[ More Info ]

[/security/encryption/gnupg] permanent link

You can create new empty keyrings with gpg --list-keys.

C:\Program Files\GNU\GnuPG>gpg --list-keys
gpg: keyring `C:/Documents and Settings/JDoe/Application Data/gnupg\pubring.gpg
' created
gpg: C:/Documents and Settings/JDoe/Application Data/gnupg\trustdb.gpg: trustdb
 created

Note: gpg uses the forward slash, "/", which is used on Unix, Linux, and other operating systems to separate directories, in its output, though Windows actually uses a backward slash, "\".

If you need to transfer keyrings from a Linux or Unix system to a Windows system, the keyrings are likely to be stored in ~/.gnupg on that system, i.e. in a .gnupg beneath a user's home directory. Transfer the .gpg files, i.e. pubring.gpg, secring.gpg, trustdb.gpg

To import someone's public key into the public keyring, you can use the instructions at Importing a Public Key with GPG.

[/security/encryption/gnupg] permanent link

Suppose you have received the following key by email or see it on a webpage. (the key below is from the The Linux Kernel Archives OpenPGP Signature webpage.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDnirDkRBADCTL/iUTeZKb0tiAcKdZdsUP/KSnrGGjlinolUAsUC0D6/hUB1
RdCpJOOERTIEr1yvehqDM7veRhNMoxJNQxa/sSrkywey5qc8uaskUNEqenimq/70
bahWJeoWXjad68mQFh65lULnHQrrioeJnh9UpyGJppNb/yIjdnymH9aYEwCglgP7
UegBzH22h8NVQEK2PWWbyUUD/jQA4lI0wRWcL9HpkYkHcH0LTKRB9zYpQYtyvzJi
yTGwJyFMfYNXy0RT11dICeLkf3HMR84hkPERKMhALobLxVUbfc7j2AygmzGphWGy
DH/xjptQP/zrsq87ylYRONK18w1J42cm+yZa4XThMDPJMrb9/l8qnxU1JnW7W1al
HKTpBACbs+91KLqrnIGcF44TMwxgUj5CUrayPoEnLU+ZMBqfSjmu8RqEYmTxJCKv
7erBFSuazBGj5X7twunrtrW3bxO63MbLbHjfXSRrMnKOb8dRULIg6eWAnoAx8VVZ
YjrOpwAntU3WxYOpbiCHt9kLbb+N5rvNtFcmOqRRQaCIUFOOaLQ8TGludXggS2Vy
bmVsIEFyY2hpdmVzIFZlcmlmaWNhdGlvbiBLZXkgPGZ0cGFkbWluQGtlcm5lbC5v
cmc+iFUEExECABUFAjnirDkDCwoDAxUDAgMWAgECF4AACgkQyGugalF9Dw4MNACe
JiQTyCmQzPGou2cl/RyOXj79kYYAnAsT6xt72hp/PFiywYM9vBsDVv9niQEVAwUQ
OeKwNWx5eAAqlgcFAQEdZgf/Vn2dMKrn8021NhavP0uA3pHGRmdKQ2WJBdLiN2tv
