Difference between revisions of "GnuPG"

From ArchWiki
Jump to: navigation, search
(update templates, see Help:Style)
m (GnuPG only setups: minor grammar fixes)
Line 37: Line 37:
  
 
== GnuPG only setups==
 
== GnuPG only setups==
If you do not plan to use other cards but those based on GnuPG you should check the {{Ic|reader-port}} parameter in {{ic|~/.gnupg/scdaemon.conf}}. The value '0' refers to the first available serial port reader and a value of '32768' (default) refers to the first usb reader.
+
If you do not plan to use other cards but those based on GnuPG, you should check the {{Ic|reader-port}} parameter in {{ic|~/.gnupg/scdaemon.conf}}. The value '0' refers to the first available serial port reader and a value of '32768' (default) refers to the first USB reader.
  
 
== GnuPG together with OpenSC ==  
 
== GnuPG together with OpenSC ==  

Revision as of 03:50, 21 February 2012

GnuPG can be used to sign and encrypt files or mails.

Basic usage

You can use gnupg to encrypt your sensitive documents, but only individual files at a time, if you want to encrypt directories or a whole file-system you should consider use Truecrypt, though you can always tarball various files and then encrypt them.

Symmetric Encryption

gpg-agent

gpg-agent is mostly used as daemon to request and cache the password for the keychain. This is useful if GnuPG is used from an external program like a mail client. It can be activated by adding following line in ~/.gnupg/gpg.conf:

use-agent

This tells GnuPG to use the agent whenever it needs the password. However, the agent needs to run already. To autostart it, create the following file and make it executable:

/etc/profile.d/gpg-agent.sh
#!/bin/sh

envfile="${HOME}/.gnupg/gpg-agent.env"
if test -f "$envfile" && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
    eval "$(cat "$envfile")"
else
    eval "$(gpg-agent --daemon --write-env-file "$envfile")"
fi
export GPG_AGENT_INFO  # the env file does not contain the export statement

If you would like to use gpg-agent to manage your SSH keys see SSH Keys#GnuPG Agent.

Finally, the agent needs to know how to ask the user for the password. This can be set in ~/.gnupg/gpg-agent.conf:

pinentry-program /usr/bin/pinentry-gtk-2

For more options see man gpg-agent.

Smartcards

GnuPG uses scdaemon as an interface to your smartcard reader, please refer to scdaemon man page for details.

GnuPG only setups

If you do not plan to use other cards but those based on GnuPG, you should check the reader-port parameter in ~/.gnupg/scdaemon.conf. The value '0' refers to the first available serial port reader and a value of '32768' (default) refers to the first USB reader.

GnuPG together with OpenSC

If you are using any smartcard with an opensc driver (e.g.: ID cards from some countries) you should pay some attention to GnuPG configuration. Out of the box you might receive a message like this when using gpg --card-status

gpg: selecting openpgp failed: ec=6.108

By default, scdaemon will try to connect directly to the device. This connection will fail if the reader is being used by another process. For example: the pcscd daemon used by OpenSC. To cope with this situation we should use the same underlying driver as opensc so they can work well together. In order to point scdaemon to use pcscd you should remove reader-port from ~/gnupg/scdaemon.conf, specify the location to libpcsclite.so library and disable ccid so we make sure that we use pcscd.

~/scdaemon.conf
pcsc-driver /usr/lib/libpcsclite.so 
card-timeout 5
disable-ccid

Please check man scdaemon if you do not use OpenSC.