Hey, I've decided to start using email encryption, and since I'm on linux this means GnuPG. Before I go live with my setup I'd like to verify that I'm not missing something important or doing something stupid. Now the thing is I've done research, and it's been a long ride, but I am still in the learning phase right now. I came up with the following settings (the key settings will be taken from gnupg.conf - see below). In particular, these two articles were most helpful:

https://we.riseup.net/riseuplabs+pao...best-practices
https://alexcabal.com/creating-the-perfect-gpg-keypair

Key generation procedure:

gnupg.conf:

• Is everything okay with my OpenPGP key setup procedure? Is everything okay with my gpg.conf? Am I missing anything important?
• Since I'll be generating a key on a live CD, how does it affect the randomness (/dev/urandom, /dev/random)? Does the system have the same random seed each boot? What can I do to increase randomization i.e. introduce some extra entropy before generating the key? I must not connect to the internet!
• One of the articles suggest that I use sha512 as the signature digest. But is it really needed? I mean I've read somewhere that 512 is a bit too long, and that it makes it difficult to read emails that are all signed with these long and annoying signatures. It suggests to use sha256 instead.
• I've noticed that GnuPG also supports Twofish encryption algorithm. The articles do not specifically mention it, but can I add it to my key i.e. in between the AES and CAST5?

Thanks in advance!

You'll need at least one other person to go along with that bold move or you'll get awful lonely.
I wouldn't say stupid, but if your answer to the above questions is "no", perhaps you haven't thought this all the way through...

On my systems, GPG encryption and decryption is very-nicely integrated right into the mail client, and there is a "GPG Keychain" utility for conveniently managing all of the keys: generating them, pushing them to keyservers, pulling from keyservers and so-on. When I send a message to certain people, it is automatically encrypted using their key, and the same is true for messages that I receive from them. (If any message weren't properly encrypted, a gigantic red-flag appears or the message is simply refused.)

Encryption of EMail (which can also be done using the S/MIME standard ...) ought to be painless. It needs to be painless, otherwise you just won't do it. It really needs to be just as routine, just as transparent, and just as "thought-less," as typing "https" when visiting a web-site. "It Just Works,™" and yet the message is at-least somewhat more secure than before.

Therefore, look around to see if you have in fact identified "the easiest way to do it." Yes, it is academically interesting and informative to get to know these tools at the command-line level, but in daily practice it should not be necessary or, as I said, you just won't do it or won't do it consistently.

What mail clients do you people use? I only know Thunderbird + Enigmail.

4096-bit RSA? LOL You must be emailing some pretty classified stuff my man! GPA is a nice little program that makes key management easier.

Personally I would have gone for the ECC equivalents, but those are not very well supported today. Anyway, I found out that mouse movement and heavy disk activity (i.e. running "find") does increase entropy, and thus /dev/random output speed (tested). It's also ok to put twofish into the list of ciphers.

Well, OS/X Mail supports S/MIME natively, and there's a very nice GPG plug-in with an accompanying GUI key-management program So, I can do either form of encryption at will, and verification is automatic. There are certain people with whom all my communications is automatically (and transparently) encrypted and decrypted. Messages which claim to be from a certain person, but who do not bear their signature and/or that are not encrypted (if I have specified that they must be) will be red-flagged or simply discarded.

The KMail client also supports encryption. Even good ol' Microsoft Outlook can do it.

You probably shouldn't have to monkey with the command-line directly, although you certainly can, and you should basically know how. Encryption should be, and can be, easy. So easy that you can almost forget about it.