GPG
 |
This {{#switch: | =article | Talk=talk page | Category=category page | Help=help page | Portal=portal page | Template=template page | User=user page | User talk=user talk page
}} is actively undergoing a major edit for a while --huston 10:38, 22 May 2007 (EDT). As a courtesy, please do not edit this page while this message is displayed. The person who added this notice will be listed in its edit history or has placed their signature above. If this page has not been edited recently (several hours!), please remove this template (or replace it with {{underconstruction}}). This message is intended to help reduce edit conflicts; please remove it between editing sessions to allow others to improve this page. {{#ifeq:{{{category}}}|no||}} |
GPG (Gnu Privacy Guard) is an encryption program which makes use of Public-key cryptography. It is commonly used for encrypting email between parties, but can also be used for plain files, as well as digitally signing things to ensure the sender's identity. It is highly secure, and based originally on PGP (Pretty Good Privacy) by Phil Zimmerman.
Initial setup
To start using GPG, you must generate a key pair. This is done with the command 'gpg --gen-key'.
- If you've never used GPG before, you'll see a couple messages about creating keyrings.
- These are the public and private keyrings where your keys, and keys of people you've imported into the program, are stored.
- You will then be asked what kind of key to generate.
- As of this writing, "DSA and Elgamal" is the default, which is fine.
- Next, how many bits should be in the key, from 1024 to 4096 with 2048 as the default (which is also fine).
- Select an expiration date for the key pair.
- This is a handy way to make sure that a key is not used beyond its useful life. By setting the expiration date in the key, you can make sure that someone who may have an old key for you knows your key is expired without you having to have issued (and they had to have received) a revocation certificate for it. You can choose any length of time, including never expire.
- Confirm the expiration of the key.
- Enter your real name, email address, and a comment for the key.
- This will construct the key's identity. After entering the items, you'll be asked if you wish to change any part, or if the result is okay.
- Enter a passphrase.
- You may be asked to do some things to generate "entropy" on the system. This is so the pseudo-random number generator has a good pool of random bytes to use for creating a key. Doing things such as moving the mouse around, typing in another window, or reading from the disks will help the system generate random numbers during this process.
Now you'll see output such as this:
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2007-06-05
pub 1024D/71148581 2007-05-22 [expires: 2007-06-05]
Key fingerprint = 92B7 4FB3 E80F C7DA E180 AD33 7964 9BD9 7114 8581
uid Foo Barr (FuBah) <nobody@astro.princeton.edu>
sub 2048g/450A56ED 2007-05-22 [expires: 2007-06-05]
Your key pair has been generated. You can now send the public key on to others, or send it up to a key server, so that people can correspond with you.
Key management
Exporting your public key
If you wish to send your public key to someone, you must export it from the keyring. You can do this with the command 'gpg --armor --export <email address>'. The output will look something like:
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.7 (GNU/Linux) mQGiBEZTIxARBACc+Ort932Nk31GVlIS9KI0Ta0vk2NSaTzSY2SmlCZYIDqr0jBY VPi6w/At9p20gZdjXgogDBBewBvaM6qOefTcuUwIDsrGzngj9DtT2VCs9R9YWr1D ueuBQr4RVK5VMIpaN0Zs1D45F2jIPiGs/K63T0tLf1x93+6j2VH41EYKQwCg0DGO /EkXZs3DRrneBlzpfSzsTYED/0jxDiQgRYjYbkbho5t2lttB6kh4D3NALlDdho85 lV9T5NjMCYtSn4uYK5YPvVs3Q9vMXLdyc2FyRGvk6VgcVxDrubGdEvHNXWGkKa+F ... EQIADwUCRlMjEAIbDAUJABJ1AAAKCRB5ZJvZcRSFgU4jAKDBoOsTnI13VZrdSpZk RHFhtsJZaQCfQL0JwsBM+fVyTg0GYWkuzSULBb4= =ZnSa -----END PGP PUBLIC KEY BLOCK-----
You can cut everything (including the "BEGIN" and "END" lines) from the terminal and paste it into an email to send to someone, or print it out. If your reasoning is to go to a key signing party, the key's ID and fingerprint is usually sufficient as it's shorter to print (and verify) on paper. Using 'gpg --fingerprint <email address>' will output the more friendly:
pub 1024D/71148581 2007-05-22 [expires: 2007-06-05]
Key fingerprint = 92B7 4FB3 E80F C7DA E180 AD33 7964 9BD9 7114 8581
uid Foo Barr (FuBah) <nobody@astro.princeton.edu>
sub 2048g/450A56ED 2007-05-22 [expires: 2007-06-05]
Sending your key to a key server
Another good way to disseminate your key is to send it to a key server. Key servers are repositories where public keys are held, and can be easily found. This is useful if you subscribe to a mailing list where many people sign their emails; you can query the key server for the signing key without having to ask the sender of the email directly (though, you shouldn't sign their key until you've verified the identity of the person). To send your key to a key server, use the command 'gpg --send-keys <key ID>'. The key ID is the hexadecimal string next to the public key type, seen in the fingerprint output above; for our example key, the ID is 0x71148581.
Importing a public key
If someone sends you their public key, you can import it into your keyring with 'gpg --import'. You can either write the public key to a file and specify the file on the command line, or you could enter the command just as above and paste the key into the terminal window (gpg will read the key from stdin).
Getting a key from a key server
Just like sending a key, you can retrieve keys from a key server as well. If you know the key's ID, then 'gpg --recv-keys <key ID>' will work fine. If you don't know the key ID, you can use 'gpg --search-keys <names>' to search for it. <names> could be the email address, or full name (or some part of it) of the person whose key you're trying to find. You'll be presented with a list of keys corresponding to the search criteria you entered, and selecting one (or more) of the keys will download those keys from the server and import them to your keyring.
To-Do
- Encrypting
- Decrypting
- Signing
- Verifying