next up previous contents
Next: Key Management with GPG Up: I want to use Previous: Any other Linux distribution   Contents

Setting up GPG for the first time

Before you can begin to use GPG for encryption, you should create a key pair. This step will create a secret key and a public key. As we noted above, you must keep the secret key protected, and publish the public key as widely as possible.

The key generation process is fairly involved, but you only have to do it one time (unless you set an expiration date on your key). To begin the key generation process, type the command:

  gpg --gen-key

At this point, if you have never used GPG before, you will see something like this:

  gpg (GnuPG) 1.0.0; Copyright (C) 1999 Free Software Foundation, Inc.
  This program comes with ABSOLUTELY NO WARRANTY.
  This is free software, and you are welcome to redistribute it
  under certain conditions. See the file COPYING for details.

  gpg: /home/username/.gnupg: directory created
  gpg: /home/username/.gnupg/options: new options file created
  gpg: /home/username/.gnupg/secring.gpg: keyring created
  gpg: /home/username/.gnupg/pubring.gpg: keyring created
  Please select what kind of key you want:
     (1) DSA and ElGamal (default)
     (2) DSA (sign only)
     (4) ElGamal (sign and encrypt)
  Your selection? _

This first question is prompting you for the type of encryption you want to use. You don't need to understand the difference between DSA and ElGamal encryption at this point. Unless you have some special situation (for example, if you live in a country where it is not legal to use encryption), you should take the default.

If you took the default, the next question will look like this:

  DSA keypair will have 1024 bits.
  About to generate a new ELG-E keypair.
                minimum keysize is  768 bits
                default keysize is 1024 bits
      highest suggested keysize is 2048 bits
  What keysize do you want? (1024) _

This question is asking you how large you want your key to be. The larger your key is, the more secure it is - but the longer it will take for GPG to generate your keys, and to encrypt and decrypt messages. If you intend to use GPG for keeping important secrets (for example, corporate trade secrets, or military secrets), then you should use the largest key size. If your security needs are more modest, then the default value should be sufficient. We would not recommend using anything smaller than the default size, even with a slow computer.

After answering this question, you will see this:

  Requested keysize is 1024 bits
  Please specify how long the key should be valid.
           0 = key does not expire
        <n>  = key expires in n days
        <n>w = key expires in n weeks
        <n>m = key expires in n months
        <n>y = key expires in n years
  Key is valid for? (0) _

With GPG, you have the ability to set expiration dates on your key pair. This means that people are expected to stop using your public key after a certain period of time, presumably because you are going to make a larger (more secure) one as computers become faster. Unless you have special needs, the default value (your key will never expire) should be fine.

GPG will ask you to confirm your choice:

  Key does not expire at all
  Is this correct (y/n)? _

After this, GPG will ask you what name you want associated with your key. For most people, this will be their real name. Of course, if you wish to use an alias for some reason, you may do that instead.

  You need a User-ID to identify your key; the software constructs the user id
  from Real Name, Comment and Email Address in this form:
      "Heinrich Heine (Der Dichter) <>"

  Real name: _

You will be asked for your real name, and then your e-mail address, and finally an optional comment. (Here, responses are shown in boldface.)

Real name: John Q. Smith
Email address:

  You selected this USER-ID:
      "John Q. Smith <>"

  Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? _

If you have made a mistake here, you may correct it; otherwise, you should type O to go on to the next step:

  You need a Passphrase to protect your secret key.    

  Enter passphrase: _

Because the secret key must be protected at all times, GPG does not store it in a readable form. Instead, it encrypts the secret key, using your passphrase as the key. Every time you use GPG to decrypt a message that was sent to you, or to digitally sign a message that you send, you will have to type your passphrase.

After typing your passphrase twice (to confirm it), you will see something like this:

  We need to generate a lot of random bytes. It is a good idea to perform
  some other action (type on the keyboard, move the mouse, utilize the
  disks) during the prime generation; this gives the random number
  generator a better chance to gain enough entropy.

As the instructions say, GPG is using random numbers to create a secret key and a public key. The Linux kernel continually looks at your computer and, based on how you use it, collects various numbers which cannot be predicted. So, if this step is taking a considerable length of time (which will be the case with the larger key sizes), you should go do other tasks while it works. The more you do with your computer, the sooner the key generation will finish.

Finally, you should see something like this:

  public and secret key created and signed.

Now, the key generation is finished. If you wish, you can look around to see what GPG has done. (The rest of this section will contain simple exercises to help you learn how to use the software. If you already know how to use GPG, you can skip ahead.)

In your home directory, there should be a subdirectory called .gnupg. This contains all of the files that GPG uses, including your secret key and your public key(s):

$ ls -la  /.gnupg

  total 8
  drwx------   2 username   users        1024 Sep 28 11:00 .
  drwxr-xr-x   3 username   staff        1024 Sep 28 10:34 ..
  -rw-rw-r--   1 username   users        2823 Sep 28 10:34 options
  -rw-rw-r--   1 username   users         888 Sep 28 11:00 pubring.gpg
  -rw-rw-r--   1 username   users           0 Sep 28 10:34 pubring.gpg~
  -rw-------   1 username   users        1206 Sep 28 11:00 secring.gpg

The file pubring.gpg is your public key ring. Right now, this file only contains your public key; but later you will probably put other people's public keys in it, so that you can encrypt messages to them and verify their digital signatures. The file secring.gpg is your secret key ring. Normally this will contain only the secret key that you just created; but if for some reason you have more than one key pair, this file will contain all of your secret keys. The options file contains some default configuration settings which you might want to change later, when you're more familiar with the program.

