When it comes to Public Key Cryptography there are private and public keys which are related.
You can share your public key with anyone but you must keep your private key secure.
If someone gets your private key in clear text the encryption is compromised. Let's start by creating
a new key pair. You can generate as many key pair as you want! gpg --gen-key
And standard dialog for generating the key pair pops up. To generate the key
I have to enter my name and my email address like say Andrei and andrei@somedomain.com
To help safeguard my key, GnuPG does not store my private key in clear-text on the disk.
Instead it encrypts it using a symmetric encryption algorithm.
That is why it's prompting for a passphrase.
Thus there are barriers an attacker must cross to access my private key:
1 - He must actually acquire the key and 2 - he must get the past the encryption. And I'm writing a password.
This is just for this test.
But you should use a passphrase that is at least eight characters long.
The private and the public keys were generated. Maybe you wonder where the keys are saved.
All GPG keys are stored in what is called a "keyring". On Linux
this is a hidden directory called .gnupg in the user’s home directory
This one.
On Windows
the keys are saved in a directory gnupg in the AppData directory of the user.
Note that AppData is a hidden directory on Windows. Running gpg --version will
show you the path being used.
This is where the keyring is saved.
Let's take a look at the public keys stored in the keyring gpg --list-keys
I listed my public key and other people's public key
I have imported into the keyring; and if I want to list my own private key I execute gpg--
list-secret-keys. I see the public key cryptographic algorithm used, which is in this case RSA 3072
the generation and the expiration date and the key fingerprint. Gpg provides
a unique identifier for each key pair.
There is both a short and the long gpg key id which consists of eight hexadecimal digits for the short
ID and of sixteen hex digits for the long version.
This ID is important when you want to perform operations like importing or exporting the keys.
You can find it adding the --keyid -format to the gpg command that lists the keys
like: --keyid-format short This is the short id of the key and the long
ID like this:
This is the long ID of the key. Having the key pair ID we can export the keys in binary or ASCII form.
Let's export the private key into text or ASCII format in order to back it up somewhere:
gpg --export-secret-keys --armor and the key id
It's prompting for the passphrase and it has printed out the private key.
This is the private key.
This very long string!
If you want to save it to a file you use the output redirection operator:
> private_key.asc
perfect.
This is the private key.
It was saved into a file. If you want to export the public key you use a very similar command. Instead
of export
secret keys
I use only export
and I redirect the public key to a file called public.pub
This is the public key.
The exported keys can be imported back into the GPG keyring later.
Let's move on and see how to delete a private key from the local storage gpg --delete-secret-keys
and the key ID
There is a typo.
Keys
and it wants a confirmation.
One more time and delete key.
Once you delete a key there is no way to recover it
the private key was deleted but the public key was not.
If I execute gpg--list-keys I'll see the public key in the keyring. To delete a public key
I have to execute gpg--delete-keys and of course the key ID.
It's the same key id.
gpg-- list- keyids will display an empty keyring
Let's
go ahead and see how to import a public or a private key into the gpg keyring from a file.
Most of the time you import your private key on a new computer or after a fresh install.
On the other hand somebody else's public keys imported to send him an encrypted message or to verify
a digital signature.
The next command is the same for importing both public and private keys: gpg--import and
the path to the private key file,
in this case it's private.asc
and it was imported; you can import the private key without asking for the passphrase adding the --
patch option like this:
first I'll delete the key
and I'll import the private key again adding --patch option and it was imported without asking
for the passphrase and finally let's import
the public key gpg-- import public.pub, the public key file.
It was imported!
Okay!
That's all! In the next lecture will discuss gpg key servers.