A Guide to GPG Keys: Managing, Importing, and Verifying

Sep 6, 2023 · GPG, Linux

What is GPG?

GPG, or GNU Privacy Guard, is a powerful open-source encryption software that provides cryptographic privacy and authentication for data communication. GPG keys play a central role in GPG’s functionality, enabling secure communication and verification of data integrity. In this guide, we’ll explore GPG keys and how to manage, import, delete, list, and verify them.

What Are GPG Keys?

At its core, GPG uses a pair of keys to secure your data: the public key and the private key. These keys are mathematically related but serve different purposes:

Public Key: This key is used to encrypt data and verify digital signatures. It can be shared openly with others.
Private Key: This key is used to decrypt data and create digital signatures. It must be kept secret and should never be shared.

Importing GPG Keys

Importing GPG keys is essential for establishing trust with other users and organizations. It allows you to verify data they’ve signed and encrypt data specifically for them. To import a GPG key, you can use the gpg --import command:

gpg --import mykey.asc

This command imports a GPG key from the mykey.asc file into your keyring.

Listing GPG Keys

Managing keys efficiently involves keeping track of them. To list your GPG keys, use the gpg --list-keys and gpg --list-secret-keys commands:

gpg --list-keys

This command displays a list of your public keys:

pub   rsa2048/0xDEADBEEF 2018-01-01
uid                  John Doe <john@example.com>
sub   rsa2048/0xC0FFEE01 2018-01-01

The output shows the key ID, key type (RSA), creation date, user ID, and any subkeys.

gpg --list-secret-keys

This command lists your secret (private) keys.

Deleting GPG Keys

If you need to remove a GPG key from your keyring, use the gpg --delete-key command followed by the key’s ID:

gpg --delete-key DEADBEEF

Replace DEADBEEF with the actual key ID.

Verifying Signatures with GPG

GPG allows you to verify the authenticity and integrity of files and messages by checking their digital signatures. To verify a signature, use the gpg --verify command:

gpg --verify file.tar.gz.sig

This command verifies the signature on the file.tar.gz archive using the associated .sig file.

Receiving Keys from a Key Server

When you need someone’s public key for secure communication, you can retrieve it from a key server using gpg --recv-key:

gpg --recv-key DEADBEEF

Replace DEADBEEF with the key ID of the key you want to retrieve. GPG will fetch the key from a key server and add it to your keyring.

Conclusion

GPG keys are the foundation for secure communication and data authentication. In this lesson, you will learn how to manage, import, list, delete, and validate.