Helpful advice for those who may be new to PGP, as it looks clear we szeekers may need to make use of a specific private key.
TL;DR here's a decent video on the same subject, instructions on GPG start at the bullet points.
PGP itself is great tool for encrypting messages in a way that you never have to send the password to the recipient.
Lets look at an encryption method that is par for the course for most seekers by this point: encipher.it. If you want to send someone an encrypted message using encipher.it, you have to come up with a password, encrypt the message, send the recipient the encrypted message and
send them the password. The whole point of encryption is to make sure only your recipient(s) can read it, right? Well this method has two major issues. The first issue is that it is susceptible to being brute forced, especially if you choose a password that is short, common, a real word or is only a few characters off from a real word. The second major issue is that you have to tell your recipient the password somehow, which means it could be intercepted.
PGP (and public-private key based encryption in general)
Using PGP for your encryption solves both of those issues quite well, though. That's because with PGP you use a pair of keys instead of just a password. When you create your own PGP key, you get a matched set of two of them: a public key and a private key.
To encrypt a message, instead of using a password, you use the public key of whoever you will be sending the message to. The encrypted message, in turn, is decrypted using the matching private key. That means you don't have a password that someone could just guess, nor do you have to send anything sensitive. Each person's public key can be freely shared as much as they like, as the only thing you can do with a public key is en
crypt a message, not de
crypt. Think of the public key as instructions that say "Here is how to make a lock only I can open" and the private key as "Here is how to open that lock". Unlike a real-world lock, it's not feasible to reverse engineer the lock to figure out what key goes in it (aside from potentially the NSA, but honestly on their end its much easier and realistic to just install malware on your machine to get at your private key than it is to try to reverse engineer it from your public key unless you're using an older, much lower bit encryption). Your private key will likely have a password associated with it as well so its not as simple as stealing a copy of your key, but the primary feature of interest is that you don't have to send your private key anywhere at all after you make it locally, which rules out a wide array of security holes that simple password-based encryption is susceptible to.
What's this Keybase nonsense?
Keybase is a great little utility, especially because it automates things like file sharing and makes it easy to find the public key associated with a reddit/twittefacebook/etc. user). However, it won't work for you to use the shared Szeeker's private key. (If you don't have that, I won't spoil where to find it, but its not especially hidden). Keybase checks to see if anyone is using the public half when you register a private key to it: in other words, because of the feature Keybase provides (making it easy to find a public key used by a specific social media account) they won't allow multiple users to share keys that way. However, since DNDH has set up a registered account there it may still be useful within the scope of the ARG to set up your own Keybase account. And, in the larger scheme of things, you'll come out with a handy way to send & receive PGP encrypted messages that's more user friendly (and social media aware) than a command-line tool like GPG. With the Chrome extension you'll even have a 'keybase chat reply' option next to any Reddit comment that will either A) open a chat with that user on Keybase or B) leave them a nudge that they should set up Keybase so they can receive your encrypted message.
So, since you can't use Keybase with that certain key, what can you do? I'll assume you'll use GPG (GnuPG) for this, you're welcome to use a different piece of software but the essence of the steps will be the same, just not the specifics.
Install GPG (or your software of choice)
Open up a command line/terminal window (or your software's GUI).
Browse to the directory you saved SSSprivate.asc to, and import the private key by running: gpg --import filename.you.saved.it.as
You can see a list of all the private keys you've registered with to be sure it went smoothly: gpg -K
To decrypt a file, you run: gpg -d [filename here]
It will ask you for the password associated with the private key. Copy & paste that sucker!
In both cases you can omit the filename and instead the command line will wait for you to copy & paste the key or encrypted message in question, but you'll have to send an end of file (EOF) sequence after you paste it. On Windows that's Ctrl-Z, but on other operating systems Ctrl-Z kills a program, hence why I suggested a newbie just import a file with those contents.
