Gnu Privacy Guard (GnuPG/gpg) information

GnuPG enables two individuals to communicate privately (encryption) or to ensure that communications have not been altered (signing) without caring about the methods used to transport those communications (though hand written messages would be quite annoying and error-prone.)

The GnuPG home page is http://www.gnupg.org/. There they have some documentation links to on-site and off-site documentation. A couple on the first-read list are the Mini-HOWTO and the Keysigning Party HOWTO.

http://webber.dewinter.com/gnupg_howto/english/GPGMiniHowto.html http://www.cryptnet.net/fdp/crypto/gpg-party.html

Between using GnuPG for encryption or signing, the most visible use is in signing. You may have seen signatures on an email before or noticed that your distribution's package system allows you to check the signatures of the package. GnuPG and PGP signatures are fairly light-weight and unobtrusive on an email message unlike X.509 based PKI signatures. GnuPG is available as a plug-in to many email programs including Mozilla-Mail and (aka) Thunderbird via the Enigmail extension.

Before you can make effective use of a GnuPG signature you need to verify that it is valid. You could of course choose to trust a key without verifying it, but you almost may as well not use the system at all then. To verify a GnuPG key you should get a written or printed copy of the other party's GnuPG key hex fingerprint, it's size (eg 1024) and type. You would then communicate with the other party, verifying that they are who they say the are and that your copy of the key information is what it should be. Note on your copy that the information is verified and the next time you are at your GnuPG enabled computer download and sign their key. Then return the signed copy back to them.

You may be thinking, but there's no way I can verify the identities and keys of all my distribution's packagers! GnuPG, following the lead of PGP, recognizes and allows for that via a concept called the web of trust. The way it works is this. Lets say you know me and have verified my key. In addition you have decided that you trust me well enough to 'certify' or 'verify' others. You can note in your GnuPG database that you trust me well enough that you automatically trust anyone who's keys I have signed. That way you trust in proxy everyone who I have certified. This extension of your own signings is called the web of trust. One way to expand that web quickly is at a keysigning party.

If you are having an organized key signing party it is helpful if people can say before hand that they are planning on participating. Then the organizer can print up a list of everyone's keys and hand out copies of the lists to each person attending. This and other ideas listed at the Keysigning Party HOWTO page can greatly speed up a key exchange with many individuals. The form would look like this:

Key ID	Owner	Fingerprint	Size	Type	Key Info Matches?	Owner ID Matches?
92FF9C21	Jacob L. Anawalt (Computer Stuff)	DDBF 5B0F A000 1BD1 5FBD 526B D241 C635 92FF 9C21	1024	DSA		

If you're interested in growing your GnuPG web of trust there are a few ways you can be proactive in doing this. Sponsor keysigning parties. Keep your key info handy to exchange with others for chance keysignings. Sign up with key exchange listing services like http://www.biglumber.com/ and use services like that to find others when you travel.

To create a new public/private key pair, run:

gpg --gen-key

and follow the prompts.

To list public keys, run:

gpg --list-keys

To list private or secret keys, run:

gpg --list-secret-keys

To delete a public key from the local key ring:

gpg --delete-keys NAME

To delete a secret key from the local key ring:

gpg --delete-secret-key NAME

To encrypt a file, use:

gpg -r NAME --output OUTFILE.gpg --encrypt INFILE

To decrypt a file, use:

gpg -r NAME --output OUTFILE --decrypt INFILE.gpg

2005-02-18T14:42:59