1
0
Fork 0
knowledge-base/KB/Linux/Desktop/GPG - PGP.md

59 lines
1.5 KiB
Markdown
Raw Normal View History

2022-09-04 12:54:22 +00:00
---
creation date: 2022-01-12
tags: [note,linux,gpg,pgp]
---
## Creation
**Really, set up an expiration date, otherwise you'll end up with non-revokable keys!**
Or you do need the `revoke@example` trick which is ugly and not really revoking a key.
Generate at least 3072 bit key with an expiration date, e.g. with Seahorse or `gpg` command line tool.
## Distribution
* Use https://keys.openpgp.org (`hkps://keys.openpgp.org`) because of address validation
* SKS Pool is widely used (`hkp://eu.pool.sks-keyservers.net`) and pool syncs automatically
* https://pgp.mit.edu slow but has a lot of keys
## gpg.conf
2023-03-29 16:16:29 +00:00
```shell
2022-09-04 12:54:22 +00:00
keyserver hkp://keys.gnupg.net
keyserver hkps://keys.openpgp.org
keyserver hkp://pool.sks-keyservers.net:11371
keyserver hkp://pgp.mit.edu:11371
```
## Seahorse for GNOME
2024-12-09 19:19:31 +00:00
Search and edit with dconf `/desktop/gnome/crypto/pgp/keyservers`:
2022-09-04 12:54:22 +00:00
2023-03-29 16:16:29 +00:00
```shell
2022-09-04 12:54:22 +00:00
['hkp://keys.gnupg.net', 'hkps://keys.openpgp.org', 'hkp://pool.sks-keyservers.net:11371', 'hkp://pgp.mit.edu:11371']
```
## Export/Revoke
2023-03-29 16:16:29 +00:00
```shell
2022-09-04 12:54:22 +00:00
export MY_GPG_ID=theID
gpg --armor --output public-key.gpg --export $MY_GPG_ID
gpg --armor --output private-key.gpg --export-secret-keys $MY_GPG_ID
gpg --output revocation-certificate.asc --gen-revoke $MY_GPG_ID
# optionally revoke with generated cert
# - import public key first
# - revoke
# - sync with keyserver of your choice
# gpg --import public-key.gpg
gpg --import revocation-certificate.asc
```
## pinentry
Edit your `gpg-agent.conf` and for a modernized look of pinentry add
```shell
pinentry-program /usr/bin/pinentry-gnome3
```