{{ :how_to:gnu.png |GPG Logo}} =====Creating a GPG Key===== **Note:** this is made from a fake account, so there will be differences, i.e. nuck is the fake username, and nucky is the fake name used for this tutorial. As always, we will assume that we are starting off from the home directory. To make a key, use the following command: gpg --gen-key You will be asked for the following nuck@riviera:~$ gpg --gen-key gpg (GnuPG) 1.4.3; Copyright (C) 2006 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details. gpg: directory `/home/nuck/.gnupg' created gpg: new configuration file `/home/nuck/.gnupg/gpg.conf' created gpg: WARNING: options in `/home/nuck/.gnupg/gpg.conf' are not yet active during this run gpg: keyring `/home/nuck/.gnupg/secring.gpg' created gpg: keyring `/home/nuck/.gnupg/pubring.gpg' created Please select what kind of key you want: (1) DSA and Elgamal (default) (2) DSA (sign only) (5) RSA (sign only) Your selection? The default is fine, so select that. Your selection? 1 DSA keypair will have 1024 bits. ELG-E keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) Again, the default is fine. If you make your key too long, it can take a long time to encode your message. Requested keysize is 2048 bits Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) Yet again, the default is fine (you can change it later if you wish). Key does not expire at all Is this correct? (y/N) If you are happy, enter 'y' and press enter. You'll be asked for your real name in a prompt like: Is this correct? (y/N) y You need a user ID to identify your key. The software constructs the user ID from the Real Name, Comment and Email Address in this form: "Heinrich Heine (Der Dichter) " Real name: Here, I've filled out my own test gpg data: Real name: Nucky Email address: nuck@compsoc.nuigalway.ie Comment: You selected this USER-ID: "Nucky " Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? If you're happy, select 'O'. Now, you'll be asked to enter a pass phrase. Be sure to think of something that is hard for a machine to think of, such as alternating lowercase and uppercase letters, number, symbols, etc. The server will now generate random(ish) bytes. It'll take a long time, so be patient. So, after all that you'll be given something like: gpg: /home/nuck/.gnupg/trustdb.gpg: trustdb created gpg: key 91B4BAB5 marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u pub 1024D/91B4BAB5 2007-12-03 Key fingerprint = 1AA1 376E 850E 1A6D 5935 845F 3CF2 9036 91B4 BAB5 uid Nucky sub 2048g/8B7CDEDB 2007-12-03 The segment 91B4BAB5 is the "short fingerprint", and we'll talk about it later. We'll need to make a public long fingerprint and long armoured text. I'll use **fingerprint** as the fingerprint file and **public.key** for the long key file. So, for the fingerprint file we'll use: gpg --fingerprint > fingerprint If you view the file, you'll see something like: nuck@riviera:~$ cat fingerprint /home/nuck/.gnupg/pubring.gpg ----------------------------- pub 1024D/91B4BAB5 2007-12-03 Key fingerprint = 1AA1 376E 850E 1A6D 