LkpAioZtho+op+xBz8j1zdIJQ/7XWko869KHge2BAFwA8rWDzjtaAWdE0Jo/NiAR
epUwV2FdRRwSxIcNG2CCPyJnfPokRqjdl2z9k2PkwidHSq+2k6JxCWnOcIXChSKf
kHnemtA65ixAlhuxvyN3MPuYs1jAHyDGcyMfomp1qH9tXFQhhyXRrG2eMAfslstC
XGXLcoLN3O2BMR/fG2GlV6kOqGOvoMIW3clVeQLQ9B1yyekKiVY6Vg+CgK5qhg8z
9tjH4f33zzNDwsx1WSCOU/1LIPzFBNbR9QtTF2XmOUfRs4hGBBARAgAGBQI54rBc
AAoJEH2d7s4ry8YhmjsAoMUW9RxfXBSos0A6LwGd+5pXv/MRAKCYFLG2T4GSV+qf
iRsXnrgDHQHD04hGBBARAgAGBQI54rOZAAoJEPKlddweGoeC/+sAoL5f7JF21mRe
Z8VV4nhh7prm+idSAKCMXDWW/tBOeJDYpiEhgyGSGgJJWrkEDQQ54q+cEBAAjRmb
txamcZ9EYsQTnQvVL2l6vY5Rnbc1JDdcyHEV1kH5OwZWqvckL4QgKKBbTQwyB9pC
o0nGK4PkBbrwL0outfHQ5jl9DUzTKIu+asWUyf3fxfUV6j2A6BMo59KNnJzUyJ2+
B5na6NN8nEqEtmogROtjT8LkOvYwqD4A/5re2vwtie+h5yU6A+JbyGQF6lFxThZj
4WGctBgCcDBqRkPAG8DFFAdeN5SMAArktCYuUGXi2q88EDoOs3Ykw0kB8+ZFECz/
4/b93so5Wt2hC15cxAJoXFfR3mXHm40EHzMdEublWV4blB2KvFocQC74/H74QPUk
cWlc6EhPodKvcuOfTimDxXaiGNFONUPgNAmCXeVoOapdWpb3x7iOHPwSaXeJSrO9
fc4GtVjDv90DT2ekK7cvYk8s6B3t7p7W21Xi+hRgrw63B3HElr01gdMZY5XA5ey/
WmnyBS6LOxXlnVBE+2uSQ+aZHqrLpXcRvq2ZonOziDSE0i940ZvIwlSzn0U5BQWl
9hBDQw78RacYqaFvlpcGiPj75bScB4eemxV6Wdo9mtK0Vrr+9bWScXHEv7did4X+
7tBWKbA8M+g290OSzjeQBGLuPmbjxzEKH9jcUumzBzzC5x5GFh7On9TLXQ4K/oRT
6QQpS93YrTVbR60G4MKsePWLJmg7IgYUtNdLGjsAAwUP/0aAAq8CmWtourj1XxNY
pFmOAU45d65fPWVadKyF++B+uDyRNYN7HQCqrJ7ddn0sH7OBtlE8yaBYgR0TFly9
9+LqQO4r4IGCw2TBgA5tKnOWoPGEzvrLeoxR3SnPrKBlDvx6Rr9h3OJ9UV5u/NLh
mCP9iN10gWCGzsWbONc6qD6PugbTur44D6s4CRK9xfliSrtG3GBHW914UKjJeB9s
e3oc1rkmNv39kKcu33w4XVETAj4qpXnwoJvy639dfvnQt1TWFjIt20iP7m+jkT3B
b526uJ5GuJl6r8sm5OYYRs5cLigvUzRZVgYnjjqlRRACx0WcinKK55Li2Pq4qcRV
vSE5Tr3kTUTGxdmy113FbscrhLhesGALv3Hb7jeeWC8jviGEaHppgUumR6v0hsI1
rZ3K8kCjFRAYV8OKtcEeMqjouArGi5dn0ClmG4lwH4SEdqC/TRNWGG+iVpWf5yCj
9mvtvUhLtl6QjXHLrJdSGyafvqR1EQMJadFt4URvx0M7tqZIcwPUnb+7Oc+J96po
e/EQmnm6rFnTpWz0BbY4mbJC7vUH4JyLs0nlxiKrBjaO9C1DSAKBpjqaga8dQe1Z
kLOI2F7IWFeKV2LaMl+ZvvfWMECNcqNW2fkCuP9Fpz5K+xg21TwovVy93aWKgFL6
06jK51oQp3fW86xXK9ZGKYqQiEYEGBECAAYFAjnir5wACgkQyGugalF9Dw5M9QCg
hhmHalzWf8B3AVrjPrtrRHA1vlgAn3YRlU5l0V5W1iXvHXQCUHIESpgm
=SZZb
-----END PGP PUBLIC KEY BLOCK-----

