🔑 PGP Encryption & 2FA

🔐 What is PGP?

PGP (Pretty Good Privacy) is encryption software that uses two keys:

• Public Key: Share with others - they encrypt messages for you
• Private Key: Keep secret - you decrypt messages meant for you

Why DrugHub Requires PGP

1. Mandatory PGP Login: Proves you control the private key
2. Address Encryption: Shipping addresses must be encrypted
3. Secure Communication: Messages with vendors are encrypted
4. Signature Verification: Verify you're talking to real admins/vendors

📥 Installing PGP Software

Windows: Kleopatra (Gpg4win)

1. Download from official site: gpg4win.org
2. Run installer, select "Kleopatra" component
3. Complete installation
4. Launch Kleopatra from Start Menu

macOS: GPG Suite

1. Download from: gpgtools.org
2. Run installer package
3. Complete installation
4. Launch GPG Keychain

Linux: GnuPG (Usually Pre-installed)

🔑 Generating Your PGP Key Pair

Using Kleopatra (Windows/Linux GUI)

1. Open Kleopatra
2. Click "New Key Pair" → "Create a personal OpenPGP key pair"
3. Fill out form:
   • Name: Use pseudonym (e.g., "DrugHubUser2025")
   • Email: Fake email or leave blank (e.g., "user@localhost")
4. Click "Advanced Settings"
5. Set:
   • Key Material: RSA
   • Key Size: 4096 bits (REQUIRED by DrugHub)
   • Valid until: Never expires OR 2+ years
6. Click "OK" then "Create"
7. Enter strong passphrase (20+ characters, store in password manager)
8. Wait for key generation (may take 1-2 minutes)

Using Command Line (Linux)

📤 Exporting Your Keys

Export Public Key (Share with Others)

Kleopatra:

1. Right-click your key → "Export"
2. OR: Right-click → "Copy" → "Copy Public Key"
3. Paste into DrugHub registration form

Command Line:

Backup Private Key (CRITICAL)

Kleopatra:

1. Right-click your key → "Export Secret Keys"
2. Save to encrypted USB drive or secure location
3. NEVER upload to cloud or email

Command Line:

Storage Recommendations:

• Store on encrypted USB drive
• Use VeraCrypt encrypted container
• Multiple offline backups in separate locations
• Never store on cloud (Dropbox, Google Drive, etc.)

🔒 Encrypting Messages

Encrypting for Others (e.g., Shipping Address for Vendor)

Step 1: Import Recipient's Public Key

Copy vendor's public key from their profile → Kleopatra → "Import" → Paste

Step 2: Encrypt Your Message

Kleopatra:

1. Click "Notepad" icon (Encrypt/Decrypt Notepad)
2. Type your message (shipping address, etc.)
3. Click "Encrypt"
4. Select recipient's public key
5. Copy encrypted message (starts with -----BEGIN PGP MESSAGE-----)
6. Paste into DrugHub order form

Command Line:

Example Encrypted Shipping Address

🔓 Decrypting Messages

Decrypting PGP Login Challenge

When you login to DrugHub, you'll receive an encrypted challenge. Here's how to decrypt it:

Kleopatra:

1. Copy the entire encrypted message from DrugHub (including headers)
2. Open Kleopatra → Click "Decrypt/Verify"
3. Paste the encrypted message
4. Enter your PGP passphrase
5. Copy the decrypted code (usually 6-8 characters)
6. Paste code back into DrugHub login page

Command Line:

✍️ Signing & Verifying Messages

Why Signatures Matter

Signatures prove a message came from the key owner. Always verify admin/vendor signatures to prevent phishing.

Verifying a Signature

Kleopatra:

1. Copy signed message
2. Click "Decrypt/Verify"
3. Paste message
4. Check result: ✓ Valid signature from [Name]

Signing Your Messages

Kleopatra:

1. Open notepad, type message
2. Click "Sign"
3. Select your key
4. Enter passphrase
5. Copy signed message

📱 Two-Factor Authentication (2FA)

Setup 2FA on DrugHub

1. Login to DrugHub
2. Navigate to: Settings → Security → Two-Factor Authentication
3. Click "Enable 2FA"
4. Scan QR code with authenticator app:
   • Recommended: Authy, Aegis (Android), Raivo (iOS)
   • Avoid: Google Authenticator (no backups)
5. Enter 6-digit code to verify
6. SAVE BACKUP CODES - Store in password manager

Using 2FA for Login

1. Enter username and password
2. Decrypt PGP challenge
3. Enter 2FA code from authenticator app
4. Successfully logged in

🔧 Common PGP Issues

🎯 PGP Best Practices

• ✅ Use 4096-bit RSA keys minimum
• ✅ Create strong 20+ character passphrase
• ✅ Backup private key to multiple offline locations
• ✅ Enable 2FA on DrugHub account
• ✅ Save 2FA backup codes
• ✅ Verify signatures on admin/vendor messages
• ✅ Use different PGP key for DrugHub (don't reuse personal keys)
• ✅ Test encryption/decryption before first order
• ❌ Never share private key
• ❌ Never upload private key to cloud
• ❌ Never email private key
• ❌ Never reuse PGP key from clearnet identity

📚 Advanced PGP Concepts for DrugHub Users

Understanding Key Fingerprints

Every PGP key has a unique fingerprint - a 40-character hexadecimal string that acts as the key's digital identity. On DrugHub Market, fingerprints are critical for verifying vendor and admin authenticity. When you receive a message claiming to be from DrugHub support or a vendor, always compare the signing key's fingerprint against their publicly listed fingerprint on the marketplace.

