Keeping Your Private Files Private: An Introduction to GNU Privacy Guard.
Features This week's article is an introduction to cryptography using GNU Privacy Guard.

Copyright 2000 by Richard C. Jankowski

Copyright license terms available at

Originally written for


We live in the digital age. Email correspondence is commonplace, business proposals are stored on computer systems, financial and legal information is sent across networks. Nobody can get this information other than the intended recipient, right?

Don't bet on it.

Just about everything you do while connected to a network can be easily watched. System Administrators can rifle through your email, and disgruntled employees can intercept copies of your financial and legal documents as you transfer them across your LAN. Laptops are often stolen, and the loss is much greater if the system also contains confidential information.

Sending sensitive information in email, transferring it around on a network, or even leaving it on your hard drive is the digital equivalent of putting that information on a neon billboard in Times Square.

Encryption is one of the most effective ways to ensure your information is secure. Correctly using a good encryption package, such as GNU Privacy Guard (GnuPG), will help insure your data remains private. Email sent encrypted with GnuPG can only be decrypted by the person whom the message is intended. Encrypted messages which are intercepted and stolen are worthless to anyone but the intended recipient.

GnuPG is GPL Software that follows the OpenPGP Standard. It is intended as a replacement for the PGP encryption package, and does not use any patented encryption algorithms. It can be downloaded from, and runs on Linux, FreeBSD, many other flavors of UNIX, as well as Windows.

Public Key Cryptography

Public Key Cryptography, also known as Asymmetric Cryptography, uses a pair of keys, a public key and a secret key. The public key is used to encrypt a message that only the corresponding secret key can decrypt. The public key is meant to be distributed, while the secret key must not. While the keys are related, it is mathematically impractical to derive one key from the other.

An example would be that Susan makes her public key available to the world by putting it on her Website, emailing it to friends, etc. If I want to send Susan an encrypted message, I would use GnuPG with Susan's public key to encrypt the message, turning it from plaintext to ciphertext. Once the message has been encrypted, only the person who has possession of Susan's secret key is able decrypt it.

Once I encrypt the message for Susan, I cannot derive the original message from the ciphertext. Without access to Susan's secret key, the only way to decrypt the message is by using a brute force attack. A brute force attempt would require every possible key be tried in effort to decrypt the message. This would take the computing equivalent of billions of mainframes trillions and trillions of years.

Making sure Susan's secret key isn't compromised is essential in keeping her messages secure.

Creating and Managing Keys

Once GNU Privacy Guard is compiled and installed, you must create your keys with the command `gpg --gen-key` as following:

[susan:~]$ gpg --gen-key
gpg (GnuPG) 1.0.0; Copyright (C) 1999 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

gpg: /home/susan/.gnupg: directory created
gpg: /home/susan/.gnupg/options: new options file created
gpg: /home/susan/.gnupg/secring.gpg: keyring created
gpg: /home/susan/.gnupg/pubring.gpg: keyring created
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) ElGamal (sign and encrypt)
Your selection? 1

You must select the type of key you would like to use. For most users the default, DSA and ElGamal, is sufficient.

DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024)

Next, you are asked what keysize you want. In general, 1024 bits is more than adequate. The larger the key the longer it will take for encrypting and decrypting messages.

Requested keysize is 1024 bits
Please specify how long the key should be valid.
0 = key does not expire
= key expires in n days
w = key expires in n weeks
m = key expires in n months
y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct (y/n)? y

In this example, Susan doesn't want her keys to expire, so she accepts the default.

You need a User-ID to identify your key;
the software constructs the user id
from Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter) "

Real name: Susan Q. Public
Email address:
Comment: Cyphergirl
You selected this USER-ID:
"Susan Q. Public (Cyphergirl) "

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

Enter passphrase:

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.



Susan is prompted for her name, email address, comment, and passphrase. GNU Privacy Guard then starts generating the keys.

Once a pair of keys is generated, Susan needs to make her public key available so others can send encrypted messages to her. This is done with the "--export" option to the gpg command. The key is exported as a binary file, which isn't suitable for emailing, so the "--armor" command will ASCII armor the key. The key is also sent to stdout, to send the output to a file, use the "--output" option as follows:

[susan:~]$ gpg --armor --output pubkey.asc --export

Now that susan has exported and distributed her key, I'll send her my key (named rich.asc) so she can send me encrypted messages.

