This article will guide you through the process of generating public andprivate keys for encrypting emails. This is for people using command line(unix) mail readers such as Mutt as well as those who use Linux workstations.
- Osx Generate Pgp Key
- Generate Pgp Key Mac Terminal
- How To Generate Pgp Key Mac
- Generate Pgp Key In Terminal 3
Warning: Generating the PGP on the YubiKey ensures that malware can never steal your PGP private key, but it means that the key can not be backed up so if your YubiKey is lost or damaged the PGP key is irrecoverable. Insert the YubiKey into the USB port if it is not already plugged in. Open Command Prompt (Windows) or Terminal (macOS / Linux).
- With GPG or another PGP program. You may import from Keybase to GPG easily and then perform whatever cryptographic actions you want. # using curl curl them /key.asc gpg -import # using `keybase pgp pull` which # imports to GPG key chain for you keybase follow them keybase pgp pull them.
- Creating your OpenPGP keys with gpg. Step 1: Open a terminal and type: gpg -gen-key Step 2: GPG will now ask you a number of questions about the type of key you want to generate. Follow the steps below to select the default option each time.
How to Generate PGP Keys
Run the following commands on your local workstation:
Note: You will have to run the same command to initialize the directory(step 1) and to generate the key (step 2).
Initialize the GPG Directory
> gpg --gen-keygpg (GnuPG) 1.0.6; Copyright (C) 2001 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
gpg: /home/keymaster/.gnupg: directory created
gpg: /home/keymaster/.gnupg/options: new options file created
gpg: you have to start GnuPG again, so it can read the new options fileGenerate a Private Key
> gpg --gen-keygpg (GnuPG) 1.0.6; Copyright (C) 2001 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
gpg: /home/keymaster/.gnupg/secring.gpg: keyring created
gpg: /home/keymaster/.gnupg/pubring.gpg: keyring created
Please select what kind of key you want:
(1) DSA and ElGamal? (default)
(2) DSA (sign only)
(4) ElGamal? (sign and encrypt)
Your selection? 1
DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024) 4096you really need such a large keysize? y
Requested keysize is 4096 bits
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct (y/n)? yYou need a User-ID to identify your key; the software constructsthe user id
from Real Name, Comment and Email Address in this form:
'Heinrich Heine (Der Dichter) '
Real name: Your Real Name
Email address: [email protected]
You selected this USER-ID:
'Your Real Name'
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.
Enter passphrase: pickapassphrase
Repeat passphrase: pickapassphrase
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++..
you may see
..
Not enough random bytes available. Please do some other work to give
the OS a chance to collect more entropy! (Need 290 more bytes)
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
+++++++++++++++.+++++++++++++++.+++++++++++++++++++++++++. publicand secret key created and signed.Generate and print a copy of your public key ID and fingerprint
>gpg --fingerprint
An an example of the fingerprint output, here is the output of theNMLUG Keymaster's fingerprint:pub 1024D/14931423 2003-02-13 New Mexico Linux User Group Keymaster
Key fingerprint = 724D 2514 93EC 83D4 E5BC D534 C5BC C12C 1493 1423
sub 2048g/42685AC7 2003-02-13
Store your PGP passphrase in a secure place, such as a password manager(LastPass Premiumis available for free to members of the Penn Community). The PGPsystem has no means to reset your password if you forget it. If you forget yourpassphrase, you will need to create a new key, send it out to everyone, andtell them to use the new one rather than the old one.
Mutt
If you use mutt to read your email, you may need to add this line to your.muttrc file:
source /usr/local/doc/mutt/samples/gpg.rcThis tutorial series will teach you how to use GPG in Linux terminal. I will not tell you a bunch of theory to overwhelm you. Instead, I show you quick and dirty examples to get you started, and explain the basic theory along the way.
This is part 1 of this series. At the end of this post, you should be able to generate your own public/private keypair and a revocation certificate. This certificate is used to revoke your public/private keypair when your private key is compromised or you forget the passphrase for your private key.
GPG can be used for encryption and for signing. This software is pre-installed on most Linux distributions. Currently the stable version is GPG 2.0. I’m using the modern version GPG 2.2 on Arch Linux.
Check Your GPG Version
First Let’s check out the version of GPG on your system and some interesting tidbits. Run the following command.
As you can see, I’m using GPG 2.2.8, which is the latest version. We also know that the configuration directory is ~/.gnupg, which will hold our public/private key files. The default option file is ~/.gnupg/gpg.conf and ~/.gnupg/dirmngr.conf. It also tells us what algorithms are supported.
