move pgp to gpg and add export and expiration notes
This commit is contained in:
@@ -1,103 +0,0 @@
|
|||||||
# PGP
|
|
||||||
|
|
||||||
- [PGP](#pgp)
|
|
||||||
- [Searching for Keys](#searching-for-keys)
|
|
||||||
- [GPG](#gpg)
|
|
||||||
- [Generate with GPG](#generate-with-gpg)
|
|
||||||
- [GPG Key Servers](#gpg-key-servers)
|
|
||||||
- [Fedora KDE](#fedora-kde)
|
|
||||||
- [Seahorse](#seahorse)
|
|
||||||
- [Evolution Email](#evolution-email)
|
|
||||||
- [Android](#android)
|
|
||||||
- [OpenKeychain](#openkeychain)
|
|
||||||
- [Fair Email](#fair-email)
|
|
||||||
|
|
||||||
## Searching for Keys
|
|
||||||
|
|
||||||
I publish all my keys to <https://keys.openpgp.org>
|
|
||||||
|
|
||||||
## GPG
|
|
||||||
|
|
||||||
### Generate with GPG
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Make sure you have pinentry installed
|
|
||||||
dnf install pinentry
|
|
||||||
|
|
||||||
# Generate the key. The defaults should be good enough.
|
|
||||||
gpg --full-generate-key
|
|
||||||
|
|
||||||
# Verify your key was created
|
|
||||||
gpg --list-keys
|
|
||||||
```
|
|
||||||
|
|
||||||
### GPG Key Servers
|
|
||||||
|
|
||||||
Edit `~/.gnupg/gpg.conf` and add `keyserver hkps://keys.openpgp.org`
|
|
||||||
|
|
||||||
Sync keys with keyserver using `gpg --refresh-keys`
|
|
||||||
|
|
||||||
Search for a user's key `gpg --auto-key-locate hkps://keys.openpgp.org --locate-keys git@ducoterra.net`
|
|
||||||
|
|
||||||
Export your public key with `gpg --export -a 'git@ducoterra.net' > keys/git_ducoterra_net.pub`
|
|
||||||
|
|
||||||
Inspect a public key with `gpg --show-key keys/git_ducoterra_net.pub`
|
|
||||||
|
|
||||||
You can upload a key with `gpg --keyserver https://keys.openpgp.org --send-keys
|
|
||||||
7FC1B2970...` but the email won't be associated with it. Use the [upload
|
|
||||||
page](https://keys.openpgp.org/upload) and upload the key file generated above
|
|
||||||
instaed. You'll need to verify your email after upload for it to be searchable.
|
|
||||||
|
|
||||||
## Fedora KDE
|
|
||||||
|
|
||||||
### Seahorse
|
|
||||||
|
|
||||||
Taken from <https://riseup.net/en/security/message-security/openpgp/gpg-keys>
|
|
||||||
|
|
||||||
1. Launch Seahorse. It should be installed by default.
|
|
||||||
2. Select GnuPG keys.
|
|
||||||
3. Select the + sign to create a new key.
|
|
||||||
4. Select PGP Key.
|
|
||||||
5. Enter your email and the name you would like to be associated with the
|
|
||||||
key. This doesn’t need to be your real name.
|
|
||||||
6. Select advanced options.
|
|
||||||
7. Encryption type should be RSA.
|
|
||||||
8. Key strength should be 3072.
|
|
||||||
9. Expiration date should be within less then two years. You can always
|
|
||||||
extend the key expiration as long as you still have access to the key,
|
|
||||||
even after it has expired. Why should I set an expiration -.
|
|
||||||
10. Enter a strong password that you can remember. If you forget this
|
|
||||||
password, it cannot be recovered and any encrypted data you have using it
|
|
||||||
for, including emails, will be permanently inaccessible.
|
|
||||||
11. The computer will now generate the key, which may take some time. After
|
|
||||||
this, you will have an OpenPGP key pair that is ready to be used—Great!
|
|
||||||
You can manage the key options, export the public key, change the
|
|
||||||
password, delete and/or revoke the key, and perform other key adjustments
|
|
||||||
through the Seahorse user interface or the command line.
|
|
||||||
12. Optional: At this point, you can publish your public key to a key server
|
|
||||||
where people can request it remotely to be able to send encrypted data
|
|
||||||
and emails to you. Before you continue, please make sure you have
|
|
||||||
selected a good keyserver. Once you are ready:
|
|
||||||
1. Select the Key(s) you want to publish. Hold Ctrl and click to select
|
|
||||||
more than one, or press Ctrl+A to select all keys.
|
|
||||||
2. Navigate to Remote → Sync and Publish Keys…
|
|
||||||
3. Press the Key Servers button.
|
|
||||||
4. Publish the keys to any keyserver (select one if the “Sync” button was
|
|
||||||
grayed out in the previous screen); they all synchronize with each
|
|
||||||
other, so your key will be on each one.
|
|
||||||
5. Recommended: Check the Automatically retrieve keys from key servers
|
|
||||||
but do not check the Automatically synchronize modified keys with key
|
|
||||||
servers check boxes. Instead, please consider using parcimonie.
|
|
||||||
6. Press the Close button and then the Sync button to synchronize your
|
|
||||||
keys.
|
|
||||||
|
|
||||||
Your public key is now published on the key servers and is accessible to
|
|
||||||
others!
