Skip to content

Latest commit

 

History

History
444 lines (292 loc) · 12.3 KB

gpg.md

File metadata and controls

444 lines (292 loc) · 12.3 KB

GnuPG

Description

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC 4880 (also known as PGP). GnuPG allows you to encrypt and sign your data and communications; it features a versatile key management system, along with access modules for all kinds of public key directories.

Directory

References

Setup

Description

This details how to install and setup GnuPG and Pinentry.

References

Steps

  1. Install the gnupg package (should come preinstalled by default in most cases) using yay.

  2. Install the pinentry package (should come preinstalled by default in most cases) using yay.

  3. (Optional) If you use KDE Wallet, you can also use it to store GPG key passphrases.

Generate GPG Key

Description

This details how to generate a GPG key.

References

Steps

  1. Launch a Terminal application (i.e. Konsole).

  2. Generate a GPG key using the gpg command:

    gpg --full-gen-key

  3. Add the following values when prompted:

    • What kind of key: 9 (ECC (sign and encrypt) *default*)
    • Which elliptic curve you want: 1 (Curve 25519 *default*)
    • Key is valid for: 1y
    • Is this correct: y
    • Real name: My Name (Add your real name here)
    • Email address: [email protected] (Add your email address here)
    • Comment: (Leave this blank or add a comment)
    • Change name, comment, email, or okay/quit: o

    Make any of your own adjustments to the above values as desired.

  4. Enter a passphrase when prompted or leave it empty. Save to the system's password manager if given the option.

Getting GPG Key Values

Description

This details how to get certain values relating to our GPG key.

References

GPG Key ID

This details how to acquire the unique identifier (long key ID) that is used to identify our GPG key:

  1. List the system's GPG secret keys:

    gpg --list-secret-keys --keyid-format long

    Sample output:

        /home/user/.gnupg/pubring.kbx
    ------------------------------
    sec   ed25519/1H89FHO4MGAJTJ9Z 2024-01-15 [SC] [expires: 2026-01-15]
        0A41C9F6335DBF47A1A186FAC82F22229FCCE1BF
    uid                 [ultimate] My Name <[email protected]>
    ssb   cv25519/A1B2C3D4E5F6G7H8 2024-01-15 [E] [expires: 2026-01-15]

  2. From this output, locate our GPG key and take note of the value of the second column from the row that says sec (Secret key) in the first column:

        sec   ed25519/1H89FHO4MGAJTJ9Z

    From this example, such value is ed25519/1H89FHO4MGAJTJ9Z.

  3. Copy the value trailing the / character (i.e. 1H89FHO4MGAJTJ9Z), which is our GPG key ID:

        1H89FHO4MGAJTJ9Z

GPG Public Key

This details how to get the public key of our GPG key:

  1. After acquiring our GPG key ID (i.e. 1H89FHO4MGAJTJ9Z), use it to export our GPG public key:

    gpg --armor --export 1H89FHO4MGAJTJ9Z

  2. Copy the GPG public key from the output accordingly.

    Sample output:

        -----BEGIN PGP PUBLIC KEY BLOCK-----

    7Ze49bA33Xzun7SbusOQspoUIYsgPny2eitPOKRvavumM+397nTftVhHia/eI410
    ...
    Lz8/MGzO2FgC33XdFwhyyp3yQH18XCnV4IMUgrFNrG==
    =iT48
    -----END PGP PUBLIC KEY BLOCK-----

Sign Git Commits

Description

This details how we can enforce automatic signing for all our commits and tags in Git and GitHub/GitLab.

References

Steps

  1. Copy the public key of our GPG key.

  2. Register the public key to GitHub:

    • Go to GitHub's SSH and GPG keys page.
    • Under the GPG keys section, click the New GPG key button.
    • Add a title for the GPG key (i.e. your system's user and hostname).
    • Paste our GPG public key into the Key text field.
    • Click the Add GPG key button.

  3. Register the public key to GitLab:

    • Go to GitLab's GPG Keys page.
    • Click the Add new key button.
    • Paste our GPG public key into the Key text field.
    • Click the Add key button.

  4. Configure Git to use our GPG key and enforce automatic signing for all our commits and tags.

    • Register our GPG key ID (i.e. 1H89FHO4MGAJTJ9Z) to Git:

      git config --global user.signingkey 1H89FHO4MGAJTJ9Z

    • Set automatic commit signing:

      git config --global commit.gpgSign true

    • Set automatic tag signing:

      git config --global tag.gpgSign true

  5. To ensure that GPG uses the correct terminal for user interaction when performing cryptographic operations, set GPG_TTY to the value of tty in your default shell profile.

