GnuPG ( GNU Privacy Guard ) is the GNU project's complete and free implementation of the OpenPGP standard. GnuPG allows to
encrypt and
sign your data and communication.
PGP use
asymmetrics cryptography. It mean, that PGP use
two keys.
Public key use to verification sign of private key. With public key you can also encrypt text. Decryption is possibly only with private key.
After generate your keys you must protect your private key and import your public key to
Key server in Internet. Key server is repository of public PGP keys. You can search and take public keys of other people there.
If you want use GnuPG in comfortable way, you use Firefox plug-in
FireGPG.
Create keys
$ gpg --gen-key
gpg (GnuPG) 1.4.9; Copyright (C) 2008 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) DSA and Elgamal (default)
(2) DSA (sign only)
(5) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
ELG-E keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 2048
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0) 2y
Key expires at Tue 20 Dec 2011 07:02:09 PM CET
Is this correct? (y/N) y
You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) "
Real name: Tomas Jurman
Email address: your@email.com
Comment:
You selected this USER-ID:
"Tomas Jurman "
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
.+++++++++++++++.++++++++++.+++++.++++++++++++++++++++.+++++..+++++++++++++++++++++++++.++++++++++.+++++++++++++++.+++++++++++++++.++++++++++>++++++++++.........+++++
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++..+++++.++++++++++.++++++++++++++++++++.++++++++++.+++++..++++++++++..+++++.+++++...+++++.++++++++++++++++++++++++++++++++++++++++.+++++.+++++....+++++++++++++++>.++++++++++>...+++++...>+++++........................................................................................................................+++++^^^^^^^^^^^
gpg: key 1DA0400B marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 2 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: next trustdb check due at 2011-12-19
pub 1024D/1DA0400B 2009-12-20 [expires: 2011-12-20]
Key fingerprint = 30DA B2F5 67B6 52D5 CEFE B8F3 3500 2542 1DA0 400B
uid Tomas Jurman
sub 2048g/8273984F 2009-12-20 [expires: 2011-12-20]
List keys
$ gpg --list-keys
pub 1024D/09CEB475 2009-12-19 [expires: 2011-12-19]
uid Tomáš Jurman
sub 2048g/4288E83B 2009-12-19 [expires: 2011-12-19]
You can see your ID (hexadecimal number after slash - 09CEB475), identity (name and email address), expiration time and other.
Create revocation key
If You want to revoke your keys for reason If has been your keys compromised. (your private key become public known), you must prepare revocation keys.
It is good idea, prepare your revocation keys immediately after generate your keys. Because if you for example by mistake delete your private key, you can not generate your revocation keys. You can prepare revocation keys in advance, save revocation key to file and use in future if it you need.
$ gpg --gen-revoke 4CA09BBE
sec 1024D/4CA09BBE 2009-12-20 tomas jurman
Create a revocation certificate for this key? (y/N) y
Please select the reason for the revocation:
0 = No reason specified
1 = Key has been compromised
2 = Key is superseded
3 = Key is no longer used
Q = Cancel
(Probably you want to select 1 here)
Your decision? 1
Enter an optional description; end it with an empty line:
> Key has been compromised
> My women bought my private notebook with my private keys.
>
Reason for revocation: Key has been compromised
Key has been compromised
My women bought my private notebook with my private keys.
Is this okay? (y/N) y
You need a passphrase to unlock the secret key for
user: "tomas jurman "
1024-bit DSA key, ID 4CA09BBE, created 2009-12-20
ASCII armored output forced.
Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory gets
access to this certificate he can use it to make your key unusable.
It is smart to print this certificate and store it away, just in case
your media become unreadable. But have some caution: The print system of
your machine might store the data and make it available to others!
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: A revocation certificate should follow
iJsEIBECAFsFAksufFxUHQJLZXkgaGFzIGJlZW4gY29tcHJvbWlzZWQKTXkgd29t
ZW4gYm91Z2h0IG15IHByaXZhdGUgbm90ZWJvb2sgd2l0aCBteSBwcml2YXRlIGtl
eXMuAAoJEK4w30tMoJu+5GEAoJ7gDvekN3DHDj/fg97N6Wx3aM1yAKCrW/EBaVnf
A0AzEx5BoJ01raygyg==
=5ln0
-----END PGP PUBLIC KEY BLOCK-----
Last part of statement you copy and paste to file with name for example "revok.key" and retain in secret place.
Revocation keys
$ gpg --import revok.key
Delete keys
$ gpg --delete-secret-keys 1DA0400B
$ gpg --delete-keys 1DA0400B
First you must delete private key and then public key.
Import your public key to Key server
For sending your public key to Key server you must determine your key ID.
$ gpg --send-keys 09CEB475
gpg: sending key 09CEB475 to hkp server keys.gnupg.net
Search public keys in Key server
$ gpg --search-key yourFriend@email.com
gpg: searching for "yourFriend@email.com" from hkp server keys.gnupg.net
(1) Tomáš Jurman
1024 bit DSA key 05CEA475, created: 2009-12-19
Keys 1-1 of 1 for "yourFriend@email.com". Enter number(s), N)ext, or Q)uit > 1
gpg: requesting key 05CEA475 from hkp server keys.gnupg.net
gpgkeys: key 05CEA475 not found on keyserver
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
The key will bee find and GPG offer you to import key in your keys store.
Export public key to file
$ gpg -a --export your@email.com > my.key
Export secret key to file
gpg --export-secret-keys -a [id] > /home/tomas/mySecrKey.txt
Value Id is optional. If you dont use id, gpg export all yours secret keys
Import public key from file
$ gpg --import my.key
Encrypt file
$ gpg -ear 09CEB475 sourcerPlainText.txt
-e = encryt, -r = recipient, -o = output, -a = armor (to ascii)
Decrypt file
$ gpg -d encryptOutputFile.txt
Encrypt and Sign
gpg -esr 09CEB475 -u 16582121 sourcerPlainText.txt
This create .pgp file decript of recipient with ID 09CEB475 and sign of user with ID 16582121
-e = encrypt; -s - sign; -r = recipient; -u = user
Sign
$ gpg -s sourcerPlainText.txt
Create .pgp file. Use compression and Contain source file data.gpg --clearsign sourcerPlainText.txt
Create .asc file. Dont use compression. Contain source file data.gpg -b sourcerPlainText.txt
Create .asc file. Create only sign, not contains data from file.
optional: -a = armor (to ascii); -u = user
gpg -bau 16582121 sourcerPlainText.txt
Fingerprint
gpg --fingerprint [ID | email]
Verify sign
You need 2 files. First file is Sign and second file contains some data for verify.
gpg --verify test.txt.sig test.txt
Create encrypt and sign file for SIMS
Every quarter of year we have to send encrypt and sign file to
SIMS.
As
-r (recipient) use ID or email address of
Matrika studentu - sber dat
As
-u (user) use your ID or your email address.
Don´t forget use switch
--pgp6.
gpg -easr sims@ics.muni.cz -u yourSchool@emailAddress.cz --pgp6 -o sims.pgp sims.xmlgpg -easr 8E4E1C1C -u 16582121 --pgp6 -o sims.pgp sims.xml
-e = encrypt; -s - sign; -r = recipient; -u = user; -o = output, -a = armor (to ascii)
