PGP protected messages
If a message has multiple recipients, your BlackBerry® device uses the first selected encryption algorithm in the list that all
recipients are known to support.
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > PGP.
3. Select the check box beside one or more encryption algorithms.
4. Press the
key > Save.
Turn off the prompt that appears before a PGP protected message is truncated
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > PGP.
3. Change the Message truncation mode field to Send Anyway or More All And Send.
User Guide
Messages
103
4. Press the
key > Save.
To turn on the prompt again, change the Message truncation mode field to Prompt User.
Turn off the prompt that appears when you use a PGP key that is not recommended for use
1. On the Home screen or in a folder, click the Options icon.
2. Click Security > PGP.
3. Clear the Warn about problems with my PGP keys check box.
4. Press the
key > Save.
To turn on the prompt again, select the Warn about problems with my PGP keys check box.
Troubleshooting: PGP protected messages
Some signing and encryption options are not available on my device
Try performing the following actions:
• Verify that the email account that you are using supports all signing and encryption options.
• If you use message classifications, verify that the message classification supports the signing or encryption options that
you want. Try using a different message classification.
I cannot open an attachment in an encrypted message
The attachment information might not be available on the BlackBerry® Enterprise Server, your administrator might have set
options to prevent you from opening attachments in encrypted messages, or you might have received the message from an
email account that does not support attachments in encrypted messages.
You cannot open an attachment in a PGP® protected message that was encrypted using the OpenPGP format by an IBM® Lotus
Notes® client working with PGP® Desktop Professional or that was encrypted by the PGP® Universal Server.