    • Update the profile of your default shell (i.e. fish) with the following variable assignment:

      set -x GPG_TTY (tty)

      If your default shell is bash, add the following line instead to its shell profile:

      export GPG_TTY=$(tty)

    • Reload the updated shell profile (i.e. ~/.config/fish/config.fish) to apply the changes:

      source ~/.config/fish/config.fish

Update Config

Description

This details how to update the GnuPG agent configuration.

References

Steps

  1. Create or update an existing gpg-agent.conf config file:

    nano ~/.gnupg/gpg-agent.conf

  2. Write and save any necessary changes to the config file.

  3. Reload the updated config:

    gpg-connect-agent reloadagent /bye

Update GPG Key Passphrase

Description

This details how to update the passphrase of a GPG key.

References

Steps

  1. Get our GPG key ID (i.e. 1H89FHO4MGAJTJ9Z).

  2. Edit the GPG key using the following command:

    gpg --edit-key <gpg-key-id>

    Replace <gpg-key-id> with the value of our GPG key ID (i.e. 1H89FHO4MGAJTJ9Z) accordingly.

  3. In the gpg> prompt, enter the passwd subcommand to change the passphrase:

    passwd

  4. Enter the current passphrase of the GPG key when prompted.

  5. Enter the new passphrase and confirm it when prompted.

    You may need to enter the save subcommand in the gpg> prompt to save changes made to the GPG key.

Renewing Expired GPG Keys

Description

This details how to renew expired GPG keys.

References

Steps

  1. Get our GPG key ID (i.e. 1H89FHO4MGAJTJ9Z).

  2. Edit the GPG key using the following command:

    gpg --edit-key <gpg-key-id>

    Replace <gpg-key-id> with the value of our GPG key ID (i.e. 1H89FHO4MGAJTJ9Z) accordingly.

  3. In the gpg> prompt, enter the expire subcommand to update the GPG key's expiration date:

    expire

  4. When prompted, submit the following values to renew the secret key:

    • Key is valid for? (0): 1y for one year
    • Is this correct? (y/N): y to accept the key's new expiration date

    Sample output:

        sec  ed25519/1H89FHO4MGAJTJ9Z
        created: 2024-01-15  expires: 2026-01-15  usage: SC
        trust: ultimate      validity: ultimate
    ssb  cv25519/A1B2C3D4E5F6G7H8
        created: 2024-01-15  expired: 2025-01-14  usage: E
    [ultimate] (1). My Name <[email protected]>

  5. After renewing the GPG key's secret key, you may need to renew the GPG key's subkey(s) as well if you have received a warning like the following:

        gpg: WARNING: Your encryption subkey expires soon.
    gpg: You may want to change its expiration date too.
    gpg: WARNING: No valid encryption subkey left over.

    • In the same gpg> session, enter the list subcommand to show your GPG key:

      list

      Sample output:

          sec  ed25519/1H89FHO4MGAJTJ9Z
        created: 2024-01-15  expires: 2026-01-15  usage: SC
        trust: ultimate      validity: ultimate
    ssb  cv25519/A1B2C3D4E5F6G7H8
        created: 2024-01-15  expired: 2025-01-14  usage: E
    [ultimate] (1). My Name <[email protected]>

      You will need to renew every subkey(s) (denoted by the ssb prefix) that has expired.

    • To select the first subkey (i.e. 1), enter the following command:

      key 1

      Sample output:

          ssb* cv25519/A1B2C3D4E5F6G7H8

      The asterisk (*) indicates that the subkey has been selected.

    • Enter the expire subcommand to update the selected subkey's expiration date:

      expire

      Enter the same values you have submitted to renew the secret key earlier when prompted. Sample output:

          sec  ed25519/1H89FHO4MGAJTJ9Z
        created: 2024-01-15  expires: 2026-01-15  usage: SC
        trust: ultimate      validity: ultimate
    ssb* cv25519/A1B2C3D4E5F6G7H8
        created: 2024-01-15  expires: 2026-01-15  usage: E
    [ultimate] (1). My Name <[email protected]>

      The expiration date of each of your GPG key's subkey(s) should be updated accordingly.

  6. After the GPG key's secret key and subkey(s) expiration date have been updated, enter the trust subcommand to update the GPG key's trust level:

    trust

    When prompted, select the ultimate trust level (i.e. 5):

    5

    Confirm the selected trust level:

    y

  7. After the GPG key's secret key and subkey(s) expiration date have been updated, enter the save subcommand (in the gpg> prompt) to save changes made to the GPG key:

    save

  8. If you have previously registered the public key of your GPG key with any services such as GitHub or GitLab, you may need to update them with your new public key accordingly.