Skip to content

Commit 6e4f461

Browse files
author
boite
committed
Add guides to signing keys and signing and encrypting messages.
1 parent ff83b15 commit 6e4f461

File tree

3 files changed

+197
-5
lines changed

3 files changed

+197
-5
lines changed

‎README.md

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ Then there are guides for the individual operations, notably:-
1515

1616
- [Generate a set of OpenPGP keys][genkey-with-detached-identity], including a
1717
detached Master Identity key.
18+
- [Certify the identity][sign_key] of a correspondent.
19+
- [Sign and encrypt a message][sign_encrypt] to a correspondent
1820
- Refresh the public keys of correspondents over Tor using
1921
[Parcimonie on Windows][parcimonie-vbguest]
2022
- ...
@@ -23,11 +25,6 @@ There is also a [sample configuration file for GnuPG][gpg-conf] which you may
2325
wish to use in place of the default configuration.
2426

2527

26-
[background]: docs/background.md
27-
[genkey-with-detached-identity]: docs/genkey-with-detached-identity.md
28-
[gpg-conf]: conf/gpg.conf
29-
[parcimonie-vbguest]: vm/parcimonie/
30-
3128
## Bibliography
3229

3330
This guide builds on the work of many other people:-
@@ -61,3 +58,11 @@ This guide builds on the work of many other people:-
6158
- https://wiki.openstack.org/wiki/OpenPGP_Web_of_Trust OpenPGP Web of Trust
6259
- http://www.phillylinux.org/keys/terminal.html Keysigning with the GNU/Linux
6360
Terminal
61+
62+
63+
[background]: docs/background.md
64+
[genkey-with-detached-identity]: docs/genkey-with-detached-identity.md
65+
[sign_key]: docs/sign_key.md
66+
[sign_encrypt]: docs/sign_encrypt.md
67+
[parcimonie-vbguest]: vm/parcimonie/
68+
[gpg-conf]: conf/gpg.conf

‎docs/sign_encrypt.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Sign and Encrypt a message for your correspondent
2+
3+
This guide assumes that you're familiar with the [background][background] and
4+
have [generated some keys][genkey-with-detached-identity].
5+
6+
7+
## Ingredients
8+
9+
- Insecure workstation
10+
- Secure workstation
11+
- Daily-use keyrings on the `keys` USB memory stick
12+
- The `unsafe` USB memory stick
13+
- The [signed public key of your correspondent][sign_key]
14+
15+
16+
## Method
17+
18+
- Mount the USB memory sticks
19+
- Sign and encrypt your message
20+
21+
22+
### Mount the USB memory sticks
23+
24+
On the secure workstation, [mount][mount_usb] the `keys` and `unsafe` USB
25+
memory sticks.
26+
27+
28+
### Sign and encrypt your message
29+
30+
me@box:~$ export GNUPGHOME=/media/keys
31+
me@box:~$ gpg --armor --output /media/unsafe/msg_for_C097AC75C097AC75.asc --recipient 0xC097AC75C097AC75 --sign --encrypt
32+
33+
You need a passphrase to unlock the secret key for
34+
user: "My Full Name <[email protected]>"
35+
4096-bit RSA key, ID 0xFDB32668D55D0A12, created 2013-12-14
36+
(subkey on main key ID 0xF1829BDBB6B64480)
37+
38+
Dear John,
39+
By the time you read these lines I'll be gone.
40+
Life goes on, right or wrong
41+
Now the sun is dead and gone. Dear John.
42+
43+
Hit `Ctrl+D` when you've finished typing your message, et voilà!
44+
45+
Alternatively you can encrypt a file:-
46+
47+
me@box:~$ gpg --armor --output /media/unsafe/msg_for_C097AC75C097AC75.asc --recipient 0xC097AC75C097AC75 --sign --encrypt some_file.txt
48+
49+
50+
[background]: background.md
51+
[genkey-with-detached-identity]: genkey-with-detached-identity.md
52+
[sign_key]: sign_key.md
53+
[mount_usb]: mount_usb.md

