Frank Zechert
62 lines
1.8 KiB
Plaintext
62 lines
1.8 KiB
Plaintext
.docname {GnuPG}
|
|
.include {docs}
|
|
|
|
Make sure the package `gnupg` is installed
|
|
|
|
## Configuration
|
|
|
|
GPG configuration is stored in `~/.gnupg`. Default configuration file is `~/.gnupg/gpg.conf`.
|
|
|
|
Enable the gpg agent by adding `~/.gnupg/gpg-agent.conf` with content
|
|
|
|
```txt
|
|
default-cache-ttl 3600
|
|
pinentry-program
|
|
```
|
|
|
|
Select the GPG Keyserver by adding `~/.gnupg/gpg-dirmngr.conf` with content
|
|
```txt
|
|
keyserver hkps://keys.openpgp.org
|
|
```
|
|
|
|
## List Keys
|
|
|
|
List known public keys with `gpg --list-keys` .br
|
|
List known private keys with `gpg --list-secret-keys`
|
|
|
|
## Backup Keys
|
|
|
|
Export your secret key with `gpg --export-secret-keys --armor --output <private-key.asc> <user id>`
|
|
|
|
If you need to export a subkey only, list subkeys first with `gpg --list-secret-keys --with-subkey-fingerprint`,
|
|
then export the subkey with `gpg --armor --export-secret-subkeys --output <subkey.asc> <subkey-id>!`.
|
|
|
|
The revocation certificate can be backed up with `gpg --gen-revoke --armor --output <revcert.asc> <user id>`
|
|
|
|
## Import a Backed Up Key
|
|
|
|
Import your key with `gpg --import <private-key.asc>`
|
|
|
|
## Modify Trust
|
|
|
|
Edit the key with `gpg --edit-key <user-id>` and choose `trust`.
|
|
|
|
## Edit Expiry Date
|
|
|
|
Never delete an expired key, edit the expiry date with `gpg --edit-key <user-id>` and choose `expiry`.
|
|
|
|
## Create a New Key
|
|
|
|
Run `gpg --full-generate-key --expert` to create the primary key. Choose
|
|
|
|
- Key Type: `ECC (set your own capabilities)`
|
|
- This key should only have the `Certify` capability
|
|
|
|
Now edit the key to add subkeys `gpg --export --edit-key <user-id>`
|
|
|
|
- Encryption Subkey: `addkey` choose `ECC (encrypt only)`
|
|
- Signing Subkey: `addkey` choose `ECC (sign only)`
|
|
- Authentication Subkey: `addkey` choose `ECC (set your own capabilities)`.
|
|
Only the Authenticate capability should be enabled
|
|
- `save` to save the changes
|