Differences

This shows you the differences between two versions of the page.

--- tools:gpg [2007/12/22 13:31]
axelle created
+++ tools:gpg [2009/02/28 15:21] (current)
@@ Line 8: / Line 8: @@
 Encrypt, and convert output to ASCII (so it can be mailed): <code>gpg -e -a ...</code>
+Conventional encryption (makes file.pgp, asks for a password, uses the s2k mode to salt the passphrase) : gpg --s2k-mode 3 -c file
 ===== List =====
@@ Line 38: / Line 40: @@
 Export key to file: gpg -ao toto-public.key --export 0637B724
-Export private key: gpg -ao toto-private.key --export-secret-keys 0637B724
+Export private key (keep this file in a secure place !): gpg -ao toto-private.key --export-secret-keys 0637B724
-=> keep this file in a secure place !
-=> to protect it with a passphrase:
-gpg -a --export-secret-keys 0637B724 | gpg -aco my-private.key.gpg
-=> to protect it with conventional encryption:
-gpg -a --export-secret-keys 0637B724 | gpg -c my-private.key.gpg
+Protect the private key with a passphrase: gpg -a --export-secret-keys 0637B724 | gpg -aco my-private.key.gpg
+Protect the private key with "conventional" encryption: gpg -a --export-secret-keys 0637B724 | gpg -c my-private.key.gpg
 Export public key to armour file: gpg --armor --export email@email.com > mypk
@@ Line 63: / Line 58: @@
 Import private key: gpg --allow-secret-key-import --import {key}
-	=> importing an encrypted key: gpg --decrypt toto-private.key.gpg |gpg --import
+Importing an encrypted key: gpg --decrypt toto-private.key.gpg |gpg --import
+Import a key from a keyserver: gpg --keyserver wwwkeys.pgp.net --recv-keys <keyID>
 ====== Sign a key ======
+  - select the key ID you want to select (--list-keys)
+  - sign the key (--sign-key) or interactively (--edit-key + sign)
+  - optional: send the public part of the key to its owner, it contains your signature.
-- select the key ID you want to select (--list-keys)
+<code>
-- sign the key (--sign-key) or interactively (--edit-key + sign)
-- optional: send the public part of the key to its owner, it contains your signature.
 	gpg [--default-key xxxxx] --sign-key 0a69a19c
 		pub  1024D/0A69A19C  créée: 2004-05-27 expire: never      confiance: -/-
 		sub  1024g/8CF406CB  créée: 2004-05-27 expire: never
 		(1). XXX <XXX@YYY.fr>
 		pub  1024D/0A69A19C  créée: 2004-05-27 expire: never      confiance: -/-
  		Empreinte de la clé principale: F233 758B 65C0 A98E 99AC  2DB0 96E7 6731 0A69 A19C
-     		XXX <XXX@YYY.fr>
 		Avec quel soin avez-vous vérifié que la clé que vous allez signer
 		appartient réellement à la personne sus-nommée ? Si vous ne savez
 		quoi répondre, entrez "0".
    		(0) Je ne répondrai pas. (par défaut)
    		(1) Je n'ai pas vérifié du tout.
    		(2) J'ai un peu vérifié.
    		(3) J'ai vérifié très soigneusement.
 		Your selection? (enter '?' for more information): 2
 		Etes-vous vraiment sûr(e) que vous voulez signer cette clé
 		avec la vôtre: "Axelle Apvrille <XXX>" (CA739793)
 		J'ai un peu vérifié cette clé.
 		Signer réellement ? oui
 		Vous avez besoin d'un mot de passe pour déverrouiller la clé secrète pour
 		l'utilisateur: "Axelle Apvrille <XXX.XXX@fr>"
+		clé de 2048 bits RSA, ID CA739793, créée le ...
-		clé de 2048 bits RSA, ID CA739793, créée le 2004-02-02
 		Entrez le mot de passe: ****
+</code>
 ===== Add a photo =====
-	Interactive way:
+The interactive way:
-	gpg --edit-key xxxxx
+<code>
+gpg --edit-key xxxxx
-	Command> addphoto
+Command> addphoto
+</code>
-	choose a JPEG photo
+choose a JPEG photo
 ===== Modify passphrase =====
-	Interactive way:
+Interactive way:
-	gpg --edit-key myemail@com
+<code>
+gpg --edit-key myemail@com
+Command> passwd
+</code>
-	Command> passwd
-===== Conventional encryption =====
-	gpg --s2k-mode 3 -c file ==> makes file.gpg
-	asks a password
-	the s2k mode salts the passphrase
@@ Line 176: / Line 130: @@
 ====== Design ======
+See RFC 2440. OpenPGP buils a OpenPGP "Secret Key" Packet ("Private Key Packet" does not exist).
-Private key protection (RFC 2440)
-OpenPGP buils a OpenPGP "Secret Key" Packet ("Private Key Packet" does not exist).
 This packet contains:
-- all information included in the Public Key Packet
+  * all information included in the Public Key Packet
+  *  private key encryption method:
-- private key encryption method:
 | PLAINTEXT PRIVATE KEY
+	or Algo ID | IV | ENCRYPTED PRIVATE KEY (passphrase is MD5 hashed, the resulting key encrypts with AlgoID the private key.(CFB mode))
+	or 255 | Algo ID | S2K spec | IV | ENCRYPTED PRIVATE KEY (passphrase is converted into a key using S2K algorithm specified by S2K spec)
+	* Simple S2K = hash the passphrase	=> S2KSpec = 0x00 HashAlgo
+ 	* Salted S2K = hash salt + passphrase	=> S2KSpec = 0x01 HashAlgo 8-byte salt
+	* Iterated S2K = loop hash(salt + passph) => S2KSpec = 0x03 HashAlgo 8-byte salt 1-byte count
-	or Algo ID | IV | ENCRYPTED PRIVATE KEY
-		=> passphrase is MD5 hashed, the resulting key encrypts with AlgoID the private key.(CFB mode)
-	or 255 | Algo ID | S2K spec | IV | ENCRYPTED PRIVATE KEY
-		=> passphrase is converted into a key using S2K algorithm specified by S2K spec:
-			Simple S2K = hash the passphrase	=> S2KSpec = 0x00 HashAlgo
-			Salted S2K = hash salt + passphrase	=> S2KSpec = 0x01 HashAlgo 8-byte salt
-			Iterated S2K = loop hash(salt + passph) => S2KSpec = 0x03 HashAlgo 8-byte salt 1-byte count

Back to top

tools/gpg.1198326707.txt.gz · Last modified: 2007/12/22 13:31 by axelle

Index Recent changes