You may find GPG useful for encrypting your own files, even when you never plan to share them with anyone else. For this, you'll use symmetric encryption, which involves using your own private key for encryption. Before you try this, you'll need to generate your keys, as I outlined in the previous section.
Let's encrypt a super-secret file that we just can't allow to fall into the wrong hands:
[donnie@localhost ~]$ gpg -c secret_squirrel_stuff.txt
[donnie@localhost ~]$
Note that the -c option indicates that I chose to use symmetric encryption with a passphrase for the file. The passphrase that you enter will be for the file, not for your private key.
One slight flaw with this is that GPG makes an encrypted copy of the file, but it also leaves the original, unencrypted file intact:
[donnie@localhost ~]$ ls -l
total 1748
-rw-rw-r--. 1 donnie donnie 37 Oct 26 14:22 secret_squirrel_stuff.txt
-rw-rw-r--. 1 donnie donnie 94 Oct 26 14:22 secret_squirrel_stuff.txt.gpg
[donnie@localhost ~]$
Let's get rid of that unencrypted file with shred. We'll use the -u option to delete the file, and the -z option to overwrite the deleted file with zeros:
[donnie@localhost ~]$ shred -u -z secret_squirrel_stuff.txt
[donnie@localhost ~]$
It doesn't look like anything happened, because shred doesn't give you any output. But, an ls -l will prove that the file is gone. Now, if I were to look at the encrypted file with less secret_squirrel_stuff.txt.gpg, I would be able to see its contents, after being asked to enter my private key passphrase:
Shhh!!!! This file is super-secret.
secret_squirrel_stuff.txt.gpg (END)
As long as my private key remains loaded into my keyring, I'll be able to view my encrypted file again without having to reenter the passphrase. Now, just to prove to you that the file really is encrypted, I'll create a shared directory, and move the file there for others to access:
sudo mkdir /shared
sudo chown donnie: /shared
sudo chmod 755 /shared
mv secret_squirrel_stuff.txt.gpg /shared
When I go into that directory to view the file with less, I can still see its contents, without having to reenter my passphrase. But now, let's see what happens when Maggie tries to view the file:
[maggie@localhost shared]$ less secret_squirrel_stuff.txt.gpg
"secret_squirrel_stuff.txt.gpg" may be a binary file. See it anyway?
And when she hits the Y key to see it anyway:
<8C>^M^D^C^C^B<BD>2=<D3>͈u<93><CE><C9>MОOy<B6>^O<A2><AD>}Rg9<94><EB><C4>^W^E<A6><8D><B9><B8><D3>(<98><C4>æF^_8Q2b<B8>C<B5><DB>^]<F1><CD>#<90>H<EB><90><C5>^S%X [<E9><EF><C7>
^@y+<FC><F2><BA><U+058C>H'+<D4>v<84>Y<98>G<D7>֊
secret_squirrel_stuff.txt.gpg (END)
Poor Maggie really wants to see my file, but all she can see is encrypted gibberish.
What I've just demonstrated is another advantage of GPG. After entering your private key passphrase once, you can view any of your encrypted files without having to manually decrypt them, and without having to reenter your passphrase. With other symmetric file encryption tools, such as Bcrypt, you wouldn't be able to view your files without manually decrypting them first.
But, let's now say that you no longer need to have this file encrypted, and you want to decrypt it in order to let other people see it. Just use gpg with the -d option:
[donnie@localhost shared]$ gpg -d secret_squirrel_stuff.txt.gpg
gpg: CAST5 encrypted data
gpg: encrypted with 1 passphrase
Shhh!!!! This file is super-secret.
gpg: WARNING: message was not integrity protected
[donnie@localhost shared]$
The WARNING message about the message not being integrity protected means that I had encrypted the file, but I never signed the file. Without a digital signature, someone could alter the file without me knowing about it, and I wouldn't be able to prove that I am the originator of the file. (Have no fear, we'll talk about signing files in just a bit.)