5935 845F 3CF2 9036 91B4 BAB5 uid Nucky sub 2048g/8B7CDEDB 2007-12-03 To make the public.key, we'll use the following: gpg --export --armor > public.key When you view the file, you should get something like: nuck@riviera:~$ cat public.key -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.3 (GNU/Linux) mQGiBEdUiJwRBACdf9HoSw6hDaPQRDG2TOi07O1xt5ouEs2evIAF3wNsbfTpE3JG BJPhusO4zGoBgUDIPKDupEcjgUjVbaCQAQGRZ/16BK2kAs4D03waN7ujGMmCwCrs 4VV1X71OVlXHHJIwMxw43AziLr8sRuZzHu27IH+DvSK0obsoOI1iO3w6cwCgqMbK Ab2LnRMRyU777sKke4Uk5tEEAJiPRHpdsZEoTOr0mT4yehI40/VJAeG1t0NVtpVE ph5tyISs8aV1cCZnXgsSuAilXQNVIc4M1t9kiddHk4lbAC6IgHIkbbC5+/z7oGsU jHRAiJ1z+FeJThuVmYPy/3/wuXbkc+UETR5cmFQOD1d6aTAy3GWW6lXrCzlUg00J xs0TA/4tTXTPjEnC3pUM1PEahXq5/qpBsRXqZPWtZ7FUGHGuAEJsC2B2/OxgjTD9 gf1acWW5qfP76vEIACyhKJ5tGQEsXVWOkjusS3o1XOqeZrUTabmB8EnAx95YXtiJ g9CAkiLR+ncHC2i07WElXdBuZKt12YTiOu6gXXWtODmPXWQ0M7QhTnVja3kgPG51 Y2tAY29tcHNvYy5udWlnYWx3YXkuaWU+iGAEExECACAFAkdUiJwCGwMGCwkIBwMC BBUCCAMEFgIDAQIeAQIXgAAKCRA88pA2kbS6tck6AJ49+nBE6gKfy7APOCZGGAA+ SoM0RwCdFmPuYobXwtWX75x1NwYUTPILOtm5Ag0ER1SInxAIAMhjx/WmQNpiRAeQ EhRcJ2z8NYZQstOpXUR0sTZSuCrE4YO2669tHAfuwdz9OsJMt0BEh4UwPJ0FjFw0 fXCUdTg5mhnu3iAojH2G4D5fskIBI+0CP8fAogWHExHBUcG3capHuike7FBIUukq ku2yZ0zW96GxwUkli0itE51ku1HguJMJkpn20tTycteCnEWFiFJ7WBMpgmGn/ut5 bMMcnqR3ocH4/CA9LfqHzsx0D7Hs2sQnpmQzCT7Z3Z7roesCifaTp5NIij+Yidc4 HX/ZoVabU09gNOk60QdAjMU6b7S+VoN8fOl/wv040wueJ49YekdW+HwOqgBmW9Bw lJxzIVcAAwUH/1uoV59AhxrJNipwasa4bOUoBEDLcxHLBOlbGcg21KMfpcaSc6BK qvemzTcjvjm62JhHSESVkX18eqDEg10D9iGHXopTb5Ddetm81dnosSzkg5mrrbgm tRxdWbgqJqzjY2PNi6PsOb8KR3Vl7pTGmKp8ENqSnl8c2S5KzQ8NFv0oPHrUXTGv Y4kpXV56FlKl+8pngIoMl2hj4mU5idJ/E/r72n9usHd9Uk+ESm5CCsJBqlrDngww 7jxT5ffIIzyhr/OFdCeUWbhCfGReQLJkv+F/jER6xwPaoTMrV2xoUWF0NqpCz1jc klZor6EtOvHadlOSFRB8UzNALmXGMnubX2qISQQYEQIACQUCR1SInwIbDAAKCRA8 8pA2kbS6tduzAJwNr7vhg+neFUrrm3/LsW0ExdaS0gCgqL434RAoPpsYTD+VIGxQ m60LjvE= =MeiD -----END PGP PUBLIC KEY BLOCK----- =====Sharing Your Fingerprint/Public Key===== It's best to keep the fingerprint and public.key in your public_html folder. So we have the key made, let's upload it to a keyserver. There are two schools of thought about uploading your public key to a key server. One is that you should upload it -- as it adds to the ease at which other people can verify your key -- and the other is that it reduces security. I'll show you how to upload it anyway and, if you want to keep it private, you can. Remember the short fingerprint from earlier, the **91B4BAB5**? That's what we'll upload to the keyserver. gpg --keyserver subkeys.pgp.net --send-keys 91B4BAB5 And away it goes. To confirm, you can download your key from the keyserver using: gpg --recv-keys 91B4BAB5 But wait, what if I forget my passphrase/my account is hacked/my key is compromised? We'll create a revoke key, that will kill your current key from the keyserver and tell everyone who refreshes their keylist regularly that your old key is no longer to be used: gpg --gen-revoke 91B4BAB5 Select 'y', then give a reason (I'm choosing 1), enter description, and 'y' again. After