Using GPG Keys to Secure Data Confidentiality and Integrity

An Introduction to GPG

Cryptography is a word that may strike fear into the hearts of non-technical folks. It's intimidating because it sounds complicated and learning about it can feel overwhelming. This guide aims to simplify the introduction of cryptography into your everyday life. For that, we're going to focus on the use of GPG keys—specifically, the RSA 3072 asymmetric key pair. Is that a mouthful? Let's keep it simple by calling them a GPG key pair. Each GPG key pair is split into public and private keys that are used for the following operations:

• Encrypting and decrypting data.
• Digitally signing files to verify their authenticity and integrity.
• Verifying signed files to ensure they haven't been tampered.

Public and Private Key Examples

Several types of asymmetric key pairs exist, but the RSA 3072 is what you'll see most often. They follow a common format that begins with a key header, followed by a Base64 encoded key, and ending with a footer that's nearly identical to the header. The header and footer distinctly identify the beginning and end of a key block.

A GPG public key in ASCII-armored format looks like:

-----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBFxhz7cBCADJc0IkrftQv+bG1DqN53+5KyiRk+mc+V5FZkDglgn9GQh2HvOz...
-----END PGP PUBLIC KEY BLOCK-----

A GPG private key in ASCII-armored format looks like this:

-----BEGIN PGP PRIVATE KEY BLOCK-----
lQOYBFxhz7cBCADJc0IkrftQv+bG1DqN53+5KyiRk+mc+V5FZkDglgn9GQh2HvOz...
-----END PGP PRIVATE KEY BLOCK-----

Generating Your Key Pair

Open your command line and type the following:

# command:
gpg --gen-key

# output:
gpg: key 3C4FA637544D94D4 marked as ultimately trusted
gpg: revocation certificate stored as '/home/user/.gnupg/openpgp-revocs.d/3C4FA637544D94D4.rev'
public and secret key created and signed.

pub   rsa4096 2024-12-13 [SC] [expires: 2026-12-13]
      3C4F A637 544D 94D4 9864 C5AC 294C 5727 54AF D654
uid           [ultimate] John Doe (Test Key) <[email protected]>
sub   rsa4096 2024-12-13 [E] [expires: 2026-12-13]

Don't worry about doing anything with your key pair yet. It's safely nestled in its home on your machine. Let's first learn what we can do with it.

Using The Public Key

How Can Public Keys Be Used?

A public key is used in the following ways:

• Encrypting data that only the corresponding private key can decrypt.

  • this is achieved by instructing your machine to encrypt a message using the recipient's public key

  • a sender will use your public key to encrypt messages they're sending to you

• Verifying the authenticity of data signed with the corresponding private key.

  • this is achieved by instructing your machine to verify a digital signature using the corresponding public key

  • while this sounds complicated, you'll find it quite trivial once the mental concept sticks

How Do Public Keys Work?

• One or more users generates a key-pair

• Each user distributes their public key via email, messenger, a website, or key servers

• Every user who intends to encrypt data or verify signatures obtains the following:

  • To encrypt data:

    • the receiver's (to whom you're sending data) public key

  • To verify signatures:

    • a signature file and public key
      • OR (more on this later)
    • a source file, signature file, and public key

• Users who are encrypting data use the receiver's public key to encrypt the data before transmission.

• Users who are verifying a signature use the signer's public key to reverse the signature and compare the source to the reversed signature. This process uses hashing to quickly and securely compare the two files. Don't worry, this step is easier than it sounds.

Exporting Your Public Key

Sharing your public key requires that your first export it. Open your command line and run the following command:

# command:
gpg --export --armor -o public-key.asc

# output file: public-key.asc
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBFxhz7cBCADJc0IkrftQv+bG1DqN53+5KyiRk+mc+V5FZkDglgn9GQh2HvOz...
-----END PGP PUBLIC KEY BLOCK-----

This command saves the public key as public-key.asc in a human-readable ASCII format. You may share this output file with anyone who needs to verify your signature or encrypt data they want to send to you.

💡 Tip
It is safe and common to share your public key.

Importing a Public Key

Using a public key requires that you first load it into your keychain. There are a number of ways to accomplish this, but we'll focus on importing a public key from a file. Other methods are listed below, but wait to review them until the intitial concepts are cemented in your mind.

Compare the fingerprint from the output to the fingerprint you obtained from the sender. The key can be trusted if they're an exact match.

Common Digital Signature Formats

Digital signatures generally exist in one of four formats. Two of these (clearsigned and embedded) combine the digital signature artifacts into a single file. Clearsigned signature files always contain a plaintext message. Think of it as a digitally signed memo with a signature verifying that the message is authentic to the claimed author. Clearsigned and embedded signatures are typically used for documents and communication while detached signatures are typically used for signing software executables.

⚠️ Warning
Digitally signed files do not offer any form of privacy or confidentiality. They exist only to ensure authenticity and integrity of files. Privacy and confidentiality requires encryption.

