gpg加密和解密

linux：gpg加密和解密

• 1 建立密鑰
• 2 查看私鑰
• 3 導出公鑰
• 4 導出私鑰
• 5 導入祕鑰
  • 5.1 公鑰
• 6 公鑰加密
• 7 私鑰解密

建立密鑰

 

gpg --gen-key

你要求輸入一下內容，這些內容，基本英文，仍是很好明白

root@g140:~# gpg --gen-key
gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 
Requested keysize is 2048 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 
Key does not expire at all
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: chenshake
Email address: shake.chen@gmail.com
Comment: 
You selected this USER-ID:
    "chenshake <shake.chen@gmail.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.

gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key AEAA16F3 marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
pub   2048R/AEAA16F3 2013-10-21
      Key fingerprint = B93B 05F8 9D63 5464 6DEE  6A08 EB9E D2BB AEAA 16F3
uid                  chenshake <shake.chen@gmail.com>
sub   2048R/02B4038D 2013-10-21

就是上面這個過程

 

在這個生成密鑰的過程當中,有個步驟很重要,就是生成內存隨機數,命令以下:

dd if=/dev/zero of=test.dbf bs=9000 count=1000k .直到生成key爲止

查看私鑰

# gpg -k
/root/.gnupg/pubring.gpg
------------------------
pub   2048R/AEAA16F3 2013-10-21
uid                  chenshake <shake.chen@gmail.com>
sub   2048R/02B4038D 2013-10-21

 

查看公鑰

# gpg --list-keys
/root/.gnupg/pubring.gpg
------------------------
pub   2048R/AEAA16F3 2013-10-21
uid                  chenshake <shake.chen@gmail.com>
sub   2048R/02B4038D 2013-10-21

 

導出公鑰

gpg -o chenshake.gpg -a --export chenshake

 

其中chenshake爲用戶ID
chenshake.gpg爲導出的公鑰文件

導出私鑰

gpg -o chenshake-private.gpg --export-secret-keys chenshake

導入祕鑰

公鑰和私鑰的導入，都是同樣。

gpg --import filename

公鑰

（另一臺機器）

固然你須要經過scp把公鑰複製到遠程的機器

# gpg --import chenshake.gpg 
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/secring.gpg' created
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key AEAA16F3: public key "chenshake <shake.chen@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

 

你也能夠查看到導入的公鑰

# gpg --list-keys
/root/.gnupg/pubring.gpg
------------------------
pub   2048R/AEAA16F3 2013-10-21
uid                  chenshake <shake.chen@gmail.com>
sub   2048R/02B4038D 2013-10-21

 

公鑰加密

一個文件，我這裏是加密cobbler.ks 這個文件，加密後是 cobbler.ks.gpg文件，須要私鑰才能查看。

# gpg -o cobbler.ks.gpg -er chenshake cobbler.ks 
gpg: 02B4038D: There is no assurance this key belongs to the named user

pub  2048R/02B4038D 2013-10-21 chenshake <shake.chen@gmail.com>
 Primary key fingerprint: B93B 05F8 9D63 5464 6DEE  6A08 EB9E D2BB AEAA 16F3
      Subkey fingerprint: FCCA 50DD C98D 644E 00FB  804C 4CD2 9544 02B4 038D

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

私鑰解密

私鑰查看 cobbler.ks.gpg

# gpg -o cobbler.ks -d cobbler.ks.gpg 

You need a passphrase to unlock the secret key for
user: "chenshake <shake.chen@gmail.com>"
2048-bit RSA key, ID 02B4038D, created 2013-10-21 (main key ID AEAA16F3)

gpg: gpg-agent is not available in this session
gpg: encrypted with 2048-bit RSA key, ID 02B4038D, created 2013-10-21
      "chenshake <shake.chen@gmail.com>"

須要你輸入你當初建立祕鑰的時候設置的那個密碼。這個時候，你就能夠查看到加密的文件。

註明:這篇文章是轉載,可是說明了最重要的一個步驟!