GnuPG Survival Guide

GnuPG, stand for GNU Privacy Guard, which is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). The developers open use this tool to sign the digital products created. This guide shows the usage of some common commands of GPG.

Common Commands

# get help for gpg
$ gpg --help

# list public keys
$ gpg --list-keys

# list secret keys
$ gpg --list-secret-keys


# create a new full featured key pair (and its revocation certificate)
$ gpg --full-generate-key

# create a revocation certificate to a file
$ gpg --output <certificate file(.asc)> --generate-revocation <key id>


# revoke a key with its revocation certificate
$ gpg --import <certificate file>
# and then, update the key server as well.
# The --keyserver option is not required, when the keyserver is specified in ~/.gnupg/dirmngr.conf.
$ gpg --keyserver <key server url> --send <key id>


# delete a secret key
$ gpg --delete-secret-key <key id>

# delete a public key
$ gpg --delete-key <key id>


# export specific(or all) public key into the file "public-gpg.key"
$ gpg -a --export [<key id>] > public-gpg.key

# export specific(or all) secret key into the file "secret-gpg.key"
$ gpg -a --export-secret-keys [<key id>] > secret-gpg.key

# export owener trust into the file "ownertrust-gpg.txt"
$ gpg --export-ownertrust > ownertrust-gpg.txt


# import secret keys(which contains the public key)
$ gpg --import secret-gpg.key

# import owner trust
$ gpg --import-ownertrust ownertrust-gpg.txt


# export keys to a keyserver
$ gpg --keyserver <key server url> --send-keys <key id>
$ gpg --keyserver hkp://pool.sks-keyservers.net --send-keys <key id>

# import keys from a keyserver
$ gpg --keyserver <key server url> --receive-keys <key id>
$ gpg --keyserver hkp://pool.sks-keyservers.net --receive-keys <key id>

# update a key if your version of it is out of date
$ gpg --refresh-keys <key id>


# search keys (interactively) contains term1 & term2
$ gpg --search-key <Term1> <Term2>

# search keys with key id from a key server
$ gpg --keyserver <key server url> --search-key <key id>


# edit key
$ gpg --edit-key <key id>

Troubleshooting for Git Bash with Gpg4Win

On the Windows OS, I prefer to install both Git for Windows and Gpg4Win for version control and secure solution. However, there is a glitch between these two powerful tools:

• git version 2.18.0.windows.1
• gpg4win-3.1.3

The issue is that git bash has its own version of gpg available, which is much outdated than the version of gpg provided by gpg4win. Their key stores are not same, and lots of the commands and arguments are not identical.

To avoid all issues brought by 2 versions of gpg, we can simply disable the gpg provided by Git, so that git bash can work with the updated gpg provided by gpg4win:

• go to Git installation directory, which is C:\Program Files\Git in my system
• go to its sub-directory usr\bin, locate the file gpg.exe
• delete gpg.exe or rename it to another name, like gpg_dsiabled.exe
• reopen git bash, run gpg --version, the updated version of gpg provided by gpg4win should be available

References

• The GNU Privacy Guard
• Gpg4win 
• GunPG HOWTOs, Chinese Version
• SKS Keyservers: Overview of the pools
• Bfrg/gpg-guide: Quick-start guide to GPG
• Instructions for exporting/importing (backup/restore) GPG keys
• Using Git Bash With Custom Installation Of GPG / GnuPG