加密工具 - GPG入门

~$ sudo apt-get install gnupg

~$ pacman -S gnupg
# or you can search candidates includes key gnupg by command:
~$ pacman -Ss gnupg

~$ git clone git://git.gnupg.org/gnupg.git

~$ ./autogen.sh
*** Activating trailing whitespace git pre-commit hook. ***
    For more information see this thread:
      https://mail.gnome.org/archives/desktop-devel-list/2009-May/msg00084.html
    To deactivate this pre-commit hook again move .git/hooks/pre-commit
    and .git/hooks/pre-commit.sample out of the way.
‘.git/hooks/pre-commit.sample’ -> ‘.git/hooks/pre-commit’
autogen.sh: *** Adding GIT filter.cleanpo.clean configuration.
*** Activating commit log message check hook. ***
‘build-aux/git-hooks/commit-msg’ -> ‘.git/hooks/commit-msg’
autogen.sh: Running aclocal -I m4 ...
autogen.sh: Running autoheader...
autogen.sh: Running automake --gnu ...
autogen.sh: Running autoconf ...
autogen.sh: You may now run:
  ./configure --sysconfdir=/etc --enable-maintainer-mode  && make
~$ ./configure --sysconfdir=/etc --enable-maintainer-mode  && make
~$ sudo make install

~$ ./configure --sysconfdir=/etc --enable-maintainer-mode  && make
...
configure:
***
*** You need libassuan to build this program.
*** This library is for example available at
***   https://gnupg.org/ftp/gcrypt/libassuan/
*** (at least version 2.5.0 (API 2) is required).
configure: error:
***
*** Required libraries not found. Please consult the above messages
*** and install them before running configure again.
***

~$ gpg --gen-key

~$ gpg --full-generate-key

~$ gpg --full-generate-key
gpg (GnuPG) 2.1.18; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 1
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: test
Name must be at least 5 characters long
Real name: gpgtest
Email address: gpgtest@gmail.com
Comment: GPG test for blog
You selected this USER-ID:
    "gpgtest (GPG test for blog) <gpgtest@gmail.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
                   disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

gpg: key 82159169CFBF69E6 marked as ultimately trusted
gpg: revocation certificate stored as '/home/yanyg/.gnupg/openpgp-revocs.d/4F2F97E03BFBF466032ADFB382159169CFBF69E6.rev'
public and secret key created and signed.

pub   rsa4096 2018-06-11 [SC]
      4F2F97E03BFBF466032ADFB382159169CFBF69E6
      4F2F97E03BFBF466032ADFB382159169CFBF69E6
uid                      gpgtest (GPG test for blog) <gpgtest@gmail.com>
sub   rsa4096 2018-06-11 [E]

# generate test files
~$ dd if=/dev/urandom of=test.data bs=1K count=4
~$ ls -lh test.data
-rw-r--r-- 1 yanyg yanyg 4.0K Jun 11 14:32 test.data
~$ gpg --local-user gpgtest --sign test.data
~$ ls -lh test.data*
-rw-r--r-- 1 yanyg yanyg 4.0K Jun 11 14:32 test.data
-rw-r--r-- 1 yanyg yanyg 4.7K Jun 11 14:34 test.data.gpg
gpg --verify test.data.gpg
gpg: Signature made Mon 11 Jun 2018 02:34:03 PM CST
gpg:                using RSA key 4F2F97E03BFBF466032ADFB382159169CFBF69E6
gpg:                issuer "gpgtest@gmail.com"
gpg: Good signature from "gpgtest (GPG test for blog) <gpgtest@gmail.com>" [ultimate]
~$ echo $?
0

~$ gpg --output gpgtest.gpg --export gpgtest
~$ gpg --no-default-keyring --keyring $PWD/gpgtest.gpg --verify test.data.gpg
gpg: Signature made Mon 11 Jun 2018 02:34:03 PM CST
gpg:                using RSA key 4F2F97E03BFBF466032ADFB382159169CFBF69E6
gpg:                issuer "gpgtest@gmail.com"
gpg: Good signature from "gpgtest (GPG test for blog) <gpgtest@gmail.com>" [ultimate]
~$ echo $?
0
~$ gpg --no-default-keyring --keyring $PWD/yanyg.gpg --verify test.data.gpg
gpg: Signature made Mon 11 Jun 2018 02:34:03 PM CST
gpg:                using RSA key 4F2F97E03BFBF466032ADFB382159169CFBF69E6
gpg:                issuer "gpgtest@gmail.com"
gpg: Can't check signature: No public key
~$ echo $?
2