entering your passphrase for your key, you'll be given a revoke certificate. Print it out, and store it safely! Now, after all that fun, we'll finally get to adding keys to your keyring. First, I'll show you how to get keys from the keyserver of someone you know's short fingerprint and publickey. **Short Fingerprint**\\ If someone has given you their short fingerprint, either online, in person (recommended), or some other means (fax!), you can search for them in the public key server. gpg --recv-keys 5470C9D7 Doing so will import their (in this case, my proper gpg-key) public key into your keyring. **Public Key**\\ You can import files or just copy and paste like here. To end the final line, use Ctrl-D. gpg --import -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.3 (GNU/Linux) mQGiBEdFiOcRBADW4f4Wu3/T394hZ3IW0NrETxrApB1bjjV3ZlrV010cyRn7TdH4 Wz2EGrI6R/+77QCpniIdHA/gybLJf6ePKUAoY477aSaTYKJbwKxL2s7b2EtRhKCf f/xDjk/vOlqnow0wed74gmE32FzbXfizw6Gpey+uL4tsU4eDy1Gmp/Xw+wCgjxoq Zvi5FrNN0SzXK6cq/Anlj70D+gJBHZK8+iQF+T5A68zeIgLuX4O9ooj3zPy6WbA3 SSU8H2LB9guqx8lJd54E0ka7Gr0+85dmM31wmrsvmRlY4Kc/PaUwOssTXsaP2/4o sHnCatIQ2WWc/YHA/qu7Q7hoYj2kN//+u2+VAt/OB2G1ke65Ab9kcwkrN+eq2yl5 pXaoA/0aRxH1XO/8ZfobPjuUvkWOX3HqpQgR/4SJoAVMf5Y7no/rie1qZsAxCipv 1+WN7/SjOlBi0SRk2I0elegLLf17m7uYVos6K4AaC6GG2U8cQJ+BTsv+Z7r3CcQy XmfICELvArYQDMenpOfQ4aXYBXojZpB3lAMRaAL3RBRjGots4rQxTmljaG9sYXMg R2VvZ2hlZ2FuIDxudW1iZXI2QGNvbXBzb2MubnVpZ2Fsd2F5LmllPohgBBMRAgAg BQJHRYjnAhsDBgsJCAcDAgQVAggDBBYCAwECHgECF4AACgkQD7YtDFRwyddR6gCf chSSeqCn+fj9Nte6AO01QXxcMywAnjqFLET2kMiz/wYpjw4wK2PY5FL4uQINBEdF iPAQCAC/Nh/nViyWeWciABAkp2jg6WaCEdJDb2TGwD750saHJLsotTE9gas+JFKm Wc7J7brtDdfzMFKSFW8HObiazTKGm6F/nT0aO8VB9pTcW7nDovH2e4ZdTJLLJBJ2 fWxl1Xzs5Tc6pNMqcSbRGHddyud1/p5E9LVzKDOoH1wN9n1ITCsSLb+MemdyR5N/ IGWmcMKGr9IRIXRtUz3Pb4w9bbxB6ZhjBBSa1BiQcCSzLdnNElRa676p9Z9KbvEg xlzp2wsuQS7j9dYJ4vjDpGVy0/YxWnjW3g4mXWtutomOk60s3x2J8l5nWpN+9nLo OJvBmYo0868W9UjjuE/XBufpw+MLAAMFB/4xkWrDEfZF6aGJ9um3p8sESpAALx3c B09BrX8wRyY0UxNRYbJNfxfSTUYUZJd38H2Izc8HPkRvzizjjoz/xycGglt/AnBm fEjEFYyU1FAEOOk/hGkczaHA3mqoy2/RjVv99fe8/4B4PO/6k9rBFg7V2MCjJ8Jc bz4YzaHjgUg9cv7kJcb3xmgHg6qJonyaXT1MOQcIqdHRAUN7ZCP5fwLD+7NYjWtb Vod53acwOQkZLFQBi6uK5D3keK+M11lEUY2+N3tVSghxCFkoNOlmOSZUitppRDZ1 7vlOYvHumY96wLo3KqgmappI9GNY8DymohBt7hIKDrc4Jcl1lC/DW/SPiEkEGBEC AAkFAkdFiPACGwwACgkQD7YtDFRwydfa5ACaAhL9oLkDz+f7SGZS4sxJa3Il468A n09gzwviknwiQssbm273BDd6T1ra =Mjw6 =====Assigning Trust Ratings===== Now we have the key we wanted to import, let's assign it a trust rating. All the editing of keys, including your own, used the: gpg --edit-key command but, to list all the keys you have, you'll need to issue this command: gpg --list-keys My key ring gives: nuck@riviera:~$ gpg --list-keys /home/nuck/.gnupg/pubring.gpg ----------------------------- pub 1024D/91B4BAB5 2007-12-03 uid Nucky sub 2048g/8B7CDEDB 2007-12-03 pub 1024D/5470C9D7 2007-11-22 uid N Geoghegan sub 2048g/8159DFB2 2007-11-22 **Nucky** is the private key and **5470C9D7** is the key I want to edit. So, back to the edit-key command: gpg --edit-key 5470C9D7 This