The Gnu Privacy Guard is free, open source software that implements the PGP algorithm for Public Key Cryptography (among many others). Note that PGP here is not meant to signify the proprietary, license-limited software package called PGP (published by the PGP corporation) but instead the “Pretty Good Privacy” algorithm, which is in the public domain. GPG is available for windows, linux and many flavors of unix. You can download the latest version at http://gnupg.org/.
GPG provides a command-line interface—meaning that on windows, you use it at the c:\> prompt. Here is a mini-tutorial on how to use gpg. User-supplied information is printed in bold red text .
Creating a key pair
To create a key pair you call gpg with the “--gen-key” option, and respond to the prompts.
C:\> gpg --gen-key
gpg (GnuPG) 1.2.1; Copyright (C) 2002 Free Software Foundation, Inc.
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(5) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
What keysize do you want? (1024) 1024
Requested keysize is 1024 bits
You need a Passphrase to protect your secret key.
Enter Passphrase: Who put the bang in shebang shebang shebang?
Reenter Passphrase: Who put the bang in shebang shebang shebang?
You need a User-ID to identify your key; the software constructs the user id from Real Name, Comment and Email Address in this form:
"Heinrich Heine (Der Dichter)<heinrichh@duesseldorf.de>"
Real name: Roy Pardee
Email address: rpardee@nowhere.net
Comment: Home
You selected this USER-ID:
"Roy Pardee (Home) <rpardee@nowhere.net>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy.
++++++++++.+++++.+++++++++++++++.++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++.++++++++++.+++++++++++++++..++++++++
+++++++>++++++++++.>+++++......................................++
+++
public and secret key created and signed.
key marked as ultimately trusted.
pub 1024D/22F2385B 2004-09-27 Roy Pardee (Home) <rpardee@nowhere.net>
Key fingerprint = 6F13 46E8 4B5F FE96 F59D A609 7CD9 F063 22F2 385B
sub 1024g/C887F092 2004-09-27
Your key pair is now stored in gpg’s keyring file. [5] Any time you need to access your secret key, you will need to supply the passphrase you’ve chosen—that’s what protects you against someone hacking into your computer, or otherwise gaining access to your keyring file, and using your secret key to impersonate you.
Exporting Your Public Key
To export your public key, type:
C:\> gpg --armor --export [e-mail address]
Where [e-mail address] is the address you specified when you generated the key. Gpg will print your public key as text to the screen:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.2.1 (MingW32)
mQGiBEFYFw4RBADmipkBekgk+wm9HF5DI3VDozF1OISNPG4BIDWZ3PuhMZ2RYB1i
mFnH4QJ8LXbqjzz0YcsbrVF+RisMysy8SJZBAVSO20fneHrCPCYSXiXpxwCggwVe
DSi9/5plm+r9FvkAn1uy9UAzEvr8NHYC6C2sTRgPU11P
=mp7B
-----END PGP PUBLIC KEY BLOCK-----
You can either copy that off your console window, or else tell gpg to write it to a file with a command like:
C:\> gpg --armor --export [e-mail address] > mykey.txt
You can then attach mykey.txt to an e-mail, or copy/paste its contents into an e-mail message or otherwise send it around.
Importing Someone Else’s Public Key
The command to import a public key is just:
C:\> gpg --import [file name]
gpg: key 705D1FB9: "Amanda Hugankiss (Pretend person) amanda@hugankiss.com>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
Where [file name] is the name of the file to which you’ve saved the key.
Encrypting A File
To encrypt a file using a public key you type:
C:\> gpg --encrypt-files –r [recipient’s e-mail address] [file name]
So for instance:
C:\> gpg --encrypt-files –r amanda@hugankiss.com StudyData.txt
Will result in the creation of a new file called StudyData.gpg. [6] You can then safely send this new file to your friend Amanda and she can decrypt it with her private key.
Decrypting A File
To decrypt a file you type:
C:\> gpg --decrypt-files [file name]
This operation requires the use of your secret key, and so gpg will prompt you for the passphrase you entered when you created it:
You need a passphrase to unlock the secret key for
user: "pardre1 <pardee.r@ghc.org>"
1792-bit ELG-E key, ID E9FD6753, created 2004-05-26 (main key ID 3468AA7D)
Who put the bang in shebang shebang shebang?
gpg: encrypted with 1792-bit ELG-E key, ID E9FD6753, created 2004-05-26
"Roy Pardee (Home) <rpardee@nowhere.net>"
Digitally Signing A File
To digitally sign a file you type:
C:\> gpg --sign [file name]
Here again you get prompted for your passphrase, and the output is written to a new file called [file name minus extension].gpg.
Verifying a Digital Signature
To verify a signed file, type
C:\> gpg --verify [file name]
gpg: Signature made 10/11/04 16:39:11 using DSA key ID 3468AA7D
gpg: Good signature from "Roy Pardee (Home) <rpardee@nowhere.net>"
This will of course only work if you have imported the public key of the person who signed the file.
Visit the Gnu Privacy Guard web page for more details on using gpg:
[1] For example, the type of encryption you use when you password-protect a .zip file is ‘secret key’ encryption.
[2] This is actually a slight simplification of the process—as an expedient, most digital signature software will compute a hash of the message and then encrypt that . The American Bar Association has a nice discussion of digital signatures here : http://www.abanet.org/scitech/ec/isc/dsg-tutorial.html
[3] See the appendix, below.
[4] You might ask yourself how the traffic is encrypted in both directions—you haven’t sent anybody a public key for encrypting stuff sent to you, so how is the web server able to encrypt the pages it sends you in such a way that your browser can decrypt them for display?
The answer is that the HTTPS protocol doesn’t use public key cryptography for these exchanges. It actually uses secret key cryptography—the kind where both sides of the transaction need to know a secret password. The reason for this is that PKC is fairly computationally intensive. If both browser client and web server had to PK-encrypt every bit of data that ran back and forth, the wait would be next to intolerable. So to save on time, the web server randomly generates a secret password, PK-encrypts that , and from that point forward your browser and the web server use secret key encryption.
[5] You don’t normally need to directly manipulate this file, but on a windows system, you will find it at c:\documents and settings\<<username>>\\Application Data\GnuPG\secring.gpg
[6] Note that it’s advisable to rename this file to StudyData.txt.gpg. The extra file extension gives a cue to the type of the file. As it is, when Amanda goes to decrypt StudyData.gpg, she will wind up with a file called simply “StudyData”. If you rename the file she will wind up with “StudyData.txt”