blob: 354d9213a06b32697f403e5ef45e388661373b55 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
Title: 05. Encryption 101: PGP on Linux
Date: 2015-10-27 09:00
Category: Data Privacy
Tags: Guides
Published: false
Slug: 05-encryption-101-pgp-on-linux
Status: published
It's only been around a million years since I last wrote about this stuff :) Back when I started this series I was still using OSX and obviously focused very heavily on Mac, iOS and the likes and could barely get myself to write a little tutorial about e-mail encryption for Windows (only because friends nagged me about it).
But that's all different now. I've been almost exclusively using Linux for the last year (maybe 1 1/2 years) and I thought I'd give the PGP toolchain on Linux also called Gnu Privacy Guard (GPG) some love. So shall we begin?
### Setting up GPG with Thunderbird
So most people will be using a mail client - I use Thunderbird because *reasons* - so let's focus on that for now. And to be honest...that's kinda boring. Please have a look at my guide on how to set up Thunderbird with Enigmail on Windows because on Linux (because of Thunderbird) it works pretty much the same way.
**The jist**
`sudo $package_manager install thunderbird`
With
Fedora 22+ `dnf`
Fedora 21 and earlier `yum`
Ubuntu `apt-get`
New Debian stuff `apt`
Arch `pacman` or `yaourt`
You get the idea...
Install the Enigmail plugin like described [here](http://spacekookie.de/data-privacy/04-encryption-101-pgp-on-windows/)!
### Getting to know the CLI
`gpg2` is a command that is installed on basically any modern Linux Distribution. And it comes with a plethora of options. It can do signing, message encryption with RSA, symmetric ciphers, hashing and compression.
Let's start with creating a new key. Like you might have read in the other tutorials GPG/ PGP uses asymetric encryption which means that you need a key-pair to use it. One key is public, for everybody to have and use, the other one is private, only for you to decrypt messages.
`gpg2 --gen-key` drops you into a nice interactive program that helps you generate a keypair and automatically adds it to your personal keychain. For all the other commands in this post to make sense you should have a keypair around to try everything out for yourself.
After you have a keypair you can go and list your keychain.
```
❤ (idenna) ~> gpg2 --list-keys
/home/spacekookie/.gnupg/pubring.gpg
------------------------------------
pub rsa4096/0022A74E 2014-08-16 [expires: 2020-08-16]
uid [ultimate] spacekookie (Hack the planet!) <spacekookie@c-base.org>
sub rsa4096/FEAAFEA5 2014-08-16 [expires: 2020-08-16]
sub rsa4096/3B1D08AC 2014-10-30 [expires: 2016-10-29]
```
You can of course also just get the fingerprint off a certain key. For that you either need your e-mail address or your key ID.
```
❤ (idenna) ~> gpg2 --fingerprint 0022A74E
pub rsa4096/0022A74E 2014-08-16 [expires: 2020-08-16]
Key fingerprint = 6B93 6393 9583 E61C 9AD7 16AE 64EF 9E1B 0022 A74E
uid [ultimate] Katharina Sabel (Personal) <katharina.sabel@mailbox.org>
uid [ultimate] spacekookie (Hack the planet!) <spacekookie@c-base.org>
sub rsa4096/FEAAFEA5 2014-08-16 [expires: 2020-08-16]
sub rsa4096/3B1D08AC 2014-10-30 [expires: 2016-10-29]
```
I usually end up using my fingerprint ID just because it's shorter to type. And I actually have quite a nice one to remember C:
### Import & Export
We can also export keys from our keychain.
```
gpg2 --export 0022A74E
\(j�ڀ���sO�έ5'�bQ�6
�U\�1���~ꢟSSÜu��-���䡘<|�1����Gd{�&K�c<�.
?��r�&,s��
:�\����ـo�T'e��kT��g�����g�p.
U���d)�V��?Sk��0w���o��6� �%�i�N�M��$%ڶr_2q���
o~��'��0��p)���5�k]��F�L�ks���ؙ��z��J�Pt}?�*�
�'6���q�8�f�]�m8m�s:ӕ�pԾz�?�ϴ|��f�B<ѹ�#�m�Gߞ���q 5���Y�sAIV<��.^$ޘ���f}�/�?��(��B�
������%0068b��dAK>�� {'���n�
�c���JT� qz����
�NM���U9��UP�諤wĸ��ds�CW_�)�s���Qc����iË�(���!�lv���� ��
```
But you'll notice that's in binary. To get something more human readable you can pad it in ASCII Armour with `-a` for something more managable.
```
❤ (idenna) ~> gpg2 -a --export 0022A74E
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2
mQINBFPvZQMBEADMRx7NgsAUBPHR4V5rNvANXChqs9qA+oqvc0/Izq01J+xiUcEM
31VcGKoxxv3Bfuqin1OPkFPDnHUOxecti5H15KGYPHylMdbD5M4UR2R7uiZLoGM8
yi4LP8GjcsAmBSxzA4H0DI83OqJc+YX5tNmAb+VUcggPJw4BZaO8a1SYDt5npRWA
DqPL72f2cC4Luhj4XngN5xim5if7myiqK9mY6FJhmJKzBxwD+mPgd+GMp2kCmQc5
JeKkQRmagN+b2Q1VEpL51WQpoFao4T9Ta5eqMHf7vZtvF4S2Nt4dILklu2n1TqtN
mq0kJdq2cl8yBXEWqp8T1AxvfsYU2CfnnzDh33Ap5BKstRc1imsHXdbFRuZMgmtz
```
The same way you can import keys either from a server
```
gpg2 --keyserver gpg.mit.edu --recv 0022A74E
```
or if you received an e-mail with someone elses key (or you nicked it off their website *hint hint*) you can import them as well
```
gpg2 --import 0022A74E.asc
```
and it'll show up in your keychain.
### Signatures
You can of course also sign messages with your private key to let people know that it was really you who sent a message. Maybe a public statement or a blackmailing threat. Whatever floats your boat.
```
gpg2 --clearsign file.txt
```
It will result in a file like you can find [here](https://spacekookie.de/pgp/spacekookie-on-the-tubes.txt).
You can of course also sign keys or not have clear signed messages but only signatures for specific messages with `--detach-sign` and `sign-key`.
### Encryption
Of course the primary idea of GPG is to provide e-mail/ message encryption. It's fairely straight forward with
```
gpg2 -a --encrypt message.txt
```
You can combine that command with a signature and even remove the ASCII Armour if you want the binary output of the file.
And that's that. You can send that to someone now. Or print it out and hang it on your wall or whatever.
---
I don't think most people will ever care about using GPG as a commandline tool but I think it's important that people understand how to, if they ever end up in a situation where they do. I also hope that this post has been somewhat useful to you. And wish you happy message encrypting :)
~Kate
|