What if the thing you're decrypting turns out to be something other than plain text, like a zip file, image or video? Or maybe you just want the text to go to a text file instead of just showing up on the command line? Then run gpg as so: gpg -d filename.goes.here > output.filename.here
Now, are you just itching to give this all a try and see if its working, but you don't have any szecret szauce to PGP decrypt yet? Have no fear! Here's a short message that you can decrypt using, yes, that szeecret szechuan szauce private key you probably have already if you've read this far. -----BEGIN PGP MESSAGE-----
Version: GnuPG v2
hQEMA2M2ogKnOHGSAQgAijHd8SBIfC1fjVYvohzlB4YgtoOLmNCGqPB2AbHuWXGs btOEXoq9nK77gqjtRPVQkYcDhwpmcE5fKjR4Aghh4dC0kJ6vGJF4/c6lmQ+L45jU 0HMW634ApDWaiqlPedpQ781PaQAAcM5J0MJC/3bpZ1Ye3RFCOVGPNB91Vz3yT2er HOSyfRt7IgtP3fRlVRzk25RvRJAUuUXG9E2/eW6JuZkrfIqqpem1LoZ4xUZdJjEB c8wiIPsoExtf7C2aYafrh+wM78N+bfi0omWGekLeEYeSBHeKEE8SfeM6n5HV9uI+ PK6FNp2OIu506/qvhkjpMR46XA3XtP937xtv4ood2NLpASqjIat1J7ZJMmbwl5EL 8BdScZtw4TEaudeKeUj5lfAP0iVWFUSdB60oWIswv4JOyGW6TA7SzfTP4UtbyWV5 msiBqCIVd3nLZumHVceCR+r16E12fUCt3XylyYfZ/G21VUNQ/dMsU+noTAvqCV1H fgYPwQUdqN9qprisxAAsgTlUIaFswaUjzzHMOKlzQ4yhCxgYPrWJ93eBEnp95jqy +obPhfGMc09NnnAOa73mbUOof9E1RZZIPO+On/YaRp7L9kYGr883VzDguYB6YH8v gEcJU7QlnvIHyx8iIsBYrQBqMCH2BBu1ARmp255jreEeOfRi92YbSL1N1OPax1is mkq+vs2gs/VuDJt0TrVIQId8aILOt7Eu52JYLGJuRkwh/DS0B0ZxqJCN5Rz/mcxf okcht/DtJrkkuf+XZqRPOpTCci8bX9EEejaX9RAo0MYZEhkdwLx5GBGYa1sDHEiX TlJmqzMXU5e+jRgAaCbWh7E8MUjYl4yI/opx13PUYm4ep9jMPeYuAXleoY89g0bQ 62YeyVvfoPthfRQAZggop9i+A5396+P7r6fCya05zLj/CEes2zIrUl3dNHJAepf0 XijnI6ZBDPzRoMAP8MXTMrEJ4IO8QgvI87Ff/dhw+L82TkhjPIavTSfYAK4sB9ct +lq+a3IkCiRoRdhGukkqWYVjFpI37wjVVEZgOw3d5Q2b9FImJhwaOOBiY/HFe/xY cqQVoJvq0li+EQPhaKm26SJh5uOoMewzDxV36kgfRQocyQmE8YXpThqvCzEgHlJl pDqw2jhGhKjsaczAdGSZL+EUSpja =VsuC
-----END PGP MESSAGE-----
If you want to verify something inside a ------PGP SIGNATURE----- block, use
gpg -d is for -----PGP MESSAGE----- blocks.
The nitty gritty is that signature blocks can only be created from a private key, and the matching public key will decrypt the signature. They allow you to be certain that whoever signed the message is someone who has that private key. For maximum security, two parties communicating with each other can use signed messages to make sure that only the intended recipient can read the message AND
the recipient can be certain who the sender was.
While an encrypted message (with or without a signature internally) with have a START and END PGP MESSAGE section, a message that is not encrypted but does has a signature will have three headers.
-----BEGIN SIGNED MESSAGE----- Some sort of message here -----BEGIN PGP SIGNATURE----- a bunch of encrypted text -----END PGP SIGNATURE-----
There isn't an extra END SIGNED MESSAGE header because the message ends at the point the signature begins.
Signed but unencrypted messages let you be certain who exactly the message came from, and that the message did not get altered between when they signed it and you checked the signature, but you don't need to be anyone specific to read the message. Their main purpose is for signing a message that you want a lot of people to be able to read, since encrypted PGP messages are normally only decryptable by the recipient. The private key that many seekers have access to provides a sort of middle ground between them: only someone who has played the ARG long enough to find the file can decrypt and encrypt messages for it, but there's no guarantee who the message came from for that key. Don't be fooled by a SIGNATURE block that decodes to be from "Szechuan Sauce Seekers", that's just someone using that private key anyone (in theory) can find.
For the purposes of this ARG, you'll want to use keybase to get the public key associated with DNDH verification,
which also provides a handy spot to verify a signature on an unencrypted message. (The puzzle this post was originally meant for can't be decrypted on Keybase by anyone except KaySen762
, the site only allows one person to use a specific private key, and KaySen was the first (and only) to set up an account on their site using that as their private key.)