search

🥷GNU Privacy Guard (gpg)

A powerful cryptographic utility.

hashtag
TL;DR

Useful commands from this page are below.

gpg --gen-key

hashtag
Overview

GPG (technically gpg2) is the OpenPGParrow-up-right part of the GNU Privacy Guard (GnuPG). It ships with your EC2 instance and offers digital encryption and signing services. It also can be used for secure shell applications (GitHub supports GPG keys for SSHarrow-up-right).

Check out this great, simple guide for using GPGarrow-up-right

circle-info

Technically, the pre-installed package is**gpg2**, which is targeted for desktop use whereas the original gpg package is for server and embedded platforms. Your ec2 instance will interpret both gpg and gpg2 commands as gpg2. This documentation will use the form gpg for simplicity.

hashtag
Tamper Resistant Digital Signatures

Digital signature certifies and timestamps a document. Any changes to that file, however slight, will be unable to pass the verification process.

circle-info

Creating and verifying signatures uses the public/private keypair from the SSH and PKI discussion; however, the operation is different from encryption and decryption.

hashtag
Getting Started

Go ahead and create a new primary key pair so you can get started with gpg.

# input
gpg --gen-key

# output
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 2 # 2 generates DSA for signing and Elgamal for encrypting
SA keys may be between 1024 and 3072 bits long.
What keysize do you want? (2048) 2048 # default is 2048
Requested keysize is 2048 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) # zero means no expiration
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

# enter your own information when you get to this screen
Real name: Kenneth Shultz
Email address: kshultz@permitzip.com
Comment: Gadget Engineering Director
You selected this USER-ID:
    "Kenneth Shultz (Gadget Engineering Director) <kshultz@permitzip.com>"
...
...
...

You will be prompted to create a passphrase for your key pair; proceed to do so, preferably using a memorable phrase with a length of several words.

Take note of your new Key ID in the output (Line 3 below):

hashtag
Generate Revocation Certificate

With the new key pair created, immediately generate a revocation certificate for the primary public key.

  • revocation certificates may be published to notify others that the public key has expired (perhaps due to a lost key, etc)

  • can be used to verify signatures made in the past

  • cannot be used to encrypt future messages

  • does not impact the ability to decrypt past messages (if you still have the private key)

Create a revocation certificate using:

Your revocation certificate has been stored in $HOME/.gnupg/ as your-new-certificate-name.asc (See line 2 above). Check your key ring out now:

hashtag
Export a Public Key

You will need to share your key so that others may verify your signatures. Use the command below, but replace the email and key ID (9FCE5492) with your information:

Here is an example output for Kenny Shultz, using kshultz@permitzip.com and key ID 9FCE5492:

Lines 2 through 41 above (bounded header and footer included) can now be copied to the clipboard in order to share public key information anywhere.

hashtag
Add Another User's Public Key and Sign

You can add another user's public key to your keyring.

Copy and paste Kenny's public key from above (include the bounded header and footer).

Name it kenny.gpg and save it to $HOME/.gnupg then import the key using:

In order to certify the key on your system, you now must sign it:

A gpg shell has been spawned (gpg>); proceed to enter the following fpr and sign commands. Before using your passphrase to complete the signing process, verify that the fingerprint (Line 9 below) matches exactly to:

4104 CFE0 F9A4 8B60 5253 A6BF ACAD E367 9FCE 5492

Always verify fingerprints before signing and authorizing keys on your system.

You can now use a force quit (ctrl+C) to exit the gpg terminal.

hashtag
Encrypting and Decrypting

You can use someone's public key to encrypt a message.

The message can only be decrypted with the recipient's private key (the key pair to the public key)

Try creating a file to encrypt - we'll create and use a message.txt file:

Try encrypting with my or your own public key:

Here we pass kshultz@permitzip.com as the recipient to encrypt the message using Kenny's key. We create and define message.txt.gpg as the output (encrypted file).

You will never be able to decrypt this file without Kenny's private key.

Kenny could now decrypt this message using his private key and resolve it to message.txt with the command:

If you'd like to try decrypting a file yourself, start this section over using your own public key to encrypt the file in place of Kenny's!

PreviousSSH KeyGen and AgentNextAuthentication

Last updated