‎docs/sign_key.md

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# Sign the key of your correspondent
2+
3+
This guide assumes that you're familiar with the [background][background] and
4+
have [generated some keys][genkey-with-detached-identity].
5+
6+
7+
## Ingredients
8+
9+
- Insecure workstation
10+
- Secure workstation
11+
- Master keyrings on the `master` USB memory stick
12+
- Daily-use keyrings on the `keys` USB memory stick
13+
- The `unsafe` USB memory stick
14+
15+
16+
## Method
17+
18+
- Copy your correspondents public key to the `unsafe` USB memory stick
19+
- Mount the USB memory sticks
20+
- Import your correspondents key into the Master keyring
21+
- Verify the fingerprint with your correspondent
22+
- Sign your correspondents key
23+
- Export the signed public key certificate of your correspondent
24+
- Import the signed public key certificate into your daily-use keyring
25+
26+
27+
### Copy your correspondents public key to the `unsafe` USB memory stick
28+
29+
There are numerous ways to obtain the public key (properly, the public key
30+
certificate). Once you have it, copy it to the `unsafe` USB memory stick on
31+
your insecure workstation. In the following example the file is named
32+
`C097AC75C097AC75.asc`.
33+
34+
35+
### Mount the USB memory sticks
36+
37+
On the secure workstation, [mount][mount_usb] the `master`, `keys` and `unsafe`
38+
USB memory sticks.
39+
40+
41+
### Import your correspondents key into the Master keyring
42+
43+
me@box:~$ export GNUPGHOME=/media/master
44+
me@box:~$ gpg --import /media/unsafe/C097AC75C097AC75.asc
45+
gpg: key 0xC097AC75C097AC75: public key "Your Contact <[email protected]>" imported
46+
gpg: Total number processed: 1
47+
gpg: imported: 1
48+
49+
50+
### Verify the fingerprint with your correspondent
51+
52+
me@box:~$ gpg --fingerprint -k 0xC097AC75C097AC75
53+
pub 1024D/0xC097AC75C097AC75 2008-09-27 [expires: 2015-09-27]
54+
Key fingerprint = B452 6436 7BCD E26B F9D3 81CB C097 AC75 C097 AC75
55+
uid [ unknown] Your Contact <[email protected]>
56+
uid [ unknown] Your Contact <[email protected]>
57+
sub 2048g/0x0COO1A5C001CA9BE 2008-09-27 [expires: 2015-12-09]
58+
59+
60+
### Sign your correspondents key
61+
62+
In this operation you are certifying that one or more User IDs bound to the
63+
public key of your correspondent truly represent their identity. You do this by
64+
adding a signature, made by your Master secret key, to their public key
65+
certificate.
66+
67+
me@box:~$ gpg -K
68+
/media/keys/secring.gpg
69+
--------------------------------
70+
sec 4096R/0xF1829BDBB6B64480 2013-12-14 [expires: 2013-12-13]
71+
uid My Full Name <[email protected]>
72+
ssb 4096R/0xFDB32668D55D0A12 2013-12-14
73+
ssb 4096R/0xC3897294DD857167 2013-12-14
74+
75+
me@box:~$ gpg --local-user 0xF1829BDBB6B64480! --sign-key 0xC097AC75C097AC75
76+
77+
pub 1024D/0xC097AC75C097AC75 created:2008-09-27 expires: 2015-09-27 usage: SC
78+
trust: unknown validity: unknown
79+
sub 2048g/0x0COO1A5C001CA9BE created:2008-09-27 expires: 2015-12-09 usage: E
80+
[ unknown] (1). Your Contact <[email protected]>
81+
[ unknown] (2) Your Contact <[email protected]>
82+
83+
Really sign all user IDs? (y/N) y
84+
85+
pub 1024D/0xC097AC75C097AC75 created:2008-09-27 expires: 2015-09-27 usage: SC
86+
trust: unknown validity: unknown
87+
Primary key fingerprint: B452 6436 7BCD E26B F9D3 81CB C097 AC75 C097 AC75
88+
89+
Your Contact <[email protected]>
90+
Your Contact <[email protected]>
91+
92+
This key is due to expire on 2015-09-27.
93+
Are your sure that you want to sign this key with your
94+
key "My Full Name <[email protected]>" (0xF1829BDBB6B64480)
95+
96+
Really sign? (y/N) y
97+
98+
You need a passphrase to unlock the secret key for
99+
user: "My Full Name <[email protected]>"
100+
4096-bit RSA key, ID 0xF1829BDBB6B64480, created 2013-12-14
101+
102+
me@box:~$
103+
104+
105+
### Export the signed public key certificate of your correspondent
106+
107+
You will want to make the signed key available to your daily-use keyring so
108+
that it can be used to encrypt messages to your correspondent. You will also
109+
want to make it available on the insecure workstation so that you are able to
110+
publish the updated certificate.
111+
112+
me@box:~$ gpg --armor --output /media/unsafe/C097AC75C097AC75_signed_by_F1829BDBB6B64480.asc --export 0xC097AC75C097AC75
113+
me@box:~$ sudo umount /media/master
114+
115+
116+
### Import the signed public key certificate into your daily-use keyring
117+
118+
me@box:~$ export GNUPGHOME=/media/keys
119+
me@box:~$ gpg --import /media/unsafe/C097AC75C097AC75_signed_by_F1829BDBB6B64480.asc
120+
gpg: key 0xC097AC75C097AC75: public key "Your Contact <[email protected]>" imported
121+
gpg: Total number processed: 1
122+
gpg: imported: 1
123+
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
124+
gpg: depth: 0 valid: 1 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 1u
125+
gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u
126+
gpg: next trustdb check due at 2015-09-27
127+
128+
You're now ready to [encrypt messages for your correspondent][sign_encrypt].
129+
130+
131+
[background]: background.md
132+
[genkey-with-detached-identity]: genkey-with-detached-identity.md
133+
[mount_usb]: mount_usb.md
134+
[sign_encrypt]: sign_encrypt.md

0 commit comments

Comments
 (0)