GPG: Difference between revisions
From YM2149.org
Jump to navigationJump to search
No edit summary |
No edit summary |
||
| Line 11: | Line 11: | ||
* typically you will generate a secret key per account and system for decryption, and copy its public key to other places for encryption there | * typically you will generate a secret key per account and system for decryption, and copy its public key to other places for encryption there | ||
* <code>gpg --output payload --export ...</code> | * <code>gpg --full-generate-key</code> to make a new key | ||
* <code>gpg --import payload</code> on | ** you should specify an expiry e.g. 1 year, this can always be extended | ||
* <code>gpg --output payload --export ...</code> to dump its public key | |||
* <code>gpg --import payload</code> on a target system to import the public key | |||
** then you need to trust it, see below | ** then you need to trust it, see below | ||
| Line 19: | Line 21: | ||
* <code>gpg --edit-key ...</code> | * <code>gpg --edit-key ...</code> | ||
* <code>trust</code> to make an imported public key usable for encryption | * <code>trust</code> to make an imported public key usable for encryption | ||
* <code>expire</code> to update expiry of a secret key | |||
* <code>passwd</code> to change the passphrase of a secret key | * <code>passwd</code> to change the passphrase of a secret key | ||
Revision as of 17:59, 21 November 2024
- also known as GNU Privacy Guard or GnuPG
- somewhat convenient way to manage your secrets
Config
~/.gnupg/gpg-agent.confdefault-cache-ttl ...to lock a key after the given number of seconds if unusedmax-cache-ttl ...to lock a key after the given number of seconds no matter what
- typically you will generate a secret key per account and system for decryption, and copy its public key to other places for encryption there
gpg --full-generate-keyto make a new key- you should specify an expiry e.g. 1 year, this can always be extended
gpg --output payload --export ...to dump its public keygpg --import payloadon a target system to import the public key- then you need to trust it, see below
Shell
gpg --edit-key ...trustto make an imported public key usable for encryptionexpireto update expiry of a secret keypasswdto change the passphrase of a secret key
Agent
gpg-connect-agent <<<helpfor list of commandsgpg-connect-agent <<<'help ...'for help on a specific command
gpg-connect-agent <<<reloadagentto pick up new config- this also forgets cached passphrases
gpg-connect-agent <<<'keyinfo --list'to check which keys (by keygrip) are currently unlocked, look for a1- note that all keys with the same passphrase are unlocked even if this shows just one of them is
gpg --list-secret-keys --with-keygripto show the keygrips of your secret keys