A Note On Complex Commands

The command line is inherently complex. It's a powerful tool that can be intimidating at first, but you'll eventually start to feel like Neo from The Matrix. Until then, it helps to understand a few key concepts:

Let's break down one of the more complex commands so you can truly understand what's happening:

If you really want to get nitty-gritty, you can read the GPG manual.

Verifying Digital Signatures

Verifying digitals signature is simple once you understand the concepts. This section reviews how to verify all four signature types.

Encrypting Data

Encrypting data is relatively simple. You'll need the recipients public key and a file to encrypt. You can encrypt in human readable and binary formats:

These operations append .gpg or .asc to the end of the file name. You'll share message.txt.gpg|asc with the recipient.

Using Your Private Key

How Can Your Private Key Be Used?

A private key can be used in the following ways:

• Decrypting information encrypted with the corresponding public key.

  • this is achieved by instructing your machine to decrypt files using your own private key

• Signing files to prove that the data originated from you and hasn't been tampered with.

  • this is achieved by instructing your machine to sign files using your own private key

How Do Private Keys Work?

The concept of a private key is generally more simple than a public key. Private keys are stored locally and used for only two operations:

• A user recieves encrypted and instructs their machine to decrypt that data using their private key

• A user generates a file they want to sign and instructs their machine to sign that file using their private key

Exporting Your Private Key

It is possible to export your private key to a file in a few scenarios where it's helpful:

1. Backing it up on an encrypted USB drive or a secure offline storage device.
2. Transferring your key to a new device such as a new laptop or workstation.
3. When migrating from one GPG tool to another.
4. Revoking your key and issuing a new one.
5. Automating secure operations: this is an advanced use case that most non-technical users can ignore.

Command to Export Your Private Key:

# command to export:
gpg --export-secret-keys --armor -o private-key.asc

# output file: private-key.asc
-----BEGIN PGP PRIVATE KEY BLOCK-----
lQOYBFxhz7cBCADJc0IkrftQv+bG1DqN53+5KyiRk+mc+V5FZkDglgn9GQh2HvOz...
-----END PGP PRIVATE KEY BLOCK-----

⚠️ Warning

It is not safe to share your private key with anyone for any reason. Anyone who gains access to your private key can impersonate you, sign files in your name, or decrypt sensitive data intended for you.

Specifying a Key When You Own Multiple:

If you have multiple keys, export a specific key by providing the key ID or email:

# command to export selected:
gpg --export-secret-keys <key-ID-or-email> --armor -o private-key.gpg

# output file: private-key.gpg
-----BEGIN PGP PRIVATE KEY BLOCK-----
lQOYBFxhz7cBCADJc0IkrftQv+bG1DqN53+5KyiRk+mc+V5FZkDglgn9GQh2HvOz...
-----END PGP PRIVATE KEY BLOCK-----

Managing Your Private Key

Never Share Your Private Key!

• The private key must be kept secret and secure at all times.

Tips for Managing Your Private Key

1. Use a Strong Passphrase:
   • Protect your private key with a strong, unique passphrase. Learn the difference betwen a strong and weak passphrase with this password strength meter.
2. Backup Securely:
   • Store backups in a secure, offline location (e.g., encrypted USB drive or hardware security module).
3. Revoke If Compromised:
   • If your private key is lost or compromised, revoke it immediately using a revocation certificate.

Signing Documents

Now, onto the good stuff. This section reviews how to use your private key to sign documents. Remember that there are four common types of signatures.

Decrypting Data

Decrypting data that was encrypted using your public key is relatively straightforward. You have two main options in this scenario—print to command line or output to file.

Practice Practice Practice

Behind every great artist is a body of failed work. Your mound of mistakes becomes the foundation of your success. To simplify the practice of these concepts you can create a directory structure on your machine specifically for GPG key management. Use that folder as your starting point.

gpg_practice/
├── gpg_keys/
│   ├── public-key.gpg                 # represents your personal public key
│   ├── mary-public-key.gpg            # represents a friend's public key
│   ├── bob-public-key.gpg             # represents a colleague's public key
│   ├── private-key.gpg                # represents your private key
├── sig_files/
│   ├── clearsigned.txt.asc            # clearsigned file to practice verifications
│   ├── clearsigned_tampered.txt.asc   # clearsigned file that you modify to practice verification failures
│   ├── embedded.txt.gpg               # file with an embedded signature
│   ├── detachedASCII.txt.asc          # detached ASCII signature
│   ├── detachedbinary.txt.sig         # detached binary signature
├── data_files/
│   ├── test_file.txt                  # test file that is subject to signatures, encryption, and decryption
│   ├── test_file_two.txt              # test file that is subject to signatures, encryption, and decryption
├── encrypted_files/
│   ├── armored_encrypted.txt.asc      # file encrypted in ASCII format (armored)
│   ├── encrypted.txt.gpg              # file encrypted in binary format
└── notes.txt                          # file to keep notes on your practice

The advent of AI is moving privacy and authenticity to the center stage. Learning the fundamentals of online privacy and security is a critical skill for businesses and their employees. GPG keys are a great place to start.