A PGP key is an encryption key with two main parts:
- Private Key
- Public Key
The owner of the key pair is the only individual that should have access to the Private Key, at any time.
A Public Key can be posted anywhere.
When someone wants to send you a secret message, or file, they can use your public key to generate cipher text.
Only the Private key can decrypt that cypher text.
GNU Privacy Guard (GPG) can be used to do PGP activities (Pretty Good Privacy).
gpg is most likely already installed on your distro. It should come with homebrew on Mac, or install with brew install gnupg.
Fast Way To Generate A Secure Key
# make a key pair, follow the prompts gpg --gen-key # export the public key to txt gpg --output public-key.txt --export --armor 'johndoe@localhost'
Long Way (Bigger Key Size 4096, More Secure)
Generate a full key (public and private).
Choose RSA + RSA
RSA and RSA
Choose a keysize of 4096 bits
Choose an expiry time of two years
Enter your name, or alias, and email address.
You will be asked to set a passphrase.
This is a password for the private key.
So, even if someone has the private key, they still need to password to use it.
You’ll need to enter this password anytime you want to decrypt messages.
Make a big password, but one that you will remember.
If you forget this passphrase, it is virtually impossible to use your keys again.
A typical key lifespan is two years. It is not recommended to make a key that will never expire.
If the password is too small, someone can brute force entry into the private key (they still need the key in the first place).
gpg: key 7BB47A69CE91569C marked as ultimately trusted gpg: revocation certificate stored as '~/.gnupg/openpgp-revocs.d/4FFF1CFF1D52EF7D86F82C277BB47A69CE91569C.rev' public and secret key created and signed. pub rsa4096 2020-12-17 [SC] [expires: 2022-12-17] 4FFF1CFF1D52EF7D86F82C277BB47A69CE91569C uid Jane Doe sub rsa4096 2020-12-17 [E] [expires: 2022-12-17]
This key was named on the local machine as
For the above key, the public fingerprint is
The public fingerprint is sometimes stored like this:
4FFF 1CFF 1D52 EF7D 86F8 2C27 7BB4 7A69 CE91 569C
The fingerprint is not used to sign messages, you need the entire public key:
Exporting The Public Key
Show your keys:
You can refer to the key you just made in multiple ways:
# these are all the same # email gpg --output public-key.txt --export --armor janedoe@localhost # name/id gpg --output public-key.txt --export --armor 7BB47A69CE91569C # public signature gpg --output public-key.txt --export --armor 4FFF1CFF1D52EF7D86F82C277BB47A69CE91569C
This will generate a txt file with a Public Key!
gpg --output public-key.txt --export --armor 'johndoe@localhost' cat ./public-key.txt
-----BEGIN PGP PUBLIC KEY BLOCK----- mQGNBF/bBAIBDADpwGYV5wiI/i6Ov+EuTm/AhEX/4DgXEIyisKYVFfhAsrgMNRE4 M4yBPyC8ewsGiY0jmlU/Zy2KM9fiFrYYKpU26/otpschq0430r2Fygopfrv+NE7L ... ... ... SSv/L0c8C0W6QSzds7jVbnhFdgHwZgQqPCb5EpVi+H3ecQ5lZ4c/2riBj7uQ6Rfl VdKpulxA1dFth9nwKaVeWDcT+Fg= =zgkU -----END PGP PUBLIC KEY BLOCK-----
Test Your PGP Keys
I use GPG Crypter to encrypt/decrypt messages.
But if you want to test the key out, you can encrypt messages online https://8gwifi.org/pgpencdec.jsp
You can paste the public key anywhere you want. Do not paste your private key in a website, that would be ridiculous.
Using other public keys to encrypt messages for them to read (and only them)
You can import someone’s Public Key into gpg and it will show up inside GPG crypter.
You can import a Public Key from a txt file or standard input:
Just save the public key block into a text file, and import it.
gpg --import public-key.txt
gpg will find the start and end of the public key.
Or you can use standard input!
gpg --import <<'EOF' -----BEGIN PGP PUBLIC KEY BLOCK----- mQGNBF/bBAIBDADpwGYV5wiI/i6Ov+EuTm/AhEX/4DgXEIyisKYVFfhAsrgMNRE4 M4yBPyC8ewsGiY0jmlU/Zy2KM9fiFrYYKpU26/otpschq0430r2Fygopfrv+NE7L ... ... ... suYUR7l0Oyfa9K0zkTmJ9+oSe3ZOSBxP2HB4EWk/0+Iz50XYI7gjLlaSyxXTWTEg SSv/L0c8C0W6QSzds7jVbnhFdgHwZgQqPCb5EpVi+H3ecQ5lZ4c/2riBj7uQ6Rfl VdKpulxA1dFth9nwKaVeWDcT+Fg= =zgkU -----END PGP PUBLIC KEY BLOCK----- EOF
Then you will see that key inside GPG Crypter.
You will be able to encrypt messages, but will not be able to decrypt messages using just someone’s public key.
Decrypt a PGP message
Simply paste the cipher text into GPG Crypter, choose your key from the dropdown, and click decrypt text.
You will have to enter the password!