1. Copy and Paste
   
   
   1. Copy the entire block from the "BEGIN PGP PUBLIC KEY BLOCK" line to the "END PGP PUBLIC KEY BLOCK" line (get the dashes on those lines as well).
   2. At a shell prompt, type gpg --import. The gpg program will start awaiting your input.
   3. Paste the PGP key and then hit enter followed by Ctrl-D to terminate the program.
   4. You should then see something like the following (the email address has been altered to preclude spam spiders picking it up).
      
      gpg: key 517D0F0E: public key "Linux Kernel Archives Verification Key <ftpadmin@kernel69296.org>" imported
      gpg: Total number processed: 1
      gpg: imported: 1
      
2. Import File
   
   
   1. Save the PGP public key above to a file. The file should contain the entire block from the "BEGIN PGP PUBLIC KEY BLOCK" line to the "END PGP PUBLIC KEY BLOCK" line (get the dashes on those lines as well).
   2. If you saved the file as ftpadmin.txt you would issue the command gpg --import ftpadmin.txt
      
3. Obtain from a Keyserver
   
   
   1. Public keys are normally available from a key server, but you need to know which key server or key servers have the key. In this case the key is available from wwwkeys.pgp.net, so you could issue the command gpg --keyserver wwwkeys.pgp.net --recv-keys 0x517D0F0E presuming you know the key id is the hexadecimal value 517D0F0E.

After you have imported a key, you can verify it is on your keyring using the command gpg --list-keys. You can delete a key with the command gpg --delete-keys. E.g., suppose I have the ftpadmin@kernel69296.org public key on my keyring, but wish to delete it. I can issue the command gpg --delete-keys ftpadmin@kernel69296.org to remove it from the public keyring. It is possible that you may have multiple public keys for the same email address. Perhaps you have one that is no longer used by the person to which it belongs and want to delete that specific one. You can use the key id associated with that one, e.g. gpg --delete-keys 517D0F0E in this case.

The key id is the sequence of numbers and letters after the slash that you see when you list the keys on the keyring. E.g. for the Linux Kernel Archives Verification Key, I see the following, if I issue the command gpg --list-keys when it is on my public keyring:

pub  1024D/517D0F0E 2000-10-10 Linux Kernel Archives Verification Key 
<ftpadmin@kernel69296.org>
sub  4096g/E50A8F2A 2000-10-10

In this case, the key ID is 517D0F0E

References:

1. The GNU Privacy Guard (GnuPG)

[/security/encryption/gnupg] permanent link

If you need to locate someone's PGP key on a PGP server using gnupg, you can use the command gpg --search-keys --keyserver <servername> <name>, where "servername" is the name of the PGP server where the key is stored and "name" is the person's name. For instance, suppose the person's last name is Pacheo and the applicable key server is server1.somewhere.com, then you would use gpg --search-keys --keyserver server1.somewhere.com pacheo. If there were multiple keys on the server that matched, you would see a numbered list of all matching keys and would be prompted to enter the number for the one you want. Once you select the one you want, you should see a message indicating the public key for the person has been imported to your keyring. If you issue the command gpg --list-keys, you should see the new key listed.

If the email address associated with the new key was pacheo@abcxyz.com and you wanted to send the file confinfo.xls as an encrypted attachment to an email to the person, you could use gpg --encrypt -r pacheo@abcxyz.com confinfo.xls. Gnupg would then create a new encrypted version of the file called confinfo.xls.gpg, which you could attach to your email. The recipient, who you specify with the "-r" option, would then need a program on his end, such as gnupg, PGP, etc. that could decrypt the file, producing a duplicate of the original confinfo.xls file.

In the above example, you would be using the person's public key to encrypt the file. Only someone who has the associated private key, which should only be that person or someone he very much trusts, will be able to decrypt the file. You don't need his private key to encrypt the file, only the public key, which he can make available to anyone via the key server.

[/security/encryption/gnupg] permanent link