Linux: gpg

Simetric Cipher

Encryption

gpg -c file.txt

we will be prompt for a password.
Or:

gpg -ca file.txt

If we want an ascii output

Encrypt & Sign

gpg --encrypt --sign --recipient 'some user ID value' <file>

Decryption

gpg -d file.txt
gpg --output <file> --decrypt <encrypted-and-signed-file>
find . -type f -name '*.gpg' -exec sh -c 'for file do gpg "$file"; done' sh {} +

we will be prompt for a password.

Asimetric Cipher

Private Key

Generate keys

gpg --full-generate-key
gpg --default-new-key-algo rsa4096 --gen-key
gpg --gen-key

Import secret keys

 gpg --allow-secret-key-import --import tmp.asc

List private keys

gpg --list-secret-keys

Export private key

gpg --export-secret-key -a "User Name" > private.key

Change private key passphrase

user@machine:~$ gpg --list-secret-keys
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
/home/user/.gnupg/pubring.kbx
-----------------------------

sec   rsa1024 2019-11-19 [SC]
      9D8D8CBC5B2A8A641C8CA0F58167B416B55E2859
uid           [ultimate] RRA Example (No comments) <rra@rra.lan>
ssb   rsa1024 2019-11-19 [E]

user@machine:~$ gpg --edit-key 9D8D8CBC5B2A8A641C8CA0F58167B416B55E2859
gpg (GnuPG) 2.2.17; Copyright (C) 2019 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

sec  rsa1024/8167B416B55E2859
     created: 2019-11-19  expires: never       usage: SC  
     trust: ultimate      validity: ultimate
ssb  rsa1024/85BB533A53DAA163
     created: 2019-11-19  expires: never       usage: E   
[ultimate] (1). RRA Example (No comments) <rra@rra.lan>

gpg> passwd

Public Keys

Export public key

To file

gpg --output <destination_file.gpg> --export <public_key_ID>

To server

gpg --send-keys --keyserver pgp.mit.edu 18384645

To ascii file

gpg --armor --export you@example.com > mykey.asc

Import public keys

From file

gpg --import <publickeyfile.gpg>

From server

gpg --keyserver pgp.mit.edu --recv-keys 18384645

Encrypt with a public key

List public keys

gpg --list-keys

Encrypt one recipient

gpg --recipient <key ID> --encrypt <file>

Encrypt with ascii output

gpg --armor --encrypt --output ~/test.crypt --recipient redteam@bbva.com  ~/test.txt

Encrypt to multiple recipients

gpg --recipient 42FF42FF \
          --recipient 12345678 \
          --recipient FEFEFEFE \
          --encrypt-files backup.tar

Decrypt with private key

comando gpg -d <encrypted_file>

Signing Keys

Sign keys

Signing

Sign

gpg -u <private_Key_ID> --output <output_signed_file> --sign <file_to_sign>
gpg --local-user <private_Key_ID> --output <output_signed_file> --sign <file_to_sign>

Verify signature

gpg -d <signed_file>

or

gpg --verify <signed_file>

CheatSheet

Gpg_cheat_sheet.tar.gz
https://www.digitalocean.com/community/tutorials/how-to-use-gpg-to-encrypt-and-sign-messages
http://www.g-loaded.eu/2010/11/01/change-expiration-date-gpg-key/