GnuPG advice

GnuPG advice (EN) - Some tips on GnuPG.md

Some tips on GnuPG

1. Basics

First, some definitions:

• key: ID, partial name, email
• <keyId>: key ID prefixed by 0x

About the console: data can be written to GnuPG stdin just like if it was written in any other console window; to signal that the stream/message is over, hit EOF (Ctrl+D on Linux).

1.1. Output

Output can be either binary or ASCII encoded. Binary is the default behavior, and ASCII can be specified by using the option --armor.

1.2. Encription/Decryption

The options are --encrypt and --decrypt, and they operate by default reading from stdin and writting to stdout.

For encryption is necessary to specify the recipients with --recipient <key>, since data will be encrypted with their public key:

gpg --recipient <key> --encrypt

Decription is quite simple:

gpg --decrypt

1.3. Signing

TODO

1.4. Specifying to GnuPG file paths for input/output

TODO

2. Security

3. Reading OpenPGP email by hand

3.1. PGP/MIME

3.1.1. Encrypted message, with or without a signature

Basically all you need is the encrypted message body and:

gpg --decrypt

The decrypted message may now show char combinations instead of non ASCII symbols. If that is the case, and if the message also starts with a header Content-Transfer-Encoding: quoted-printable, you will need to pipe that into qprint for decoding of this encoding:

gpg --decrypt | qprint -d

And that's it.

3.1.2. Signed only messages

TODO

4. More

If you search a keyserver for the ID of a subkey, it will usually return the corresponding master key. However, it wont inform you of that. So, if you search for a key ID and the server returns a different ID, check to see if your query isn't a subkey of the result.