gpg

​GnuPG is used to encrypt and sign email messages and files. First you need to create the GPG key:

Generating Keys

———————————————————–

$ gpg –gen-key

———————————————————–

Select option 5 for RSA and then type the encryption level.

———————————————————–

Please select what kind of key you want:

(1) DSA and Elgamal (default)

(2) DSA (sign only)

(5) RSA (sign only)

Your selection? 5

RSA keys may be between 1024 and 4096 bits long.

What keysize do you want? (2048) 4096

Requested keysize is 4096 bits

Please specify how long the key should be valid.

0 = key does not expire

= key expires in n days

w = key expires in n weeks

m = key expires in n months

y = key expires in n years

Key is valid for? (0)

Key does not expire at all

Is this correct? (y/N) y

———————————————————–

Now enter your personal information

———————————————————–

Real name: Jason Brown

Email address: [email protected]

Comment: Example

You selected this USER-ID:

“Jason Brown (Example) ”

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform

some other action (type on the keyboard, move the mouse, utilize the

disks) during the prime generation; this gives the random number

generator a better chance to gain enough entropy.

……………………….+++++

………..+++++

gpg: key 7C11053D marked as ultimately trusted

public and secret key created and signed.

gpg: checking the trustdb

gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model

gpg: depth: 0 valid: 4 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 4u

pub 4096R/7C11053D 2009-10-12

Key fingerprint = EE6B C53F A665 593C 3607 FEE1 F984 2AF9 7C11 053D

uid Jason Brown (Example)

———————————————————–

As stated in the option menu, this key is only generated to sign email or files and cannot be used to encrypt. You now have to edit the key that was just generated to use it for encryption.

———————————————————–

$ gpg –edit-key [email protected]

pub 4096R/7C11053D created: 2009-10-12 expires: never usage: SC

trust: ultimate validity: ultimate

[ultimate] (1). Jason Brown (Example)

Command> addkey

You need a passphrase to unlock the secret key for

user: “Jason Brown (Example) ”

4096-bit RSA key, ID 7C11053D, created 2009-10-12

———————————————————–

Enter in your passphrase and then select option 6 for ‘RSA (encrypt only)’. It will then ask for a key size and key expiration, use the same settings as in the first section. Once complete you will have a new key for encryption.

———————————————————–

pub 4096R/7C11053D created: 2009-10-12 expires: never usage: SC

trust: ultimate validity: ultimate

sub 4096R/55D59203 created: 2009-10-12 expires: never usage: E

[ultimate] (1). Jason Brown (Example)

———————————————————–

Now type save to exit:

———————————————————–

Command> save

———————————————————–

Your new key is now ready to be uploaded to the key repository servers.

———————————————————–

$ gpg –keyserver pgp.mit.edu –send-key [email protected]

———————————————————–

GPG Key Backup

Once your keys have been generated, you will need to export both the public and private keys and store them for safe keeping. To export your public key:

———————————————————-

$ gpg –export -a [email protected] > example-pub.key

———————————————————-

And the private key:

———————————————————-

$ gpg –export-secret-key -a [email protected] > example-priv.key

———————————————————-

You can then create a tar backup of these two keys and encrypt them with a passphrase.

———————————————————-

$ tar -cvf gpgkeys.tar example-priv.key example-pub.key

$ gpg -c –cipher-algo aes256 gpgkeys.tar

———————————————————-

Then enter in a strong password. This will allow you to retrieve your keys if you do not have your public/private key pair installed on a machine. Once this is done you will need to securely delete your keys leaving just the tarball. This is important as someone can compromise your keys.

———————————————————-

$ for i in gpgkeys.tar example-priv.key example-pub.key

>do

>shred -n 100 -z -u -v $i

>done

———————————————————-

Retrieving Public Keys

To search for a persons key type:

———————————————————-

$ gpg –search-keys [email protected]

———————————————————-

As this is an example and a fake email address, this will not return any results. Had this been a real address you will see a list of email addresses with numbers along the side. To request the public key of that person, type the number and hit ‘enter’ and it will retreive the public.

Encrypting Files to Other Users

To encrypt a file to a different user you must first have that users public key. To check type:

———————————————————-

$ gpg –list-keys

pub 4096R/7C11053D 2009-10-12

uid Jason Brown (Example)

sub 4096R/55D59203 2009-10-12

———————————————————-

I will encrypt a file to myself. The ‘-e’ option is to tell it to encrypt and the ‘-r’ is the recipient or public key of the person you want to give the file to.

———————————————————-

$ gpg -e -r [email protected] ssn.txt

———————————————————-

To decrypt the file, the receipient must have their public key installed on the machine. Then type:

———————————————————-

$ gpg –output ssn.txt –decrypt ssn.txt.gpg

———————————————————-

Where ‘–output’ is the name of the decrypted file and ‘–decrypt’ is the file being decrypted.

You may also want to digitally sign the file you are encrypting, to do so type:

———————————————————-

$ gpg –detach-sig ssn.txt.gpg

———————————————————-

And to verify the signature file:

———————————————————-

$ gpg –verify ssn.txt.gpg

gpg: Signature made Mon 12 Oct 2009 02:21:26 PM EDT using DSA key ID 7C11053D

gpg: Good signature from “Jason Brown (Example) ”

———————————————————-