Sharing Important Secrets over Internet: Why You Need to Learn About GPG Keys Now!

Introduction

I'm sure that if you're seeing this for the first time, you might be thinking, "What is this all about? What do I do with it?" I felt the same way when I first encountered it.

What is GPG?

GPG stands for GNU Privacy Guard, an implementation of public key cryptography, which can be used both for the more standard operations of encryption keys (encrypt/decrypt), and for message verification via signature.

Let's start from absolute basics like what is the public and private key.

A public key and a private key are cryptographic tools used in various security systems, such as encryption and digital signatures. They are part of a system called public key cryptography (or asymmetric cryptography), where a pair of keys are generated, one public and one private. Here's how they work:

1. Public Key:

• The public key is available to anyone. It can be shared openly without compromising security. • It is primarily used for encrypting data or verifying digital signatures. • When someone encrypts a message with a public key, only the corresponding private key can decrypt it.

2. Private Key:

• The private key is kept secret by the owner. It should never be shared. • It is used to decrypt data encrypted with the corresponding public key or to sign messages/data. • When a message is signed with a private key, anyone with the public key can verify that the message came from the holder of the private key.

Example in Use:

• Encryption: If Alice wants to send a secure message to Bob, she encrypts it with Bob's public key. Only Bob, with his private key, can decrypt the message. • Digital Signatures: If Bob wants to prove that a message is from him, he can sign the message using his private key. Alice can then verify the signature using Bob's public key.

Key Features:

• Asymmetry: Public and private keys are mathematically related but cannot be derived from each other. • Security: The system is secure because even though the public key is available to everyone, only the private key can decrypt or sign messages.

These keys are fundamental to various security protocols such as HTTPS, SSL/TLS, SSH, and cryptocurrencies like Bitcoin.

Now let's see the real magic how it works.

Illustration of Encryption and Decryption

For example, in the image above, you can see two individuals named Alice and Bob, who are quite famous, right? Let's say Bob wants to send a secret message to Alice — perhaps some credentials like AWS secrets or a GitHub login ID. However, it's unlikely that Bob would encrypt a simple message like "Hello, Alice" unless he feels there's a risk involved in communicating with her.

So, getting to the point: Bob will first ask Alice to share her public key. Then, he will use that key to encrypt his message and send the encrypted version to Alice. Since the message is encrypted with Alice's public key, she can use her private key to decrypt it and access the original message.

Signature Verification

It can also be used for signature verification, which is useful when you want to confirm the source of a message. For instance, if Bob wants to ensure that a message actually came from Alice and not from her father, he can verify it using Alice's public key. Since her public key is meant to be shared openly, Alice can share it with anyone.

If you're eager to see some real action, let's dive in!

Installing GPG on Various Operating Systems

1. Linux

In most Linux distributions, gpg2 comes pre-installed by default. If you happen to find that it's missing, no worries, you can grab it easily from your distro's official package repository. A simple package manager command should do the trick. If, by chance, it's not available, you can always install it manually by following these steps:

Download GPG: Head over to the GPG Download Page and grab either the GnuPG (LTS) or GnuPG file.

Extract the Files:

$ tar jxf <gnupg_tar.bz2>

Navigate to the Directory:

$ cd <gnupg_tar_dir>

Configure the Installation:

$ ./configure

Build the Package:

$ make

Install GPG:

$ sudo make install

That's it! You've got GPG up and running on Linux.

2. Windows

For Windows users, installing GPG is straightforward. Here's what you need to do:

1. Download the Installer: Go to the GPG Download Page and get the Windows installer.
2. Run the Installer: Follow the steps in the installation wizard.
3. Add GPG to Your PATH: This will let you run gpg from the Command Prompt (CMD).

Alternatively, if you prefer an easier approach, use Chocolatey:

choco install gnupg

That's it for Windows. Now you can start using GPG from the terminal!

3. Mac OS

If you're on Mac OS, the simplest way to install GPG is by using Homebrew. Just run:

brew install gnupg

Homebrew handles the installation for you.

Creation of GPG Key

You can simply open your terminal and type:

gpg --full-gen-key

When you run the command gpg --full-gen-key, it walks you through a series of prompts to generate a new GPG key pair (public and private keys). Here's a breakdown of what the output and the process typically look like:

tip

Note: Remember to put the email you can remember you can put anything but it's important you should remember that later.

$ gpg --full-gen-key
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072) 4096
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 2y
Key expires at Thu 24 Sep 2026.
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: John Doe
Email address: [email protected]
Comment: 
You selected this USER-ID:
    "John Doe <[email protected]>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

You can do this to list your keys. To list public keys present in your computer, use --list-keys or --list-public-keys:

$ gpg --list-public-keys

You might be wondering, "Sudip, I've got a good grasp of what GPG is, but how can I encrypt something now?"

Encryption with GPG

To encrypt a file using GPG, you'll need the recipient's public key. You can simply ask them to provide it to you.

If you want to export your own GPG public key, you can do so easily by running the following command, you can ask the recipient to do the same.

gpg --export --armor [email protected] > gpg.pub

Then you will have a gpg.pub file and you can share it with anyone, specifically you can share it with the sender to perform encryption you can use following steps.

To encrypt a .env file using a public key stored in pub.txt, you can follow these steps:

tip

Note: .env is nothing but simply a file with some important passwords and things like that we would not like to share over internet. you can use any files too.

Step 1: Import the Public Key

First, you need to import the public key from gpg.pub into your GPG keyring. Open your terminal and run:

gpg --import gpg.pub

Step 2: Encrypt the .env File

After importing the public key, you can encrypt your .env file using the public key. Use the following command:

gpg --encrypt --recipient "[Recipient Name or Email]" .env

Replace [Recipient Name or Email] with the name or email address associated with the public key you imported.

This will create an encrypted file named .env.gpg.

Step 3: Verify the Encrypted File

You can verify that the file has been encrypted by listing the contents of the current directory:

ls -l

You should see a file named .env.gpg alongside your original .env file.

Step 4: Send the Encrypted File

You can now safely send the .env.gpg file to the recipient, who can decrypt it using their private key.

Step 5: Decrypting the File (for the Recipient)

The recipient can decrypt the file using the following command:

gpg --decrypt .env.gpg > .env

This will decrypt the contents of .env.gpg and save it to a file named .env.

Conclusion

GPG is a powerful tool for securing communications and files. By understanding how public and private keys work together, you can safely share sensitive information over the internet. Whether you're a developer sharing credentials, a journalist protecting sources, or just someone who values privacy, GPG is an essential tool to have in your security toolkit.

The beauty of GPG lies in its simplicity once you understand the basics. Start with simple file encryption and gradually explore more advanced features like digital signatures and key management. Remember, security is not a destination but a journey, and GPG is an excellent companion for that journey.