.docname {GnuPG}
.include {docs}

Make sure the package `gnupg` is installed

## Configuration

GPG configuration is stored in `~/.gnupg`. Default configuration file is `~/.gnupg/gpg.conf`.

Enable the gpg agent by adding `~/.gnupg/gpg-agent.conf` with content

```txt
default-cache-ttl 3600
pinentry-program
```

Select the GPG Keyserver by adding `~/.gnupg/gpg-dirmngr.conf` with content
```txt
keyserver hkps://keys.openpgp.org
```

## List Keys

List known public keys with `gpg --list-keys` .br
List known private keys with `gpg --list-secret-keys`

## Backup Keys

Export your secret key with `gpg --export-secret-keys --armor --output <private-key.asc> <user id>`

If you need to export a subkey only, list subkeys first with `gpg --list-secret-keys --with-subkey-fingerprint`,
then export the subkey with `gpg --armor --export-secret-subkeys --output <subkey.asc> <subkey-id>!`.

The revocation certificate can be backed up with `gpg --gen-revoke --armor --output <revcert.asc> <user id>`

## Import a Backed Up Key

Import your key with `gpg --import <private-key.asc>`

## Modify Trust

Edit the key with `gpg --edit-key <user-id>` and choose `trust`.

## Edit Expiry Date

Never delete an expired key, edit the expiry date with `gpg --edit-key <user-id>` and choose `expiry`.

## Create a New Key

Run `gpg --full-generate-key --expert` to create the primary key. Choose

- Key Type: `ECC (set your own capabilities)`
- This key should only have the `Certify` capability

Now edit the key to add subkeys `gpg --export --edit-key <user-id>`

- Encryption Subkey: `addkey` choose `ECC (encrypt only)`
- Signing Subkey: `addkey` choose `ECC (sign only)`
- Authentication Subkey: `addkey` choose `ECC (set your own capabilities)`.
  Only the Authenticate capability should be enabled
- `save` to save the changes