In this lecture I'll show you how to encrypt a file using gpg.
There are two types: Symmetric aka Private Key Encryption and asymmetric or Public Key
encryption.
As we’ve seen from the output of gpg --help GPG supports many different encryption
algorithms.
However the most commonly known ones are advanced encryption standard or AES for symmetric encryption
and RSA and ECDSA for asymmetric encryption. Note that ECDSA stands for Elliptic Curve Digital
Signature Algorithm
and is starting to replace RSA. For example The Bitcoin cryptocurrency uses ECDSA.
Let's see how to encrypt a file using symmetric encryption.
Then the file can be decrypted by anyone who has the password or the passphrase.
This can be useful just for encrypting your own sensitive files locally or to encrypt a file before
sending it to someone else.
If you choose to send the encrypted file to someone else over an unsecured channel like the Internet
you'll have to make sure that you'll find a more secure channel to send him the passphrase; the exchange
of the shared password, in a secure manner, can be problematic sometimes. There are 2 formats of output you
can get: binary and text. The binary version will take up less space but the ASCII or text version
is preferable when you want to transport it as text like say pasting it into an email. GPG
can encrypt any file type
but for this example I'll take a text file. I've already created a simple text file called secret.txt
This is its contents and I’m executing: gpg -c secret.ext and its prompting for a passphrase.
Use something complex, at least 12-14 random characters including ditis and the special characters or
6 random words; just for this example
I'll use something simple to write it fast.
And in the same directory a new file has appeared.
This is the encrypted file in binary form.
Secret to that the secret.txt.gpg
Let's see its contents.
It's random gibberish! By default GPG uses AES256 as the encryption algorithm.
This is very secure but if you want to change it for any reason you can use the --cipher-algo
option. To check what part of the available symmetric algorithms execute gpg
--version.
The symmetric encryption algorithms available are in the cipher section. For the next example
let's choose blowfish which is by the way a very strong algorithm.
I also want to specify manually the name of the output file and I'm executing a gpg-c
-cipher -algo
the name of the algorithm blowfish
-o
and the name of the output file for example
secret_blowfish.txt.gpg and the file that will be encrypted
secret.txt. It's asking for the passphrase and I'm entering the passphrase or the password.
And the new file named secret_blofish.txt.gpg has appeared in the current working
directory.
After encrypting your file, if you want to keep it for storage,
don't forget to erase the clear text version, this file. You could use the shred command instead of rm
because it overrides the file to hide its contents and then delete it. This will make it very hard
for anyone who wants to recover the deleted file.
Something like this shred -vu -n 100 secret.txt
The file was overwritten 100 times and then deleted.
When you want to decrypt your file you execute: gpg -o
the name of the clear text file that will be created secret.txt -d and the name of
the encrypted file secret.txt.gpg
There is a new file called the secret.txt in the currentworking directory.
It has automatically determined if it was symmetrically encrypted,
the encryption algorithm or if it was encrypted asymmetrically with something like RSA or e ECDSA and
it needs to look for a private key.
Maybe you wonder why didn't it ask for any passphrase?
The answer is that the gpg uses by default a software component called gpg agent
this is its man page. Gpg-agent runs as a demon and manages secret or private keys.It's running as a
demon in the background so for this session the gpg. demon is keeping a copy of the passphrase securely
in the RAM.
You can make it forget the passphrase like this:echo RELOADAGENT in upper case letters
| gig-connect-agent
or if you want to manually terminate the currently running agent you can execute gpgconf --
kill gpg-agent.
Now if I try to decrypt the same file it will ask for the passphrase.Let's run the command that decrypt
the file, this one, and it's asking for the passphrase.
Let's move on and see how to create an ASCII format output instead of binary. As I said it is useful
when you want to use the encrypted message, in text based applications, like pasting it somewhere. To produce
an encrypted ASCII format,
all you have to do is to add -a or -- -armor option to the gpg command like this:
gpg -ca and the clear text file that will be encrypted secret.txt
and the resulting encrypted file is secret.txt.asc in the current working directory.
All of the options we have seen in the previous exemples are still available.
This is a text file.
This is the encrypted file.
And you decrypted as usual gpg-d secret.txt.asc and it was decrypted.
This is the contents of the file.
Remember that the gpg agent kept a copy of the passphrase in the RAM.
Okay, that's all about the symmetric or private key encryption using gpg.
In the next lecture will move to asymmetric or public key encryption.
See you in a second!