Skip to content

Instantly share code, notes, and snippets.

@abcdw

abcdw/gpg-explained.org

Last active September 5, 2023 20:20
Show Gist options
  • Star 7 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save abcdw/3ee8fc771ce5b0b9e50ce670756cbe2d to your computer and use it in GitHub Desktop.
Save abcdw/3ee8fc771ce5b0b9e50ce670756cbe2d to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gpg-explained.org

gpg explained

Plan for today

  • Brief introduction
  • Managing keys
  • gpg key instead of ssh and gpg-agent instead of ssh-agent
  • hardware tokens

Disclaimer

  • I’m not a security expert.
  • We won’t learn how to use tools for encryption/signing/etc today.

Asymmetric cryptography use cases

aka Public-key cryptography.

  • Sign the work (binaries, commits, tags)
  • Encrypt (files, emails, passwords)
  • Authenticate (SSH, Git, VPN)
  • Create and sign other keys

Name confusion and a little history

PGP
a software tool.
OpenPGP
a standard.
gpg or GnuPG
complete and free implementation of OpenPGP.

Is gpg ideal?

GPG key structure and capabilities

https://rzetterberg.github.io/assets/yubikey-gpg-nixos/key-anatomy1.png

  • Sign
  • Encrypt
  • Authenticate
  • Certify

Managing keys

Generating key and subkeys

Do it in a safe environment.

gpg --expert --full-generate-key
gpg --edit-key
addkey

Where to store keys?

Backing up keys

# Use encrypted flash drive or similiar tool instead of ~/gpg-backup dir
# For more information: https://github.com/drduh/YubiKey-Guide#backup
mkdir ~/gpg-backup
gpg --export-secret-keys > ~/gpg-backup/keys.gpg
gpg --export-secret-subkeys > ~/gpg-backup/subkeys.gpg

Publishing key

  • keyserver
  • web
  • email/etc

Searching for key

gpg --keyserver keyserver.ubuntu.com --search-keys KEYID

Importing keys

Generating ssh public key

https://wiki.archlinux.org/index.php/GnuPG#SSH_agent https://github.com/drduh/YubiKey-Guide#ssh

Extending expire date

Links

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment