Using GPG to securely send a message

18 Nov 2015 in TIL

As part of my new found commitment to security, I've been generating new SSH keys for my various different identities. One of these involved sending my public key to a coworker so that it could be rolled out to all of our infrastructure. As Gareth is a bit of a security nut (Hi Gareth!), I opted to encrypt the message with his GPG key, so that he's the only person that can read it.

Firstly, I needed to find his public key. To do this, I searched on the public gpg key server for his email address and found his key on there.

pub  4096R/DE731050 2014-01-15
Fingerprint=648A D02C B24B FE36 D601  C976 AD43 71CA DE73 1050

Once I had his key, I needed to import it locally. To do this, I used gpg --recv-keys like so:

bash
$ gpg --recv-keys DE731050
gpg: requesting key DE731050 from hkp server keys.gnupg.net
gpg: DBG: locking for `/home/michael/.gnupg/pubring.gpg.lock' done via O_EXCL
gpg: DBG: locking for `/home/michael/.gnupg/secring.gpg.lock' done via O_EXCL
gpg: DBG: locking for `/home/michael/.gnupg/trustdb.gpg.lock' done via O_EXCL
gpg: key DE731050: public key "Gareth Llewellyn (Only accepts TLS protected SMTP connections) <[email protected]>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

To check that it was imported correctly, I used gpg --list-keys

bash
$ gpg --list-keys
gpg: DBG: locking for `/home/michael/.gnupg/trustdb.gpg.lock' done via O_EXCL
/home/michael/.gnupg/pubring.gpg
--------------------------------
pub   2048R/F4489F24 2014-08-19
uid                  Michael Heap <[email protected]>
sub   2048R/5C14441F 2014-08-19
pub   4096R/DE731050 2014-01-15
uid                  Gareth Llewellyn (Only accepts TLS protected SMTP connections) <[email protected]>
uid                  Gareth Llewellyn <[email protected]>
sub   4096R/7D63EE1B 2014-01-15

I realised that I haven't yet signed this key, so I signed it

bash
gpg --sign-key DE731050

Then I used gpg to encrypt the message in a text format

bash
gpg --armor --output FooBar.txt.gpg --encrypt --recipient [email protected] FooBar.txt

Then, I took the contents of FooBar.txt.gpg and emailed it to Gareth, and (hopefully) he'll be able to decrypt it and roll out my new key.

If you're interested, here's what the encrypted message looks like: