Thunderbird:OpenPGP:PQCTesting
After https://bugzilla.mozilla.org/show_bug.cgi?id=2021616 and https://bugzilla.mozilla.org/show_bug.cgi?id=1848103 have been completed in Thunderbird, it will be possible test OpenPGP Post-Quantum-Cryptography (PQC) email encryption.
At this time we're careful and consider the RNP code that implements PQC as experimental. This includes the code for key generation.
(Note, once the code is considered stable, the limitations below will be removed from Thunderbird.)
Step 1: Create a separate profile for testing
Once you generate a PQC key with the experimental Thunderbird version, current Thunderbird release versions can no longer read your keyring files. To prevent that you're locking yourself out from using your stable Thunderbird environment/profile, you should create a separate profile for testing purposes.
https://support.mozilla.org/en-US/kb/using-multiple-profiles
Step 2: Decide which email address to use
During the testing period, the code restricts for which email addresses you may generate a PQC key. It only works with email addresses that contain +pqc-test or -pqc-test at the end of the local part. For example, only addresses that look like these are currently supported: alice+pqc-test@example.com or bob-pqc-test@example.com You might be able to test with your regular mail account. If your email address is alice@example.com, try to send an email to yourself with plus syntax. Use your own email address and insert "+pqc-test" just before the "@" characters. If you send it to yourself, and the email arrives, you can use it.
If you found an account that works, setup a second identity for your email account, following the instructions, and use the +pqc-test syntax for the second identity.
https://support.mozilla.org/en-US/kb/using-identities
Step 3: Enable the experimental RNP library
Start Thunderbird Daily with your secondary profile.
Open Settings (not account settings).
Section General.
Scroll to the bottom and click the button "Config Editor"
In the "search preference" field type "rnp". If your Daily version supports it, you should see a line below "mail.openpgp.use_rnp_experimental". Double click that line to switch the setting to true.
Important: Restart Thunderbird
If you want to double check if worked, open the menu, help, troubleshooting information, on the keyboard type CTRL+F and enter the search term "rnp". The version in use should include the text ".experimental."
Step 4: Create a fresh OpenPGP ECC + PQC key
Open account settings.
On the left, click the respective account.
On the right, scroll down and click "Manage Identities".
Select the "+pqc-test" identity that you created earlier.
Click the edit button.
On the top, select the End-To-End Encryption tab.
Click "add key".
Select "create a new key" and continue.
On the page "generate openpgp key" in the bottom area, for key type select "ECC (elliptic curve)". (Thunderbird recommends to not use both RSA and PQC encryption keys in a single OpenPGP key, and doesn't support creating this combination.)
Click "Generate Key".
Confirm.
The ECC key should have been generated and now being selected as your current key for this identity.
On the right hand side of the selected new key, there is small arrow. Click it to expand the key information section.
You should see a "Key Properties" button. Click it.
The Key Properties view opens. In the middle section, there are 3 or 4 tabs. Click the tab "Structure" on the right.
The table below shows 2 rows, algorithms EDDSA and ECDH.
If your email address follows the allowed format (ends with -pqc-test or +pqc-test), you should see a button "generate pqc-encryption subkey". Click it and confirm.
After a delay, the table below should show a third row with algorithm "ML-KEM-768+X25519" (that's a PQC algorithm).
Now you have a PQC encryption key.
Close all the dialogs that are open and close the settings tabs.
Step 5: Send an encrypted test message to yourself
Click new message.
In the upper area, after "From", click on your email address.
A selection dropdown will appear.
Select your "pqc-test" identity.
In the to address, enter the same email address.
Type a few words into the subject and message text fields.
In the upper toolbar toggle "Encrypt" to enabled.
Send the message.
Click your email inbox and click the message you just sent.
On the right side of your subject, you should see an encryption padlock icon. Click it.
In the popup cliffhanger that appears, it should say "message is encrypted" and further below it should say "Your decryption key ID .... (sub key id: ....)"
The "sub key id" that is shown should match the key id of your ML-KEM-768+X25519 key (you can check by clicking "view your decryption key" and clicking the "structure" tab).