If you look closely, you can see that the insecure hash algorithm SHA1 is still supported in version 2.2.8 SHA1 is obsolete and you don’t want to use it to generate signature.
Create Your Public/Private Key Pair and Revocation Certificate
Use gpg --full-gen-key command to generate your key pair.
It asks you what kind of key you want. Notice there’re four options. The default is to create a RSA public/private key pair and also a RSA signing key. Let’s hit Enter to select the default.
Next it asks you the key length. The default is 2048 bits long. 1024 RSA key is obsolete. The longer 4096 RSA key will not provide more security than 2048 RSA key. So hit Enter to select the default.
Steps to take after generating a new key video. The next section shows a full example of what each key file should look like. The Generated Key Files. The generated files are base64-encoded encryption keys in plain text format. If you select a password for your private key, its file will be encrypted with your password. Be sure to remember this password or the key pair becomes useless. Sep 26, 2019 When you generate the keys, you will use ssh-keygen to store the keys in a safe location so you can bypass the login prompt when connecting to your instances. To generate SSH keys in macOS, follow these steps: Enter the following command in the Terminal window. Ssh-keygen -t rsa. This starts the key generation process. Adding your SSH key to the ssh-agent. Before adding a new SSH key to the ssh-agent to manage your keys, you should have checked for existing SSH keys and generated a new SSH key. When adding your SSH key to the agent, use the default macOS ssh-add command, and not an application installed by macports, homebrew, or some other external source. Scenario 1: 7 seconds to generate the key pair. Scenario 2: 4 seconds to generate the key pair. Don’t avoid generating key pairs because of the complexity or time involved. Even with relatively limited resources, today’s technology makes short work of key generation.
After that it asks you how long the key should be valid, 2 years is fine. You can always update the expiration time later on.
Now it asks you if it’s correct. Notice that the default is No. So press y then Enter to confirm it’s correct.
And now we need to provide some user identification information for the key. This is important because this information will be included in our key. It’s one way of indicating who is owner of this key. The email address is a unique identifier for a person. You can leave Comment blank.
Select Okay.
Now it asks you to enter a passphrase to protect your private key. Enter a good and long passphrase and remember it. Because if you forget this passphrase, you won’t be able to unlock you private key.
Once you enter and confirm your passphrase. GPG will generate your keys.
It will take a while for GPG to generate your keys. So you can now do other stuff.
It took about 4 minutes on my system to generate my key pair.
This first line tells us that GPG created a unique identifier for public key. This unique identifier is in hex format. When someone wants to download you public key, they can refer to you public key via your email address or this hex value.
The third line tells us that GPG created a revocation certificate and its directory.Your should never share you private key with anyone.If you private key is compromised, you can use revocateion certificate to revoke your key. That means you tell the rest of the world that the old public key shall not be used any more.I suggest that you open this revocation certificate with your text editor to see what’s inside there.
Let’s look at the last three lines. They tell us the public key is 2048 bits using RSA algorithm. The public key ID 4F0BDACC matchs the last 8 bits of key fingerprint. The key fingerprint is a hash of your public key.
It also lists our user ID information: your name and your email address. And it also indicates the subkey which is 2048 bits using RSA algorithm and the unique identifier of the subkey.
Osx Generate Pgp Key
Now you can find that there are two files created under ~/.gnupg/private-keys-v1.d/ directory. These two files are binary files with .key extension.
Export Your Public Key
Others need your public key to send encrypted message to you and only your private key can decrypt it. Use the following command to export your public key. --armor option means that the output is ASCII armored. The default is to create the binary OpenPGP format. user-id is your email address.
The exported public key is written to pubkey.asc file.
Export Your Private Key
Issue the following command to export your private key.
The exported key is written to privkey.asc file.
Generate Pgp Key Mac Terminal
Protect Your Private Key and Revocation Certificate
Your private key should be kept in a safe place, like an encrypted flash drive. Treat it like your house key. Only you can have it and don’t lose it. And you must remember your passphrase, otherwise you can’t unlock your private key.
How To Generate Pgp Key Mac
You should also protect your revocation certificate. If others have your revocation certificate, they can immediately revoke your public/private keypair and generate a fake public/priavte keypair.
In part 2 we will look at how to encrypt message with your public key and how to decrypt it with your private key. Take care!