|
|
||||||
|
|
||||||
### Evolution Email
|
|
||||||
|
|
||||||
## Android
|
|
||||||
|
|
||||||
### OpenKeychain
|
|
||||||
|
|
||||||
### Fair Email
|
|
||||||
119
active/software_gpg/gpg.md
Normal file
119
active/software_gpg/gpg.md
Normal file
@@ -0,0 +1,119 @@
|
|||||||
|
# GPG
|
||||||
|
|
||||||
|
- [GPG](#gpg)
|
||||||
|
- [Searching for GPG Keys](#searching-for-gpg-keys)
|
||||||
|
- [Generate GPG Keys](#generate-gpg-keys)
|
||||||
|
- [Renewing GPG Keys](#renewing-gpg-keys)
|
||||||
|
- [Export GPG Keys](#export-gpg-keys)
|
||||||
|
- [GPG Key Servers](#gpg-key-servers)
|
||||||
|
- [Using GPG keys](#using-gpg-keys)
|
||||||
|
- [Linux Apps](#linux-apps)
|
||||||
|
- [Evolution Email](#evolution-email)
|
||||||
|
- [Android Apps](#android-apps)
|
||||||
|
- [OpenKeychain](#openkeychain)
|
||||||
|
- [Fair Email](#fair-email)
|
||||||
|
- [Troubleshooting](#troubleshooting)
|
||||||
|
|
||||||
|
## Searching for GPG Keys
|
||||||
|
|
||||||
|
I publish all my keys to <https://keys.openpgp.org>
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Search for an arbitrary user's key
|
||||||
|
gpg --auto-key-locate hkps://keys.openpgp.org --locate-keys <email>
|
||||||
|
```
|
||||||
|
|
||||||
|
## Generate GPG Keys
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Make sure you have pinentry installed
|
||||||
|
dnf install pinentry
|
||||||
|
|
||||||
|
# Generate the key. The defaults should be good enough.
|
||||||
|
gpg --full-generate-key
|
||||||
|
|
||||||
|
# Verify your key was created
|
||||||
|
gpg --list-secret-keys
|
||||||
|
|
||||||
|
# Edit a key in your keyring
|
||||||
|
gpg --edit-key <id>
|
||||||
|
```
|
||||||
|
|
||||||
|
## Renewing GPG Keys
|
||||||
|
|
||||||
|
You should set an expiration for your keys. You can extend that expiration (or
|
||||||
|
set it on existing keys) with:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Note 2y == "expire 2 years from now"
|
||||||
|
# You can also set '0' for no expiration or use 'd' days and 'w' for weeks
|
||||||
|
gpg --quick-set-expire <key id> 2y
|
||||||
|
|
||||||
|
# Don't forget to republish your keys with new expirations
|
||||||
|
gpg --keyserver https://keys.openpgp.org --send-keys <key id>
|
||||||
|
```
|
||||||
|
|
||||||
|
## Export GPG Keys
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Export your public key in ascii format
|
||||||
|
gpg --export -a 'git@ducoterra.net' > keys/git_ducoterra_net.pub
|
||||||
|
|
||||||
|
# Export your private key
|
||||||
|
gpg --export-secret-keys -a 'git@ducoterra.net' > git_ducoterra_net.key
|
||||||
|
```
|
||||||
|
|
||||||
|
## GPG Key Servers
|
||||||
|
|
||||||
|
Edit `~/.gnupg/gpg.conf` and add `keyserver hkps://keys.openpgp.org`
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Sync keys with keyserver
|
||||||
|
gpg --refresh-keys
|
||||||
|
|
||||||
|
# Search for a user's key
|
||||||
|
gpg --auto-key-locate hkps://keys.openpgp.org --locate-keys git@ducoterra.net
|
||||||
|
|
||||||
|
# Export your public key
|
||||||
|
gpg --export -a 'git@ducoterra.net' > keys/git_ducoterra_net.pub
|
||||||
|
|
||||||
|
# Inspect a public key with
|
||||||
|
gpg --show-key keys/git_ducoterra_net.pub
|
||||||
|
|
||||||
|
# Upload a key to a keyserver
|
||||||
|
# NOTE: if you upload your key to keys.openpgp.org with this command, the email
|
||||||
|
# won't be searchable. You'll need to Use the upload page
|
||||||
|
# (https://keys.openpgp.org/upload) and upload the key file generated above
|
||||||
|
# instaed. You'll need to verify your email after upload for it to be searchable.
|
||||||
|
gpg --keyserver https://keys.openpgp.org --send-keys <key id>
|
||||||
|
```
|
||||||
|
|
||||||
|
## Using GPG keys
|
||||||
|
|
||||||
|
## Linux Apps
|
||||||
|
|
||||||
|
### Evolution Email
|
||||||
|
|
||||||
|
1. Edit -> Preferences -> Double click the account with a GPG key -> Security ->
|
||||||
|
OpenPGP Key ID
|
||||||
|
2. Always sign outgoing messages
|
||||||
|
3. Advanced Options -> Always trust keys in my keyring when encrypting
|
||||||
|
|
||||||
|
## Android Apps
|
||||||
|
|
||||||
|
### OpenKeychain
|
||||||
|
|
||||||
|
### Fair Email
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
"error receiving key from agent: No such file or directory - skipped"
|
||||||
|
|
||||||
|
"error obtaining lock... process is in use by..."
|
||||||
|
|
||||||
|
In general, the easiest way to fix gpg problems is by killing and restarting the agent.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
gpgconf --kill gpg-agent
|
||||||
|
gpgconf --reload gpg-agent
|
||||||
|
```
|
||||||
Reference in New Issue
Block a user