Encryption is a process of embedding plain text data in such a way that it cannot be decoded by outsiders. It is necessary to encrypt data to prevent misuse. The GNU Privacy Guard (GPG) application allows you to encrypt and decrypt information. It is based on the use of a pair of keys, one public and one private (or secret). Data encrypted with one key can only be decrypted with the other. To encrypt a message to you, someone would use your public key to create a message that could only be unlocked with your private key. To sign information, you would lock it with your private key, allowing anyone to verify that it came from you by unlocking it with your public key.
Modern Linux distributions have gpg already installed on them. If not present, install it.
#yum install gnupg
#apt-get install gnupg
1) Create gpg key
When installing gnupg package, we need to understand the concept to use gpg as well.
Generating a new keypair
To encrypt your communication, the first thing to do is to create a new keypair. GPG is able to create several types of keypairs, but a primary key must be capable of making signatures.
# gpg --gen-key Please select what kind of key you want: Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) 4096 Please specify how long the key should be valid. Key is valid for? (0) 0 Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: my_name Email address: firstname.lastname@example.org Comment: my-key-pair You selected this USER-ID: "my_name (my-key-pair) <email@example.com>" You need a Passphrase to protect your secret key. We need to generate a lot of random bytes. .......+++++ pub 4096R/BAC361F1 2017-03-30 Key fingerprint = 0397 AD65 6EE6 074A 2B95 EEF1 D2A7 4997 BAC3 61F1 uid my_name (my-key-pair) <firstname.lastname@example.org> sub 4096R/9742DE56 2017-03-30
uid:Please take a note about the USER-ID mentioned in the result. We will use its value to do some operation.
pub:It represents the public key. The key-id is BAC361F1. Yours will be different
sub:It represents subkeys, goes along with the primary key. Commonly, it is used to encryption.
Your prompt can be handled for a very long time without finishing if you see the message below
"Not enough random bytes available. Please do some other work to give the OS a chance to collect more entropy! (Need 285 more bytes)"
The problem is caused by the lack of entropy (or random system noise). So cancel the process and check the available entropy
$ cat /proc/sys/kernel/random/entropy_avail 14
You can see it is not enough. We can install a package to solve the lack of entropy with rngd which is a random number generator utility used to check immediately the available entropy
# apt-get install rng-tools # cat /proc/sys/kernel/random/entropy_avail 3075
Now can start again with the
gpg --gen-key command and the process will be fine. We have only installed it without anything else. In certain distributions, you need to use rngd before the gpg process.
# rngd -f -r /dev/urandom
3) Generating a revocation certificate
After your keypair is created you should immediately generate a revocation certificate to revoke your public key if your private key has been compromised in any way or if you lose it. Create it when you create your key. The process requires your private key, passphrase.
$ gpg --output revoke_key.asc --gen-revoke BAC361F1 sec 4096R/BAC361F1 2017-03-30 my_name (my-key-pair) <email@example.com> Create a revocation certificate for this key? (y/N) y (Probably you want to select 1 here) Your decision? 0 Enter an optional description; end it with an empty line: > revocation if key compromised > Reason for revocation: No reason specified Is this okay? (y/N) y You need a passphrase to unlock the secret key for user: "my_name (my-key-pair) <firstname.lastname@example.org>" 4096-bit RSA key, ID BAC361F1, created 2017-03-30 Revocation certificate created.
The argument BAC361F1 is the key ID. It must be a key specifier, either the key ID of your primary keypair or any part of a user ID that identifies your keypair like email@example.com. The generated certificate will be saved in
revoke_key.asc file. Store it where others can't access it because anybody having access to it can revoke your key, rendering it useless. If the
--output option is omitted, the result will be placed on standard output.
4) Making an ASCII armored version of your public key
Some keyservers allow you to paste an ASCII armored version of your public key in order to upload it directly. This method is most preferred because the key comes directly from the user who can see that the key has been successfully uploaded.
$ gpg --output armored_key.asc --export -a BAC361F1
5) Exchanging keys
In order to communicate with others, you must exchange public keys. To do it, you must be able to list your keys. There is some commands to list your public keyring
gpg --list-keys:List all keys from the public keyrings, or just the keys given on the command line.
gpg --list-secret-keys:List all keys from the secret keyrings or just the ones given on the command line
gpg --list-sigs:Same as --list-keys, but the signatures are listed too.
$ gpg --list-keys /home/ubuntu/.gnupg/pubring.gpg ------------------------------- pub 4096R/BAC361F1 2017-03-30 uid my_name (my-key-pair) <firstname.lastname@example.org> sub 4096R/9742DE56 2017-03-30
Export a public key
Now that you have generated a key pair, the next step is to publish your public key on internet ( Keyservers ) so that other person can use it to send you a message. You can use either the key ID or any part of the user ID may be used to identify the key to export. There are two commands but with the first command, the key is exported in a binary format and can be inconvenient when it is sent through email or published on a web page. So, we will use the second command for ASCII armored method.
$ gpg --output to-bob.gpg --export BAC361F1 $ gpg --armor --export BAC361F1 > my_pubkey.gpg
The output will be redirected to my_pubkey.gpg file which has the content of the public key to provide for communication.
Submit your public keys to a keyserver
Once you have this ASCII-armored public key, you can manually paste it into a form at a public key server like pgp.mit.edu
$ gpg --keyserver pgp.mit.edu --send-keys BAC361F1 gpg: sending key BAC361F1 to hkp server pgp.mit.edu
Because someone seems to have sent you their public key, there's no reason to trust that it's from that person unless you have validated it.
Import a public key
As others persons can use your public key to send you a message, you can import public from people you trust in to communicate with them.
gpg --import bob_public_key.gpg
Now we have notions on the principles to use and generate a public key. You know how GnuPG is functioning and you can use it for secure communication. GPG encryption is only useful when both parties use good security practices and are vigilant.