My notes on GPG and PGP

posted on 2020-11-30T15:11:36Z · last modified on 2021-01-23T16:42:08Z · view page on GitHub

GPG stands for the 'GNU Privacy Guard'. It's the standard way to manage your PGP keys on Linux. PGP, in turn, stands for 'Pretty Good Privacy'. With PGP you typically create a public/private key pair which are respectively used to encrypt and decrypt messages. PGP keys are mostly used to send sensitive information over the internet or to prove your identity online.

In practice, sending information is done by first sharing your public key with everyone such that any person can use that key to encrypt the information they want to send you. On receiving a message encrypted with your own public key, you can use your private key to decrypt it.

Conversely, if you're in possession of someones public key, you can use that public key to encrypt a message for that person, who can then decrypt it by using his private key.

Usually, public keys can be published on public key servers to make it easier for others to find your public key and use it to send you encrypted information. However, keep in mind that these public keys can never be deleted from a key server.

Generating keys¶

To generate a public-private key pair, run the full gpg wizard. It's best to choose the default options wherever possible.

$ gpg --full-gen-key

You'll be asked a few questions about your identity. Fill them out correctly... as PGP is used to prove identity it's impossible to change the identity information on your key later on.

Exporting keys¶

First list your secret keys

$ gpg --list-secret-keys

Copy the id of the key you want to export. The ID is often defined as the last 8 (short ID) or last 16 (long ID) digits of the key fingerprint shown in the listing. Be aware that collisions might happen with 8-digit short IDs. Often, you'll only have one public key per email address, in which case the email address tied to the gpg key can also be used as key ID.

To export a public key:

$ gpg --export --armor --output public.asc <key-id>

To export a private key:

$ gpg --export-secret-key --armor --output private.asc <key-id>

By default, the private key will be exported and encrypted with the same password as you used to generate the key.

If you want to export your private key with a different password (or with no password), you'll have to edit the key before exporting. Editing the password can for example be done as follows:

$ gpg --edit-key <key-id>

Secret key is available.

---

gpg> passwd

First, enter the current password, then enter the new password twice (leave blank for no password). You will also be asked to provide a new password for each of your subkeys. After setting the new password (or removing the password), type quit to exit the gpg-prompt.

You might have noticed the --armor flag used in the above export commands. The armor command is used to export to (or import from) ASCII encoding (in stead of binary). If you want to import/export to binary format, drop the --armor flag. Also in that case, the convention is to use a .pgp extension for the exported key:

$ gpg --export --output public.pgp <key-id>
$ gpg --export-secret-key --output private.pgp <key-id>

Publishing keys¶

To export (publish) your public key to a public key server, use:

$ gpg --keyserver <keyserver-uri> --send-key <key-id>

For example to publish your key on the ubuntu keyservers, use hkp://keyserver.ubuntu.com as keyserver.

You can check if the key was published correctly by searching for it:

$ gpg --keyserver <keyserver-uri> --search <key-id>

Importing keys¶

Both public and private keys can be imported from an exported key file as follows:

$ gpg --import public.asc
$ gpg --import private.asc

In case the private key was encrypted with a password, you'll need to provide it.

By default, imported public keys have the lowest trust level ('unknown'). If the imported keys are indeed your own, you should increase the trust level to the 'ultimate' level to prevent that some encryption programs refuse to use your own public key for encryption. This can be done as follows:

$ gpg --edit-key <key-id>

gpg> trust

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

In general, it might also be a good idea to increase the trust level of imported public keys you don't own to a level you're comfortable with.

Deleting keys¶

A public key can be deleted from your keyring as follows:

$ gpg --delete-key <key-id>

However, this will only work for public keys for which you do not own the private key. Hence this is usually used to delete the public key of someone else from your system.

To delete a personal public key from your system, you have to delete the private key first.

However, if that means you will lose the private key forever, please make sure to revoke your public key from any public key server before deleting the private key from your system!

Indeed, revoking the public key will tell others to disregard it such that they (hopefully) will start using a different public key that belongs to you which hasn't been revoked (however, nothing is actually stopping them to keep on using the old, revoked key).

The private key can be deleted from your system as follows:

$ gpg --delete-secret-key <key-id>

After which you'll be able to remove the public key as shown above. To simultaneously delete both keys from your system, use:

$ gpg --delete-secret-and-public-key <key-id>

Encrypting messages¶

To encrypt a message, first find the public key-id you want to use to encrypt the message. As we know, this can be done with gpg --list-keys.

$ gpg --encrypt --armor --recipient <key-id> <filename>

Which will create a new encrypted file called <filename>.asc (or <filename>.pgp if the --armor flag is removed).

A message from stdin can also be encrypted. For example:

$ echo "This message will be encrypted" | gpg --encrypt --armor --recipient <key-id>

Note that multiple recipients can be supplied by repeating the --recipient flag multiple times. This will make sure the message can be decrypted by all recipients specified.

Decrypting messages¶

To decrypt a message, you'll need to have at least one of the private keys belonging to any of the public keys the message was encrypted with. Then the message can simply be decrypted as:

$ gpg --decrypt <filename>

Or, for a message coming from stdin:

$ echo "This message will be encrypted then decrypted" | gpg --encrypt --armor --recipient <key-id> | gpg --decrypt

My Public GPG key¶

That's it. Feel free to leave an encrypted comment below. This is my public gpg key:

If you like this post, consider leaving a comment or star it on GitHub.