How to view a key fingerprint in Kleopatra:

1. Right-click the key in your keyring
2. Select "Details" or "Certificate Details"
3. Find the "Fingerprint" field
4. Compare character-by-character with the official fingerprint

Key Trust Levels and the Web of Trust

PGP uses a decentralized trust model called the "Web of Trust." While DrugHub doesn't require you to build an extensive trust network, understanding these concepts helps you evaluate key authenticity:

• Unknown Trust: You haven't verified this key belongs to who it claims
• Marginal Trust: You have some confidence but not full certainty
• Full Trust: You have personally verified this key belongs to the claimed owner
• Ultimate Trust: Your own keys (you trust yourself completely)

For DrugHub operations, treat vendor keys as "Marginal Trust" unless you've verified them through multiple channels (Dread posts, forum signatures, official market listing).

Subkeys and Key Management

Advanced users can create subkeys for different purposes. Your master key pair consists of a primary key used for certification (signing other keys) and subkeys for encryption and signing messages. This separation provides security benefits - if a subkey is compromised, you can revoke it without losing your entire identity.

DrugHub recommendation: For most users, the default key generation creates appropriate subkeys automatically. Only modify subkey settings if you understand the implications fully.

🏗️ PGP Security Architecture on DrugHub

How DrugHub Implements PGP Authentication

DrugHub Market uses PGP for mandatory two-factor authentication during login. This implementation differs from simple password-based systems and provides cryptographic proof that you control the private key associated with your account. The process works as follows:

1. Registration: You submit your 4096-bit RSA public key during account creation
2. Key Storage: DrugHub stores only your public key (never your private key)
3. Login Challenge: When you attempt login, DrugHub encrypts a random challenge code using your public key
4. Decryption Proof: Only someone with the corresponding private key can decrypt this challenge
5. Verification: Entering the correct decrypted code proves you control the private key

This system prevents several attack vectors common on other marketplaces:

• Phishing resistance: Even if you enter credentials on a fake site, they cannot decrypt your PGP challenge
• Database breach protection: Stolen password hashes are useless without your private key
• Session hijacking prevention: Active sessions require ongoing key possession verification

Encrypted Communication Channels

All sensitive information on DrugHub should be PGP encrypted, including:

• Shipping addresses: Always encrypt with vendor's public key before submission
• Personal information: Never send unencrypted details in messages
• Order notes: Sensitive instructions should be encrypted
• Dispute evidence: Encrypt attachments when privacy is critical

Message Integrity and Non-Repudiation

PGP signatures provide two critical security properties for DrugHub communications:

Integrity: If a signed message is altered in any way, the signature verification fails. This prevents man-in-the-middle attacks where someone intercepts and modifies messages between you and vendors.

Non-repudiation: A valid signature cryptographically proves the message came from the key owner. Vendors cannot deny sending a message they signed, and you cannot deny signing messages with your key. This is essential for dispute resolution.

🛡️ Operational Security with PGP

Secure Key Storage Strategies

Your PGP private key is the most sensitive piece of data in your DrugHub operations. Proper storage prevents account takeover and protects your transaction history:

Key Rotation and Expiration

Security best practices recommend periodic key rotation. However, on DrugHub this presents challenges since your account is tied to your key. Consider these approaches:

• Long-term key with strong security: Use a key that never expires, but protect it extremely well
• Periodic account migration: Create new account with new key every 1-2 years
• Subkey rotation: If using subkeys, rotate encryption subkey while maintaining master key

Emergency Procedures

Plan for potential security incidents:

💬 PGP for Vendor Communication

Encrypting Shipping Addresses

One of the most critical uses of PGP on DrugHub is encrypting your shipping address. This ensures that only the intended vendor can read your delivery details:

1. Navigate to the vendor's profile page on DrugHub
2. Locate and copy their PGP public key
3. Import the key into Kleopatra or your PGP software
4. Verify the key fingerprint matches what's displayed on their profile
5. Compose your address in a text file or Kleopatra's notepad
6. Encrypt the text using the vendor's public key
7. Paste the encrypted message into DrugHub's order form

Verifying Vendor Identity

Before placing orders, especially with new vendors, verify their PGP key authenticity:

• Check if the vendor has posted their key on Dread or other forums
• Compare fingerprints across multiple sources
• Look for signed messages from the vendor proving key ownership
• Be suspicious if a vendor's key suddenly changes without announcement

Secure Message Templates

For efficiency, create message templates that you encrypt before each use:

❓ Frequently Asked Questions