6.3. Using PGP/GPG encryption and decryption

6.3.1. GPG Basics

GnuPG encrypts messages using asymmetric keypairs individually generated by GnuPG users. The resulting public keys can be exchanged with other users. They must always be exchanged carefully to prevent identity spoofing by corrupting “public key” / “owner” identity correspondences.

The public keys are used for encrypting data and the private keys for decrypting the data encrypted with the corresponding public key.

If a partner gives you a public key, you can encrypt data with it. This data can only be decrypted by the owner of the private key associated with the public key.

If the private key is lost the encrypted data can not be recovered.

6.3.2. Generating public and private key pair

Generating a private key:

gpg --gen-key

You will have to enter:

• What kind and size key you want.
• Duration for which the key should be valid. You can safely choose a non-expiring key for your own use. If you plan to use a key for public signing, you might want to consider a yearly expiration.
• Your real name and e-mail address; these are necessary for identifying your key in a larger set of keys.
• A comment for your key, useful for distinguishing a key. The comment can be empty.
• A passphrase.

To allow partners to encrypt files that will later have to be decrypted by you, you will have to export and distribute the public key part of your GPG/PGP key:

gpg --armor --output pubkey.asc --export 'Your Name'

This command will store the public key inside the pubkey.asc file and you can distribute this file to all your partners.

6.3.3. Importing partner’s public keys

Before you can encrypt files that will be later decrypted by your partners, you must first import the partner’s private key into your PGP/GPG key storage:

gpg --import KEYFILE

When importing a public key onto another machine, you may have to configure GPG to trust the key. Otherwise, when you use the key to do encryption, you may get a prompt like this:

It is NOT certain that the key belongs to the person named
in the user ID. If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N)

This locks the execution of a non-interactive script, waiting for user’s input.

To trust the key, run:

gpg --edit-key NAME

In the GPG console type “trust” and select the level of trust (recommended value = 5):

Command> trust
Please decide how far you trust this user to correctly verify other
users' keys (by looking at passports, checking fingerprints from
different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

Type “quit” to exit the key validation process.

6.3.4. Encrypting files using partner’s public key

Once the partner’s public key is imported into your GPG/GPG key storage, you can encrypt a file using the following command:

gpg --encrypt --recipient 'user@domain.com' myfile.txt

Replace user@domain.com with the name of the partner that will have to decrypt the file.

6.3.5. Decrypting files using our own private key

Once your partners have received your public key, they can use it for encrypting files.

Note

The files encrypted using your public key file can only be decrypted using your private key part.

To decrypt a file, execute the following command:

gpg --output unencrypted_file.txt --decrypt encrypted_file.txt.gpg