[susan:~]$ cat rich.asc
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see


The "--import" option will allow you to import a public key into your keyring as follows:

[susan:~]$ gpg --import rich.asc
gpg: key 76BF6FAD: public key imported
gpg: /home/susan/.gnupg/trustdb.gpg: trustdb created
gpg: Total number processed: 1
gpg: imported: 1

To list the keys in a keyring, use the "--list-keys" option:

[susan:~]$ gpg --list-keys
pub 1024D/533F200F 2000-03-07 Susan Q. Public (Cyphergirl)
sub 1024g/C8F2C0F7 2000-03-07

pub 1024D/76BF6FAD 1999-09-10 Rich Jankowski
sub 1024g/61A19A5E 1999-09-10

Encryption and Decryption

Susan just changed the router password and wants to notify me of the change through email. Because of the sensitive nature of this message, she doesn't want to send it as plaintext. She'll then create a file called doc.txt with the following content:

The new router password is "ro0t3r4dm!n"

To encrypt the message using my public key she would use:

[susan:~]$ gpg --armor --output doc.asc --encrypt --recipient \ doc.txt

This will create an ASCII armored file called doc.asc:

[susan:~]$ cat doc.asc
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see


After getting this message, I can decrypt it with the following:

[rich:~]$ gpg --output doc.txt --decrypt doc.asc

You need a passphrase to unlock the secret key for
user: "Rich Jankowski "
1024-bit ELG-E key, ID 61A19A5E, created 1999-09-10
(main key ID 76BF6FAD)

Enter passphrase:


After entering the correct passphrase for my secret key, GNU Privacy Guard decrypts the file as doc.txt as demonstrated:

[rich:~]$ cat doc.txt
The new router password is "ro0t3r4dm!n"

GNU Privacy Guard also uses symmetric ciphers, which will enable you to use the same key for both encryption and decryption. This is useful if you want to encrypt important files on your system. When encrypting a file with a symmetric cipher, you are prompted for a passphrase. Others who know that passphrase are able to decrypt that file.

Here's an example of using a symmetric cipher to encrypt a file called sales.txt:

[susan:~]$ gpg --symmetric sales.txt
Enter passphrase: A hard to guess passphrase
Repeat passphrase: A hard to guess passphrase

Now, someone using `gpg --decrypt` will be prompted for a passphrase, only someone who knows the passphrase Susan used will be able to decrypt her document.

Signing and Signature Verification

Being able to verify who sent a message is as important as the message itself. GNU Privacy Guard allows users to place a digital signature on both plaintext and ciphertext to validate their origin. In signing a file, GNU Privacy Guard uses the secret key to sign, and the public key is used to validate the signature. Therefore, signed files can be verified by anyone who has access to the sender's public key.

In this example, Susan has a simple plaintext message, called email.txt, which contains:

Lunch meeting at 1 o'clock

She's going to sign the message with "--clearsign", and then email it to me:

[susan:~]$ gpg --clearsign email.txt

You need a passphrase to unlock the secret key for
user: "Susan Q. Public (Cyphergirl) "
1024-bit DSA key, ID 533F200F, created 2000-03-07

Enter passphrase:

GNU Privacy Guard creates a signed file called email.txt.asc, that can be emailed:

[susan:~]$ cat email.txt.asc
Hash: SHA1

Lunch meeting at 1 o'clock
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see

[susan:~]$ mail < email.txt.asc

Upon reciept of this message, I can check to see if the signature is good by using the "--verify" option:

[rich:~]$ gpg --verify email.txt.asc
gpg: Signature made Mon Mar 13 20:24:26 2000 EST using DSA key ID 533F200F
gpg: Good signature from "Susan Q. Public (Cyphergirl) "

The same message could also be encrypted and signed at the same time as:

[susan:~]$ gpg --armor --sign --output email.txt.asc \
--encrypt --recipient email.txt

You need a passphrase to unlock the secret key for
user: "Susan Q. Public (Cyphergirl) "
1024-bit DSA key, ID 533F200F, created 2000-03-07

Enter passphrase:

Encrypted files that are also signed are verified during the decryption:

[rich:~]$ gpg --decrypt email.txt.asc

You need a passphrase to unlock the secret key for
user: "Rich Jankowski "
1024-bit ELG-E key, ID 61A19A5E, created 1999-09-10 (main key ID 76BF6FAD)

Enter passphrase:

Lunch meeting at 1 o'clock
gpg: Signature made Mon Mar 13 20:38:24 2000 EST using DSA key ID 533F200F
gpg: Good signature from "Susan Q. Public (Cyphergirl) "

Note how when "--output" is not specified, the decrypted contents go to stdout.

Putting it Together

To better illustrate the examples, I used the long options in this article. Most of the options don't need to be written out in the long format. Here's a few of the more common options, and their corresponding long and short option flag:

Option Long Flag Short Flag
Armor --armor -a
Encrypt --encrypt -e
Decrypt --decrypt -d
Sign --sign -s
Verify --verify -v
Symmetric --symmetric -c

This makes it a lot easier to type, as:

gpg --sign --encrypt --armor --recipient crypt.txt

is more easily invoked as:

gpg -sear crypt.txt

If you're a fan of graphical user interfaces, you don't have to use GnuPG from the command-line. A nice graphical front-end is TkPGP, and might make GNU Privacy Guard easier to use.

There's a lot more to GnuPG and cryptography than was covered in this intoductory article. Checking the documentation page will go a long way in helping you use GNU Privacy Guard more effectively.

GNU Privacy Guard allows you to take control of your confidential information and ensures that your privacy is not violated. After all, the only ones who probably care about your privacy are the ones trying to invade it.

Return To

Only registered users can write comments.
Please login or register.

Powered by AkoComment!