~$ echo "plain text" >> test.txt
~$ gpg --clearsign test.txt
~$ ls -lh test.txt*
-rw-r--r-- 1 yanyg yanyg  11 Jun 11 14:45 test.txt
-rw-r--r-- 1 yanyg yanyg 548 Jun 11 14:45 test.txt.asc
~$ cat test.txt.asc
cat test.txt.asc
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

plain text
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE0BqO3vjy8KO1xif3Ux7dTb+fD1sFAlseGooACgkQUx7dTb+f
D1v/DQgAnn75lyOmcX4TJFMj2FV8J2JVjY8Hbp71jMO68x9j1Kao8pemvMMXC87w
zi80ZfQbiMImpRZG90ObF/8NHkDT/uqcg4yqHnTbfpmMvlTvUcX6AbOBqINC4WG9
89P8JelyfiA/3x5asow3iL2HBITtCEVoYKtwrMJSgfFHd9q/CJjdAx67O0hakzEZ
i1E94rBslfguzO8mRlqvj7b8vEWdGJpXtCPTLhgNKg1Grx9vOhAfhLHl3Vgb+PKB
bVl1EZ2CTBuVk4ruNWBlS0FUo5+gAolicYoNT4v4uDy7AXjKY6dIs9qsbmKBbNN0
lXAROEL0pBiIOtYkx531LfwfX69bkg==
=VsDH
-----END PGP SIGNATURE-----

~$ gpg --local-user gpgtest --detach-sign test.data
~$ ls -lh test.data*
-rw-r--r-- 1 yanyg yanyg 4.0K Jun 11 14:32 test.data
-rw-r--r-- 1 yanyg yanyg 4.7K Jun 11 14:34 test.data.gpg
-rw-r--r-- 1 yanyg yanyg  585 Jun 11 14:47 test.data.sig
~$ gpg --verify test.data.sig test.data
gpg: Signature made Mon 11 Jun 2018 02:47:22 PM CST
gpg:                using RSA key 4F2F97E03BFBF466032ADFB382159169CFBF69E6
gpg:                issuer "gpgtest@gmail.com"
gpg: Good signature from "gpgtest (GPG test for blog) <gpgtest@gmail.com>" [ultimate]
# Give wrong file:
~$ gpg --verify test.data.sig  test.txt
gpg: Signature made Mon 11 Jun 2018 02:47:22 PM CST
gpg:                using RSA key 4F2F97E03BFBF466032ADFB382159169CFBF69E6
gpg:                issuer "gpgtest@gmail.com"
gpg: BAD signature from "gpgtest (GPG test for blog) <gpgtest@gmail.com>" [ultimate]

~$ gpg --armor --detach-sign test.txt
File 'test.txt.asc' exists. Overwrite? (y/N) y
yanyg@pc:~/org$ cat test.txt.asc
-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEE0BqO3vjy8KO1xif3Ux7dTb+fD1sFAlseG20ACgkQUx7dTb+f
D1sCpgf/d7gh5oaQ50K6CeL6VnFNL54olDcVIaGd6Trjz0smCYuszmVZ2s2j7C0d
ScZkNVQW9yGHj7QURF8HiFfHU44bLvSSkE7H7sS4lhPI1x1EFRNziyeyL4tCQVNj
/muhyDMgAEJ+I8YBsTew5bAT3c7+EyvKACOP0HUqN0ePJFHBeN4hjzeQ+L2Tr6k4
rUETZPmRmYbEKS0Sn85J2ztQbKbHQr5VQ11UmdIsGHIM4tZuf57BBXoD0QCzPzJg
OQBs4tQZfPsC1rfVZgg8GgxhVcfCRRNOO/vtz+aiVgzIf+IIRAQnnVvj2lkpVi2E
IuSb+9CDA/f4W2VFUka8xFg/h2EBvw==
=YAAi
-----END PGP SIGNATURE-----
~$ gpg --verify test.txt.asc test.txt
gpg: Signature made Mon 11 Jun 2018 02:49:17 PM CST
gpg:                using RSA key D01A8EDEF8F2F0A3B5C627F7531EDD4DBF9F0F5B
gpg: Good signature from "yanyg <yanyg@inspur.com>" [ultimate]
~$ gpg --verify test.txt.asc test.data
gpg: Signature made Mon 11 Jun 2018 02:49:17 PM CST
gpg:                using RSA key D01A8EDEF8F2F0A3B5C627F7531EDD4DBF9F0F5B
gpg: BAD signature from "yanyg <yanyg@inspur.com>" [ultimate]

~$ gpg --recipient gpgtest --output test.txt.enc --encrypt test.txt
~$ ls -lh test.txt test.txt.enc
-rw-r--r-- 1 yanyg yanyg  11 Jun 11 14:45 test.txt
-rw-r--r-- 1 yanyg yanyg 607 Jun 11 14:53 test.txt.enc
~$ gpg --decrypt test.txt.enc
gpg: encrypted with 4096-bit RSA key, ID 9D5CD5E32EF4FC4B, created 2018-06-11
      "gpgtest (GPG test for blog) <gpgtest@gmail.com>"
plain text
~$ gpg --quiet --decrypt test.txt.enc
plain text

~$ gpg --export-secret-keys gpgtest > gpgtest.priv
# change to root
~# gpg --allow-secret-key-import --import gpgtest.priv
gpg: key 82159169CFBF69E6: public key "gpgtest (GPG test for blog) <gpgtest@gmail.com>" imported
gpg: key 82159169CFBF69E6: secret key imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
~# gpg --quiet --decrypt test.txt.enc
plain text

~$ gpg --local-user gpgtest --recipient root1 --output my.enc --sign --encrypt my.txt
# Change to root to verify & decrypt
~# gpg --quiet --decrypt my.enc