Gpg
From Attie's Wiki
(Difference between revisions)
m |
m |
||
(2 intermediate revisions by one user not shown) | |||
Line 35: | Line 35: | ||
</source> | </source> | ||
− | {| | + | {|class="wikitable" |
! Long !! Short !! Description | ! Long !! Short !! Description | ||
|- | |- | ||
Line 52: | Line 52: | ||
| --decrypt || -d || decrypt a file | | --decrypt || -d || decrypt a file | ||
|- | |- | ||
− | | --detach- | + | | --detach-sig || -b || make a detached signature |
|} | |} | ||
Line 82: | Line 82: | ||
The ''fake'' key information from above has a <code>${key-id}</code> of <code>0x8462FC4A</code><br> | The ''fake'' key information from above has a <code>${key-id}</code> of <code>0x8462FC4A</code><br> | ||
In some situations like the <code>--recipient</code> argument you may use the name <code>Attie Grande</code>, part of the name <code>Attie</code>, or the identifier <code>0x8462FC4A</code> | In some situations like the <code>--recipient</code> argument you may use the name <code>Attie Grande</code>, part of the name <code>Attie</code>, or the identifier <code>0x8462FC4A</code> | ||
+ | |||
+ | ==Send files via a secure channel== | ||
+ | ''Secure'' in that it is encrypted, not so much in that this example uses netcat. | ||
+ | |||
+ | The recipient is <code>${RECIPIENT}</code>, I have his public key. | ||
+ | |||
+ | ===Sender=== | ||
+ | <source lang="bash"> | ||
+ | tar -caf - -C ${SRC_DIR} ${FILES} | gzip | gpg -e -r ${RECIPIENT} - | nc -l 27015 | ||
+ | </source> | ||
+ | |||
+ | ===Receiver=== | ||
+ | <source lang="bash"> | ||
+ | nc ${SERVER} 27015 | gpg -o - -d | gzip -d | tar -xv | ||
+ | </source> |
Latest revision as of 14:14, 2 April 2015
How to make use of GPG (GNU Privacy Guard)
# make a key (it is often necessary to copy a large file in order to generate enough random data - roughly 3GB should do for a 2048-bit key) gpg --gen-key # view the stored keys gpg --list-keys gpg --list-secret-keys # export the public key (for use by others) gpg --armor --output pubkey.txt --export ${key-id} # export a secret key (be safe!) gpg --armor --output privkey.txt --export-secret-keys ${key-id} # import a key (public or private) gpg --import key.asc # send your public key to a public server - it may take a minute or two to appear, presumably there is some server-side processing to be done gpg --send-keys ${key-id} # retrieve a public key from a public server gpg --search-keys 'myfriend@his.isp.com' # encrypt a file gpg --encrypt --recipient ${key-id} foo.txt # decrypt a file gpg --output foo.txt --decrypt foo.txt.gpg # sign a file gpg --armor --detach-sign crucial.tar.gz # verify a file's signature gpg --verify crucial.tar.gz.asc crucial.tar.gz # edit a key gpg --edit-key ${key-id}
Long | Short | Description |
---|---|---|
--list-keys | -k | list the public keys stored |
--list-secret-keys | -K | list the private keys stored |
--armor | -a | create ASCII armored output, the default is plain binary |
--output | -o | write to output file |
--recipient | -r | encrypt a file for the given recipeint |
--encrypt | -e | encrypt a file |
--decrypt | -d | decrypt a file |
--detach-sig | -b | make a detached signature |
Contents |
[edit] Uncertain Ownership
It is NOT certain that the key belongs to the person named in the user ID.
This message can be caused if you import a key that was generated on another system.
It can be prevented by one of the following methods:
[edit] Permanently
- Run
gpg --edit-key ${key-id}
- Enter the command
trust
- Select the appropriate trust level
[edit] Every Execution
gpg --encrypt --yes --no-tty --trust-model always --recipient ${key-id}
[edit] key-id?
The ${key-id}
tags above generally mean the 32-bit identifier, in hex.
It appears that you can often use the email address to identify a key as well.
$ gpg -k /home/attie/.gnupg/pubring.gpg ------------------------------ pub 2048R/8462FC4A 2012-02-23 uid Attie Grande <attie@attie.co.uk> sub 2048R/E8423A6F 2012-02-23
The fake key information from above has a ${key-id}
of 0x8462FC4A
In some situations like the --recipient
argument you may use the name Attie Grande
, part of the name Attie
, or the identifier 0x8462FC4A
[edit] Send files via a secure channel
Secure in that it is encrypted, not so much in that this example uses netcat.
The recipient is ${RECIPIENT}
, I have his public key.
[edit] Sender
tar -caf - -C ${SRC_DIR} ${FILES} | gzip | gpg -e -r ${RECIPIENT} - | nc -l 27015
[edit] Receiver
nc ${SERVER} 27015 | gpg -o - -d | gzip -d | tar -xv