GnuPG Command on Linux: Encrypt, Sign, and Verify Files and Messages

The GnuPG Command in Linux is a GNU Project application that implements OpenPGP as defined by RFC4880. GnuPG allows you to encrypt and sign your data and messages, using public and private keys.

The idea is that you make your public key available to the world and keep your private key secret.

Anyone with a copy of your public key can encrypt information and send it to you, because only you will be able to decrypt the messages. It is also possible to sign files, so that anyone with your public key can verify that a specific file or message came from you.

The latest version of GnuPG can be installed through the gnupg package from your distribution.

Once installed, you need to generate the user's keys using the "--gen-key" option of the gpg command:

$ gpg --gen-key

Figure 22 - gpg --gen-keys

Once the key pair is created, you must export the public key so that other people can send you messages or verify the signature of messages you sent. To export the public key, use the "--export" option:

$ gpg --export [email protected] > uira.pub

If you want to verify the created file:

$ file uira.pub uira.pub: PGP/GPG key public ring (v4) created Wed Oct 23 11:28:11 2019 RSA (Encrypt or Sign) 3072 bits MPI=0xbfa4300b374fd596...

To import other people's keys, use the "--import" option:

$ gpg --import chave.pub

You can view the keys that were created with the "--list-keys" argument

$ gpg --list-keys
/home/uiraribeiro/.gnupg/pubring.kbx
------------------------------------
pub   rsa3072 2019-10-23 [SC] [expires: 2021-10-22]
      E725EE3678AB3C99D51C625646BFCC17E483A6E0
uid           [ultimate] Uira Ribeiro <[email protected]>
sub   rsa3072 2019-10-23 [E] [expires: 2021-10-22]

You can put your public key on your website, or send it to your friends.

Once a public key from another person is imported, it can be validated through verification of its digital signature:

$ gpg --edit-key [email protected]  1024D/9E98BC16  created: 1999-06-04 expires: never  trust: -/qsub  1024g/5C8CBD41  created: 1999-06-04 expires: never     (1)  Carla Cruz <[email protected]>Command> fprpub  1024D/9E98BC16 1999-06-04  Carla Cruz <[email protected]>Fingerprint: 268F 448F CCD7 AF34 183E  52D8 9BDE 1A08 9E98 BC16

The "fingerprint" signature must then be verified with the owner of the public key, so that it is guaranteed that that public key belongs to its true owner. This prevents someone from being able to create a public key pretending to be another person. 

Sometimes you can just accept that the key is indeed from the person who sent it to you, even without verifying the signature. 

In any case, you can sign the imported public key with your key:

$ gpg —edit-key [email protected]  1024D/9E98BC16  created: 1999-06-04 expires: never  trust: -/qsub  1024g/5C8CBD41  created: 1999-06-04 expires: never     (1)  Carla Cruz  <[email protected]>Command> signpub  1024D/9E98BC16  created: 1999-06-04 expires: never   trust: -/qFingerprint: 268F 448F CCD7 AF34 183E  52D8 9BDE 1A08 9E98 BC16

File Encryption with GPG

To encrypt a file to send to a specific person, you must have that person's public key imported and verified.

The "--encrypt" option is used to encrypt the data:

$ gpg --output documento.gpg --encrypt --recipient [email protected]  documento.pdf

This way, the documento.pdf was encrypted and saved with the name documento.gpg, which can only be read by Carla Cruz, who holds the private key.

This way, Carla, and only Carla, can view the contents of the documento.gpg file using the "--decrypt" option:

carla:~\# gpg --output arquivo.pdf --decrypt documento.gpg

Document Signing

You can also digitally sign documents, so that people can verify that a file is indeed from you and has not been altered by anyone.

To digitally sign a file, use the "--sign" option:

$ gpg --output documento.sig --sign documento.pdf

This way, the file will be compressed and your signature will be added.

With the "--sign" option the file is not encrypted and anyone who has your public key can view its contents and verify your signature.

To verify a signature and read the signed document, you must use the "--decrypt" option:

$ gpg --output documento.pdf --decrypt documento.sig

You can also sign emails with a text signature, using the "--clearsign" option:

$ gpg --clearsign email.txt

This way the text will be signed with a hash:

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512Este é um email de teste.Abraços,prof. Uirá Ribeiro-----BEGIN PGP SIGNATURE-----iQGzBAEBCgAdFiEE5yXuNnirPJnVHGJWRr/MF+SDpuAFAl2wadEACgkQRr/MF+SDpuAU9AwAkmQ/ffkJv0k2T1yq0VxuuG6ezxOulapr0dsFHCVWCXinYmjil/oNMamwtZw4cDAKbdjMmP+3dg8a234dsFyN43AOiwznx8QPeJeMtWQNaWo9cg5THNZiKR5wthsPMUC+3mcV0AqlGy3y5u9m4Uh6K97x+BjGc2XYkG6O3bocooSRTS3+rvDbGioR3a84WtGY+YlgUsKlGhn4eUdfJ1+LxUNgUsSuT45CdDujB2VQXw3KK34/CGAxdctHLBsI+DNrc/w/1lTjnmNpYGCdWjtQXAt8/DpXuI1GFJCZJmXD3Eu0gC7R7XTibcjUCvMp5ovONTCGrnwkYXBSVwM/fZYKrcAManG5Vqyqepd7x6FVysxVPpbgPh/IKN51RlfQeuF0+PjvqO5r3ShZxWvawnVh1kkEe2I0mYgW2aQWUdN7hC+zQZaHx6Gj3gIZMD1OJvCAuhW3yhBQV0EMOjotAhQC8NOfVrEKSSqD0yZs40kM+lwsNlJlNfLDMh3TJIcAJGem=TPYZ-----END PGP SIGNATURE-----

The same "--decrypt" option can be used to verify if the message is authentic and has not been altered:

$ gpg  --decrypt email.asc Este é um email de teste.Abraços,prof. Uirá Ribeirogpg: Signature made Wed 23 Oct 2019 11:55:13 AM -03gpg:                using RSA key E725EE3678AB3C99D51C625646BFCC17E483A6E0gpg: Good signature from "Uira Ribeiro <[email protected]>" [ultimate]

Revoking Keys

If you lost your private key, or if someone has had access to your private key, or even if you have forgotten your passphrase, you can generate a key revocation.

Key revocation generates a certificate that must be distributed alerting users that your current key and signature are no longer valid.

$ gpg --output revoke.asc --gen-revoke minhachave

The minhachave argument can be the key ID, or the userID that identifies your key.

This revocation certificate is quite small. It is recommended to print it and keep it in a safe place and delete it from the computer.

GnuPG files reside in the users' HOME directory, named ~/.gnupg/

Learn much more about Linux in our online course. You can enroll here. If you already have an account, or want to create one, just log in or create your user here.

Liked it? Share