outputs something similar to: nuck@riviera:~$ gpg --edit-key 5470C9D7 gpg (GnuPG) 1.4.3; Copyright (C) 2006 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details. pub 1024D/5470C9D7 created: 2007-11-22 expires: never usage: SC trust: unknown validity: unknown sub 2048g/8159DFB2 created: 2007-11-22 expires: never usage: E [ unknown] (1). N Geoghegan Command> The commands you can use are as follows: * help - lists all commands * save - save changes and quit * quit - quit, prompts to ask if you want to save changes * fpr - show fingerprint * list - show details about the key * sign - this is among the most important commands. With it you say that you believe that a key is really belonging to its owner. You must select the level to which you have checked the owner's identity. After signing, you should use gpg --send-key to upload the key to a keyserver * trust - this is also an important command. With it, you select how much you trust others to verify the identity of keys. Ultimately, trust should never be used. Marginal/full are generally used. gpg --check-trustdb should be run after this to update your web of trust. In this example, I know 5470C9D7 so I'll sign his key. sign 5470C9D7 I'll be asked whether I really want to sign and then for my passphrase. After that, I'll have signed his key. Next, we'll go onto trust. How well do you trust the person? I suggest that you only "marginally" trust them as it's safer. So, to trust the key 5470C9D7 we'll use: trust 5470C9D7 And I'll select marginally from the options. To quit, just type: quit There, you've just signed your first gpg key. They're now in your keyring and all emails in mutt from them will be recognised as valid signatures and will be able to be decrypted. =====GPG and Mutt===== So, finally, we get to configure mutt to use gpg to autosign your emails. Again, like before, I'm assuming you're in your home directory. First create a .muttrc file and then add the following lines to it: set pgp_autosign=yes #this auto signs tyour outgoing mail set pgp_timeout=1800 #remembers your password for 1800 seconds my_hdr X-GPG-Key: http://www.compsoc.nuigalway.ie/~username/public.key #where your gpg key is available, this key points to public.key in your webspace set move=no #this is optional, it gets rid of mutt asking to move your read meassages set editor = nano #this is also optional, it uses the nano text editor which is easier to use Signing, encrypting and decrypting mail all require your passphrase. Ctrl-F will wipe your passphrase from memory. **Viewing Mail**\\ Once your Muttrc is configured, GPG will automatically be called to verify any signed/encrypted mail. **Composition**\\ In the compose menu (where you normally press 'y' to send a message) you can press 'p' to bring up the PGP menu. This displays: (e)ncrypt, (s)ign, sign (a)s, (b)oth, or (f)orget it? This allows you to encrypt and sign mail. If you set **pgp_autosign** (as above), all mail will be signed by default. To encrypt a mail to someone, you must have a copy of their public key.