Catharsis market PGP: setting up your key and two-factor login

Catharsis market PGP comes down to one keypair that does three jobs: it proves the login is really you, it encrypts what you send to vendors, and it verifies the Catharsis market operator's signed announcements when an address changes. Setting it up takes about half an hour the first time, and the part people stumble on is rarely the generating. It is the one moment, weeks later, when a login challenge won't decrypt and the private key is on a laptop that no longer boots. The backup is what decides how that day ends.

What PGP and 2FA actually protect

A password on its own is a weak lock on an account that holds money and can't be recovered by email. With PGP two-factor turned on, the market doesn't accept your password alone; it encrypts a short message to your public key, shows it to you, and lets you in only after you decrypt it and type back what it says. Anyone who phished or guessed your password still can't log in, because they don't have the private key that does the decrypting.

It does not protect you from a clone login page that you type the password into, and it doesn't help if the private key sits unprotected next to the password in the same notes file. It also does nothing about what a vendor does with your address after you hand it over. What it covers well is the ordinary theft case, which is the one you are most likely to meet.

A second reason has nothing to do with login. Your public key is how vendors encrypt a reply to you and how you encrypt your delivery details to them, so without one you are either sending those details unencrypted or going without. The third is the signed link announcement, covered on the link page.

Generating the keypair on Windows, macOS, or Linux

To set up PGP for a darknet market you need GnuPG, the standard open implementation of PGP, or something built on it, and which one depends on your system. The same key serves the market's 2FA, so there is only one thing to get right.

Windows: Install Gpg4win, whose own documentation walks through it, and use Kleopatra, the key manager that comes with it. File, New Key Pair, then choose a personal OpenPGP key pair.
macOS: GPG Suite gives you the same thing with a Keychain-style window; or install GnuPG from Homebrew and use the command line.
Linux: GnuPG is already installed on most distributions, and gpg --full-generate-key asks you what it needs. The GnuPG manuals cover every option.

Whichever you use, the choices are the same. Take an ECC key on Curve25519 or an RSA key of 4096 bits; both are accepted by markets of this kind, and I'd choose the ECC one unless the market's form complains. Give it an expiry of a year or two, so a lost key stops being valid by itself eventually. Use a name and an email address that belong to this one purpose and nothing else, and never your real ones, since both end up in the public key everyone can read.

The passphrase is the part to spend time on. It encrypts the private key file, so it decides what a thief gets if they copy the file. Make it long, make it different from your account password, and don't type it anywhere that isn't the key manager's prompt.

Adding your public key to the account

Export the public key, in ASCII armour, which is the text block starting -----BEGIN PGP PUBLIC KEY BLOCK-----. In Kleopatra that's right-click, Export; on the command line it's gpg --armor --export followed by the key's ID.
Log in to Catharsis (registration itself is covered in the access walkthrough), open the account's security settings, and paste the whole block, from the first dash to the last one, into the PGP key field.
The market usually asks you to prove you own the key before it accepts it, by giving you a short encrypted message to decrypt. Decrypt it with your private key and type back the text. If this step fails, it's nearly always a truncated paste, so copy the block again rather than editing it by hand.
Only after it accepts the key, switch on two-factor login. Doing it in this order means that if the key was pasted wrongly you find out while you can still log in with a password.

Compare the fingerprint the market displays with the one in your key manager once it is saved. They should be identical, and it takes ten seconds.

Passing the Catharsis market 2FA challenge at login

From then on every login is two steps. You enter your username and password, and the market shows an armoured block of encrypted text. Copy it, decrypt it, and enter what it says in the box underneath. On Windows that means pasting it into Kleopatra's Notepad tab and choosing Decrypt/Verify; on the command line it is gpg --decrypt, with the block pasted in and ended with Ctrl+D.

The decrypted message is a short code or phrase that is different every time, so there's nothing worth saving from it. If you copy the challenge into a text editor first, close the editor afterwards without saving, since otherwise you've left a copy of the market's session text in a file. The challenge usually expires after a few minutes; if you take too long, reload the login page for a new one rather than trying the old block again.

If you're logging in on an air-gapped or second device because you keep the key there, that's a sensible arrangement, with the cost that every login becomes a little tedious. I'd accept the tedium. The safety guide has more on keeping this work on one device.

Backing up and protecting the private key

Export the private key once, into an encrypted location that you control: an encrypted USB drive or a password-manager attachment, stored somewhere other than the machine the key lives on. Also save the revocation certificate the key manager offers to create, which lets you declare the key dead if it's ever lost or exposed. The public key is safe to keep anywhere.

The failure here is a quiet one. Nothing warns you the backup is missing until the day the laptop dies, and then the account is locked behind a key you can't reproduce. With no recovery by email or phone, the market can't help, and the balance in the account goes with it.

Test the backup once. Import it on a different machine, or into a clean keyring, and decrypt a message with it. A backup you've never restored is a guess, and the test costs a few minutes.

When the 2FA decryption fails

A failed challenge feels like a locked account, and it almost never is one. I work through these in order, because the cheap causes are far more common than the serious one.

"No secret key" or "decryption failed": You're decrypting with the wrong key. If you've made more than one pair, the challenge is encrypted to the one you uploaded; check its fingerprint against the one in the account settings. This is the usual cause.
The block won't paste, or reports bad armour: You copied it with missing lines. Include the header and footer exactly, and don't let a word processor reflow the text.
It decrypts but the market rejects the answer: The challenge has probably expired or you're answering an older one. Reload the login page, get a fresh block, and try again once.
The passphrase isn't accepted: Check the keyboard layout and caps lock before anything else. If you truly can't recall it, the private key can't be opened by anyone, you included.
The key is gone or the passphrase is lost: Restore from the backup. If there isn't one, a message to the market's support is the only route, with no promise it can help; otherwise the account is lost and you should consider anything in it lost too.

If a failure like this ever happens right after you followed a link someone sent you, close the page and go back to a verified address. A clone that asks you to decrypt a block "to confirm your account" isn't asking for 2FA, it's asking you to do the decrypting for it, so it can log in to the real market as you while you read its next page.