• Home
• About
• Project documents
• News and events

Workbook on Digital Private Papers > How-Tos

How-Tos

Securing and signing documents using GNU Privacy Guard (GnuPG) command-line tool GPG

GPG is a command-line tool that enables documents to be secured for exchange with other users, as well as verification of the source of a document that has been signed or encrypted. GPG can:

• encrypt files so that only the intended recipient may read the contents of the file;
• sign files, so that recipients of the file will be able to verify the actual sender;
• decrypt and verify files that have been received from others;
• manage and maintain keypairs.

Generating a key pair

To utilise GPG's functions, requires that a pair of public and private GPG keys be created. When gpg is first run from the command line it will automatically create some configuration files:

and then it prompts with a number of questions, which we'll go through individually:

Select the default (1). The DSA key is used to sign documents and the ElGamal key will be used for encryption.

Then, the encryption key size is requested:

Keeping with the default keysize of 2048 bits is recommended unless security is the overriding concern. The longer the key size the greater the strength of the encryption, but there is corresponding decline in performance with a longer key length.

The period for the key's validity is then queried:

It is recommended that 0 be selected here. In almost all cases, allowing a key to expire creates more issues than it solves (for example: how to manage documents which have been signed by an expired key, management of certificate revocation lists). Confirmation of the choice is then requested:

Some information about the user needs to be entered, which will be stored in the key:

The user name, an email address and a comment (such as a role) are requested.
A prompt to allow the information to be modified is given; if the information is correct, choose "o" for "Okay."

Finally the passphrase to protect the private key is requested:

A memorable but hard to guess passphrase needs to be chosen. The passphrase should have a mix of upper- and lowercase letters, numbers and preferably one or more non-alphanumeric characters. It is allowed to contain spaces and multiple words, but should not be either a dictionary word or even a grammatically correct sentence. The passphrase must not be forgotten or disclosed! If the private key is somehow compromised, the passphrase is the only line of security that prevents a malicious user from posing as the key owner or decrypting files meant only for that user.

On entry of the passphrase, random typing is requested to help the random number generator operate. GPG will exit, after few seconds having created and signed the keys:

An optional step is to immediately create a revocation certificate in case the passphrase is forgotten or the private key has been compromised or lost. In which case the certificate may be published to notify others that public key is no longer valid for use.

janette_a.gpg --export janette

Will output the public key for janette to the file janette_a.gpg. This file can now be given to anyone with whom an exchange of signed or encrypted files is intended.

To verify files received from other users, as well as to encrypt files for sending to those users, their keys will need to be imported. Once their public key has been received, gpg will need to be run with the --import option:

Before using someone else's public key, the key should be verified to make sure that it has indeed come from that person. To do this, requires the key's fingerprint to be found. gpg is invoked with the --edit-key option (the key may be identified by either the real name or the email address of the key's owner):

At this prompt, enter "fpr" to see the key's fingerprint:

Once the fingerprint has been established the owner of the key should be contacted, preferably by phone or in person. Check that the fingerprint of the owner's key matches the one received. If it does, then the key should be signed in order to use it:

GPG will ask for confirmation, answer "y" here, then the signing key's passphrase is requested. Imported and signed keys can be checked to list the signatures on them. The user id on the key will have one or more self-signatures as well as signatures from those users who have validated the key.

Finally, type "quit" at the next prompt to exit GPG (answer "y" when asked to save changes).

Encrypting and decrypting files using keys

Now that Janette has a validated the public key for Kathy, she can use it to encrypt her communications with Kathy and likewise Kathy can use Janette's exported public key to encrypt messages back to Janette. Both Janette and Kathy will need to use their own private keys to decrypt the encrypted messages they receive from each other.

If Janette wishes to encrypt a file janettes.doc so that it can only be read by Kathy, the --encrypt option is used:

This option generates an encrypted file called janettes-doc.gpg that can be decrypted only by the use of Kathy's private key. Use of this command requires that the receiver's public key has already been imported.

To decrypt a file kathys-doc that has been encrypted with Janette's public key so that it can only be read by Janette, the --decrypt option is used:

After entering the passphrase, this will decrypt the encrypted file kathys-doc.gpg and output it to kathys-doc.

Signing and verifying files without encryption

Clear-signing a file is a method of assuring the receiver that the file has come from the sender, but without encrypting the file. It has the advantage that the receivers may read the file without having to decrypt it with their key or a passphrase, so any user who has access to the public key may read the file, as well as verifying its authenticity. This is useful when publishing from a webpage or other shared space, but is not suitable for sensitive material that should not be publicly accessible.

To sign the file janettes-doc, gpg is used with the --clearsign option:

This produces the file janettes-doc.asc,a clearsigned file in the following format:

The file contents appear between "Hash: SHA1" and "-----BEGIN PGP SIGNATURE-----" lines. To verify a signed file that has been received, the gpg --verify option is used:

GPG can be used with the --decrypt option on the signed document file to recover the original.

More information is available from the GPG homepage and the GPG manual.

How-Tos

Portecle

Securing and signing documents using GNU Privacy Guard (GnuPG) command-line tool GPG

KGPG

GPGee

GPA - The Gnu Privacy Assistant

Jacksum

Hasher 0.3

KeyTool and Jarsigner

Last updated 2 Jan. 2008.