In this lab, you'll learn about how to encrypt and share a file with GPG public key encryption:
- To begin, create a user account for Frank, as you did for Maggie in the previous lab.
- Create a key set for both yourself and for Frank, as I've already shown you. Next, extract your own public keys into an ASCII text file. Log in as Frank, and extract his public key:
cd .gnupg
gpg --export -a -o donnie_public-key.txt
Log in as Frank, and repeat this command for him.
- Normally, the participants in this would send their keys to each other either through an email attachment or by placing the keys in a shared directory. In this case, you and Frank will receive each other's public key files and place them into your respective .gnupg directories. Once that's done, import each other's keys:
donnie@ubuntu:~/.gnupg$ gpg --import frank_public-key.txt
gpg: key 4CFC6990: public key "Frank Siamese (I am a cat.) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
donnie@ubuntu:~/.gnupg$
frank@ubuntu:~/.gnupg$ gpg --import donnie_public-key.txt
gpg: key 9FD7014B: public key "Donald A. Tevault <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
frank@ubuntu:~/.gnupg$
- Now for the good stuff. Create a super-secret message for Frank, asymmetrically encrypt it (-e), and sign it (-s). Signing the message is the verification that the message really is from you, rather than from an impostor:
donnie@ubuntu:~$ gpg -s -e secret_stuff_for_frank.txt
. . .
. . .
It is NOT certain that the key belongs to the person named
in the user ID. If you *really* know what you are doing,
you may answer the next question with yes.
Use this key anyway? (y/N) y
Current recipients:
2048R/CD8104F7 2017-10-27 "Frank Siamese (I am a cat.) <[email protected]>"
Enter the user ID. End with an empty line:
donnie@ubuntu:~$
So, the first thing you have to do is to enter the passphrase for your private key. Where it says to enter the user ID, enter frank, since he's the intended recipient of your message. But look at the line after that, where it says There is no assurance this key belongs to the named user. That's because you still haven't trusted Frank's public key. We'll get to that in a bit. The last line of the output again says to enter a user ID so that we can designate multiple recipients. But Frank is the only one you care about right now, so just hit the Enter key to break out of the routine. This results in a .gpg version of your message to Frank:
donnie@ubuntu:~$ ls -l
total 8
. . .
-rw-rw-r-- 1 donnie donnie 143 Oct 27 18:37 secret_stuff_for_frank.txt
-rw-rw-r-- 1 donnie donnie 790 Oct 27 18:39 secret_stuff_for_frank.txt.gpg
donnie@ubuntu:~$
- The final step on your end is to send Frank his encrypted message file by whatever means available.
- When Frank receives his message, he'll use the -d option to view it:
frank@ubuntu:~$ gpg -d secret_stuff_for_frank.txt.gpg
. . .
. . .
gpg: gpg-agent is not available in this session
gpg: encrypted with 2048-bit RSA key, ID CD8104F7, created 2017-10-27
"Frank Siamese (I am a cat.) <[email protected]>"
This is TOP SECRET stuff that only Frank can see!!!!!
If anyone else see it, it's the end of the world as we know it.
(With apologies to REM.)
gpg: Signature made Fri 27 Oct 2017 06:39:15 PM EDT using RSA key ID 9FD7014B
gpg: Good signature from "Donald A. Tevault <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: DB0B 31B8 876D 9B2C 7F12 9FC3 886F 3357 9FD7 014B
frank@ubuntu:~$
- Frank enters the passphrase for his private key, and he sees the message. At the bottom, he sees the warning about how your public key isn't trusted, and that There is no indication that the signature belongs to the owner. Let's say that you and Frank know each other personally, and he knows for a fact that the public key really is yours. He then adds your public key to the trusted list:
frank@ubuntu:~$ cd .gnupg
frank@ubuntu:~/.gnupg$ gpg --edit-key donnie
gpg (GnuPG) 1.4.20; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 2 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 2u
pub 2048R/9FD7014B created: 2017-10-27 expires: never usage: SC
trust: ultimate validity: ultimate
sub 2048R/9625E7E9 created: 2017-10-27 expires: never usage: E
[ultimate] (1). Donald A. Tevault <[email protected]>
gpg>
- The last line of this output is the command prompt for the gpg shell. Frank is concerned with trust, so he'll enter the trust command:
gpg> trust
pub 2048R/9FD7014B created: 2017-10-27 expires: never usage: SC
trust: unknown validity: unknown
sub 2048R/9625E7E9 created: 2017-10-27 expires: never usage: E
[ unknown] (1). Donald A. Tevault <[email protected]>
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu
Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y
- Frank has known you for quite a while, and he knows for a fact that you're the one who sent the key. So, he chooses option 5 for ultimate trust. Once Frank logs out and logs back in, that trust will take effect:
frank@ubuntu:~$ gpg -d secret_stuff_for_frank.txt.gpg
You need a passphrase to unlock the secret key for
user: "Frank Siamese (I am a cat.) <[email protected]>"
2048-bit RSA key, ID CD8104F7, created 2017-10-27 (main key ID 4CFC6990)
gpg: gpg-agent is not available in this session
gpg: encrypted with 2048-bit RSA key, ID CD8104F7, created 2017-10-27
"Frank Siamese (I am a cat.) <[email protected]>"
This is TOP SECRET stuff that only Frank can see!!!!!
If anyone else see it, it's the end of the world as we know it.
(With apologies to REM.)
gpg: Signature made Fri 27 Oct 2017 06:39:15 PM EDT using RSA key ID 9FD7014B
gpg: Good signature from "Donald A. Tevault <[email protected]>"
frank@ubuntu:~$
- With no more warning messages, this looks much better. At your end, do the same thing with Frank's public key.
As you can see in the screen output in step 8, you can assign the marginal, full, or ultimate trust level to someone else's public key. Space doesn't permit me to provide a full explanation of the trust levels, but you can read a rather colorful explanation here: PGP Web of Trust: Core Concepts Behind Trusted Communication — https://www.linux.com/tutorials/pgp-web-trust-core-concepts-behind-trusted-communication/.
What's so very cool about this is that even though the whole world may have your public key, it's useless to anyone who isn't a designated recipient of your message.
On an Ubuntu machine, to get rid of the gpg-agent is not available in this session messages and to be able to cache your passphrase in the keyring, install the gnupg-agent package:
sudo apt install gnupg-agent
Now that we've done that, let's look at how to sign a file without encrypting it.