Encrypting Documents with gpg at the Command Line 189

delete an item, right-click the item and choose Delete. If you do drag things into the trash, don’t forget to take out the garbage by rightclicking the can and choosing Empty Trash Bin!

kgpg is well integrated with the Konqueror browser. Click an encrypted file, and it decrypts. Right-click a document and choose Encrypt File from the menu to encrypt a file.

Encrypting Documents with gpg at the Command Line

Encrypting documents with gpg is an easy and quick way to keep information out of the hands of people who shouldn’t have it. If you’re using SSH or working on a system without a desktop environment, you can use gpg encryption from the command line to keep your private files private.

Sharing a secret file

To encrypt a private document for your friend’s eyes only, you need his public key. When you’ve received his public key (by e-mail or on disk), save it to a directory. To import a public key into your key ring, open your terminal window, move to the directory containing the public key, and use the following command:

$ gpg --import keyname.gpg

Now you can encrypt your file with your friend’s key by using the following command:

$gpg --encrypt --armor -r keyname filename

Share the file as you normally would — you can send it by e-mail or hand your friend a CD. Unless someone has your friend’s private key, that person won’t be able to read the document.

To open the file, your friend uses his private key with the following command:

Creating a key pair and receiving encrypted documents

To receive encrypted documents, your friend needs your public key. Follow these steps to generate a public/private key pair with gpg at the command line:

1. Open a terminal window and enter the following command:

$ gpg --gen-key

A slightly awkward, but functional menu opens, prompting you to select the kind of key you want.

2. Type 1 and press Enter.

You’re prompted to enter the key size.

3. Type 1024 and press Enter.

gpg asks for an expiration date.

4. Type 0 to create a nonexpiring key and press

Enter.

gpg notifies you that the key does not expire and asks you to verify that you want to generate a permanent key.

5. Type y and press Enter.

6. gpg asks for your real name. Type it in and press Enter.

This is used to identify your key in your friend’s key ring.

7. When gpg prompts you for a comment, type one in if you wish.

The comment is optional. Remember, if you enter one, the public will see it.

8. gpg prompts you for your e-mail address. Type your e-mail address and press Enter.

gpg displays your name, comment, and e-mail address.

9. Verify that the information is correct (or select the appropriate item to change). When the information is correct, enter O (the letter, not the number) to verify that the information is okay and then press Enter.

$ gpg --decrypt filename

190 Technique 28: Using Encryption for Extra Security

You’re prompted for a passphrase.

10. Type a passphrase and press Enter.

You’re asked to repeat the passphrase.

11. Type the passphrase again and press Enter.

That’s all there is to it — you’ve created a key.

To exchange your key with others so that you can send and receive encrypted files, you need to do a little more upfront work:

1. Write your public key to a file by using the following command:

$gpg --armor --export e-mailaddress > filename

The --armor option tells gpg to write your public key in an e-mail–friendly form by using only printable characters.

2. Send the key file to your friends or post it on your Web site.

3. Your friends need to import your public key with the key file (using the gpg --import command as described at the beginning of this section) before they can decrypt your messages.

Now people can send you encrypted files that only you can read with your private key.

If you need to encrypt or decrypt messages on a Windows computer, check out “A Practical Introduction to GPG in Windows” at www.gnupg.org/(en)/ documentation/guides.html.

Encrypting documents on your home system

You can use the same key pair that you created to exchange with others (see the preceding section) to encrypt documents for your own use. Encrypt the document and delete the unencrypted version, and only those users that know your passphrase can decrypt and read the document.

Follow these steps to encrypt a document:

1. Open your terminal window and move into the directory containing the file to be encrypted.

2. Enter the following command:

$gpg --encrypt --armor -r keyname filename

Substitute the real name you used to create the key pair for keyname and the name of the file you want to encrypt into filename.

You’re prompted for the passphrase you entered when you created your key pair.

3. Enter the passphrase and press Enter.

The new, encrypted file appears in your directory as filename.asc.

You can now delete the unencrypted document with this command:

$ rm filename

When you need to use your document again, follow these steps:

To open a message encrypted with your public key, use the following command:

$ gpg --decrypt filename

gpg is a powerful encryption program, but it’s not completely foolproof. We’ve only scratched the surface here. Good key management makes a big difference in how well gpg can protect your private bits. Many encryption options and security features are available with gpg. For more information about encrypting with gpg, visit www.gnupg.org.

1. Open your terminal window and move to the directory containing the encrypted file.

2. Enter the following command:

$ gpg --decrypt filename.asc > newfile

You’re prompted to enter your passphrase.

3. Enter your passphrase and press Enter.

The file is decrypted and written to the filename specified in the command as newfile.