Linux: gpg
GnuPG
Simetric Cipher
Encryption
gpg -c file.txt
we will be prompt for a password.
Or:
gpg -ca file.txt
If we want an ascii output
Encrypt & Sign
gpg --encrypt --sign --recipient 'some user ID value' <file>
Decryption
gpg -d file.txt
gpg --output <file> --decrypt <encrypted-and-signed-file>
find . -type f -name '*.gpg' -exec sh -c 'for file do gpg "$file"; done' sh {} +
we will be prompt for a password.
Asimetric Cipher
Private Key
Generate keys
gpg --full-generate-key
gpg --default-new-key-algo rsa4096 --gen-key
gpg --gen-key
Import secret keys
gpg --allow-secret-key-import --import tmp.asc
List private keys
gpg --list-secret-keys
Export private key
gpg --export-secret-key -a "User Name" > private.key
Change private key passphrase
user@machine:~$ gpg --list-secret-keys
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 2u
/home/user/.gnupg/pubring.kbx
-----------------------------
sec rsa1024 2019-11-19 [SC]
9D8D8CBC5B2A8A641C8CA0F58167B416B55E2859
uid [ultimate] RRA Example (No comments) <rra@rra.lan>
ssb rsa1024 2019-11-19 [E]
user@machine:~$ gpg --edit-key 9D8D8CBC5B2A8A641C8CA0F58167B416B55E2859
gpg (GnuPG) 2.2.17; Copyright (C) 2019 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
sec rsa1024/8167B416B55E2859
created: 2019-11-19 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa1024/85BB533A53DAA163
created: 2019-11-19 expires: never usage: E
[ultimate] (1). RRA Example (No comments) <rra@rra.lan>
gpg> passwd
Public Keys
Export public key
To file
gpg --output <destination_file.gpg> --export <public_key_ID>
To server
gpg --send-keys --keyserver pgp.mit.edu 18384645
To ascii file
gpg --armor --export you@example.com > mykey.asc
Import public keys
From file
gpg --import <publickeyfile.gpg>
From server
gpg --keyserver pgp.mit.edu --recv-keys 18384645
Encrypt with a public key
List public keys
gpg --list-keys
Encrypt one recipient
gpg --recipient <key ID> --encrypt <file>
Encrypt with ascii output
gpg --armor --encrypt --output ~/test.crypt --recipient redteam@bbva.com ~/test.txt
Encrypt to multiple recipients
gpg --recipient 42FF42FF \
--recipient 12345678 \
--recipient FEFEFEFE \
--encrypt-files backup.tar
Decrypt with private key
comando gpg -d <encrypted_file>
Signing Keys
Signing
Sign
gpg -u <private_Key_ID> --output <output_signed_file> --sign <file_to_sign> gpg --local-user <private_Key_ID> --output <output_signed_file> --sign <file_to_sign>
Verify signature
gpg -d <signed_file>
or
gpg --verify <signed_file>
CheatSheet
Gpg_cheat_sheet.tar.gz
https://www.digitalocean.com/community/tutorials/how-to-use-gpg-to-encrypt-and-sign-messages
http://www.g-loaded.eu/2010/11/01/change-expiration-date-gpg-key/