There are also some basic commands you can use to learn more about how GPG works. For example, to show the contents of your public key ring, you can use this command:

  gpg --list-keys

This should show you something like this:

  pub  1024D/FFF5BD5A 1999-09-28 John Q. Smith <>
  sub  1024g/939A094A 1999-09-28

If you want to see your secret key ring, you can use the command:

  gpg --list-secret-keys

In our case, the secret key ring looks just like the public key ring. Later, this will not be the case.

Now you are ready to start signing and encrypting messages. It's helpful to practice this on your computer before you actually start using it with your e-mail messages. So, let's start by creating a simple message. Using your favorite text editor, go ahead and create a file called message. It can contain anything you want. For example,

$ cat message

  This is a secret message.
  I am using it to learn GPG.

Now, suppose you want to put your digital signature on this message. You can do that with this command:

$ gpg -clearsign message

  You need a passphrase to unlock the secret key for
  user: "John Q. Smith <>"
  1024-bit DSA key, ID FFF5BD5A, created 1999-09-28

  Enter passphrase: _

After doing this, you should have a file called message.asc, which is your message plus your digital signature. It looks something like this:

  Hash: SHA1

  This is a secret message.
  I am using it to learn GPG.
  Version: GnuPG v1.0.0 (GNU/Linux)
  Comment: For info see


You may notice that it says "PGP SIGNED" and not "GPG SIGNED". This is so that PGP and GPG can both read the same messages and digital signatures.

As you can see, your message is still there, clearly readable. You haven't encrypted it yet - you've only signed it. Now, you can verify your digital signature to make sure it worked:

$ gpg -verify message.asc

  gpg: Signature made Tue Sep 28 11:38:33 1999 EDT using DSA key ID FFF5BD5A
  gpg: Good signature from "John Q. Smith <>"
  gpg: /home/username/.gnupg/trustdb.gpg: trustdb created

If you want to see how digital signatures protect you, go ahead and change the file message.asc with a text editor. You can change either the message at the top, or the signature at the bottom. In either case, when you try to verify the signature, you'll see that it is not valid any more:

$ gpg -verify message.asc

  gpg: Signature made Tue Sep 28 11:38:33 1999 EDT using DSA key ID FFF5BD5A
  gpg: BAD signature from "John Q. Smith <>"

As you can see now, the digital signature depends on the message which is being signed, and on the secret key used to sign it. You can't just copy a digital signature from one message and put it on a different message - it won't be valid any more. This is what makes digital signatures so powerful and useful.

Now, you can practice encrypting and decrypting a message. We'll use the same message file that we used when we were practicing digital signatures. To encrypt a message, use the command:

$ gpg -encrypt -a message
You did not specify a user ID. (you may use "-r")

Enter the user ID: smith
File `message.asc' exists. Overwrite (y/N)? y

The -a option makes an output file which contains only printable characters. This is called ''ASCII armored''. This is useful, because this type of file can be sent in an e-mail message. Later, when you use GPG with your mail program, your mail program will automatically use the -a option.

As before, this command created a file called message.asc. But now, if we look at this file, we see something like this:

  Version: GnuPG v1.0.0 (GNU/Linux)
  Comment: For info see

  -----END PGP MESSAGE-----

As you can see, the original message is no longer readable. It has been encrypted into this message, which looks random but isn't. The only way to read the message is to decrypt it, which requires the correct secret key.

There are two other things you may have noticed above. First, when we were encrypting the message, we had to specify a user ID. This is so that GPG knows which public key to use for encrypting the message. Right now, you only have one public key - your own. But later, you will probably have several public keys, and you will not normally encrypt messages to yourself (although you can, if you wish). So GPG has to be told which user(s) should be able to read the message.

Second, you were not prompted for your passphrase. This is because the process of encryption only uses public keys, not your secret key. However, you will need your secret key (and therefore your passphrase) to decrypt the message:

$ gpg -decrypt message.asc

  You need a passphrase to unlock the secret key for
  user: "John Q. Smith <>"
  1024-bit ELG-E key, ID 939A094A, created 1999-09-28 (main key ID FFF5BD5A)

  Enter passphrase: _

After typing your passphrase, you will see the message:

$ gpg -decrypt message.asc

  You need a passphrase to unlock the secret key for
  user: "John Q. Smith <>"
  1024-bit ELG-E key, ID 939A094A, created 1999-09-28 (main key ID FFF5BD5A)

  This is a secret message.
  I am using it to learn GPG.

If you have lost your secret key, or if you have forgotten your passphrase, you will not be able to read the message. If you type the wrong passphrase three times in a row, for example, you will see something like this:

  gpg: encrypted with 1024-bit ELG-E key, ID 939A094A, created 1999-09-28
        "John Q. Smith <>"
  gpg: public key decryption failed: bad passphrase
  gpg: decryption failed: secret key not available

next up previous contents
Next: Key Management with GPG Up: I want to use Previous: Any other Linux distribution   Contents
Greg Wooledge 2000-10-11