Difference between revisions of "GnuPG"

From ArchWiki
Jump to: navigation, search
Line 131: Line 131:
  cpanm GnuPG::Interface  
  cpanm GnuPG::Interface  
To send the signatures to its owner you need an working [https://en.wikipedia.org/wiki/Message_transfer_agent MTA], if you don't have already one install [[ssmtp]].
To send the signatures to its owner you need an working [https://en.wikipedia.org/wiki/Message_transfer_agent MTA], if you don't have already one install [[SSMTP]].
== Smartcards ==
== Smartcards ==

Revision as of 18:56, 9 September 2013

GnuPG can be used to sign and encrypt files or mails.


Install gnupg, available in the official repositories.

Basic keys management

Create key

  • Generate a private key by typing in a terminal:
# gpg --gen-key

You’ll have to answer a bunch of questions but generally, you can accept the defaults.

While having an expiration date for subkeys isn't technically necessary, it is considered good practice. A period of a year is generally good enough for the average user. This way even if you lose access to your keyring, it will allow others to know that it is no longer valid.

  • Set expiration date (repeat for both/all subkeys)
# gpg --edit-key 'Your Name'
# key [number]
# expire
# save
  • Generate an ASCII version of your public key (e.g. to distribute it by e-mail):
# gpg --armor --output public.key --export 'Your Name'
  • Register your key with a public PGP key server, so that others can retrieve your key without having to contact you directly.:
# gpg  --keyserver hkp://subkeys.pgp.net --send-keys Key Id

Rotating subkeys

Warning: Never delete your expired or revoked subkeys unless you have a good reason. Doing so will cause you to lose the ability to decrypt files encrypted with the old subkey. Please only delete expired or revoked keys from other users to clean your keyring.

If you have set your subkeys to expire after a set time, you will have to create new ones. Do this a few weeks in advanced to allow others to update their keyring.

  • Create new subkey (repeat for both signing and encrypting key)
# gpg --edit-key 'Your Name'
# addkey

And answer the following questions it asks.

  • Save changes
# save
  • Update it to a keyserver.
# gpg  --keyserver hkp://subkeys.pgp.net --send-keys Key Id
Note: Revoking expired subkeys is unnecessary and arguably bad form. If you are constantly revoking keys, it may cause others to lack confidence in you.

Import key

  • Import a public key to your public key ring:
# gpg --import public.key
  • Import a private key to your secret key ring:
# gpg --import private.key

List keys

  • Keys in your public key ring:
# gpg --list-keys
  • Keys in your secret key ring:
# gpg --list-secret-keys

Basic usage

You can use gnupg to encrypt your sensitive documents, but only individual files at a time.

For example, to decrypt a file data, use:

# gpg -d secret.tar.gpg

You'll be prompted to enter your passphrase.

If you want to encrypt directories or a whole file-system you should consider use Truecrypt, though you can always tarball various files and then encrypt them.

Symmetric Encryption


gpg-agent is mostly used as daemon to request and cache the password for the keychain. This is useful if GnuPG is used from an external program like a mail client. It can be activated by adding following line in ~/.gnupg/gpg.conf:


This tells GnuPG to use the agent whenever it needs the password. However, the agent needs to run already. To autostart it, create the following file and make it executable:


if test -f "$envfile" && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
    eval "$(cat "$envfile")"
    eval "$(gpg-agent --daemon --write-env-file "$envfile")"
export GPG_AGENT_INFO  # the env file does not contain the export statement

Add an entry in your .xinitrc

eval $(gpg-agent --daemon) &

Log out your Xsession and login. Check gpg-agent is actived

# ps aux | grep agent

If you would like to use gpg-agent to manage your SSH keys see SSH Keys#GnuPG Agent.


Finally, the agent needs to know how to ask the user for the password. This can be set in ~/.gnupg/gpg-agent.conf

The default uses a gtk dialog. To change it to ncurses or qt, set the following in the above file

pinentry-program /usr/bin/pinentry-curses


pinentry-program /usr/bin/pinentry-qt4

For more options see man gpg-agent and info pinentry.


To be sure I key you can find on a keyserver is realy from the person who claims it to be, PGP/GPG uses a socalled Web-of-Trust. To build this, there a Keysigning-Partys at a lot of hackerevents.

The Zimmermann–Sassaman key-signing protocol is a way of making these very effective. See the Wikipedia article for an description. Here you'll find an How-To-article.


For an easier process of signing keys an sending the signatures to the owner, after a keysigning-party, you can use the tool 'caff'. It cam be installed from the AUR ether with the package caff-svnAUR or better together with some other useful tools as the package signing-party-svnAUR. In both ways there will be a lot of dependencies to install from the AUR, alternately you can install them with

cpanm Any:Moose
cpanm GnuPG::Interface 

To send the signatures to its owner you need an working MTA, if you don't have already one install SSMTP.


GnuPG uses scdaemon as an interface to your smartcard reader, please refer to scdaemon man page for details.

GnuPG only setups

If you do not plan to use other cards but those based on GnuPG, you should check the reader-port parameter in ~/.gnupg/scdaemon.conf. The value '0' refers to the first available serial port reader and a value of '32768' (default) refers to the first USB reader.

GnuPG together with OpenSC

If you are using any smartcard with an opensc driver (e.g.: ID cards from some countries) you should pay some attention to GnuPG configuration. Out of the box you might receive a message like this when using gpg --card-status

gpg: selecting openpgp failed: ec=6.108

By default, scdaemon will try to connect directly to the device. This connection will fail if the reader is being used by another process. For example: the pcscd daemon used by OpenSC. To cope with this situation we should use the same underlying driver as opensc so they can work well together. In order to point scdaemon to use pcscd you should remove reader-port from ~/gnupg/scdaemon.conf, specify the location to libpcsclite.so library and disable ccid so we make sure that we use pcscd.

pcsc-driver /usr/lib/libpcsclite.so 
card-timeout 5

Please check man scdaemon if you do not use OpenSC.



When using pinentry, you must have the proper permisions of the terminal device (e.g. /dev/tty1) in use. However, with su (or sudo), the ownership stays with the original user, not the new one. This means that pinentry will fail, even as root. The fix is to change the permissions of the device at some point before the use of pinentry (i.e. using gpg with an agent). If doing gpg as root, simply change the ownership to root right before using gpg

chown root /dev/ttyN  # where N is the current tty

and then change it back after using gpg the first time. The equivalent is likely to be true with /dev/pts/.

Note: being part of the group tty does not seem to alleviate the issue, at least as root. (Please confirm with non-superusers)

Agent complains end of file

The default pinentry program is pinentry-gtk-2, which needs a DBus session bus to run properly. See General Troubleshooting#Session permissions for details.

Alternatively you can use the qt pinentry.

# ln -sf /usr/bin/pinentry-qt4 /usr/bin/pinentry

See also