| From: https://kb.iu.edu/d/awio 或者: http://www.hellopp.cn/page/5b99c5311d266bd4494282ea GNU Privacy Guard (GPG, also GnuPG) is free encryption software that's compliant with the OpenPGP (RFC4880) standard. Using GPG you can encrypt (and decrypt) files that contain sensitive data, such as protected health information (PHI) regulated by the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules. For more on GPG, see the GNU Privacy Guard website. At Indiana University, GPG is installed as a command-line application in the default user environments on Big Red II, Carbonate, and Karst. To use GPG, you create a unique encryption key, and then use that key to encrypt and decrypt your files. If you need help using GPG on IU's research computing systems, contact the UITS Scientific Applications and Performance Tuning (SciAPT) team. On this page:
Creating an encryption key To create a unique key for encrypting and decrypting files with GPG:
- Make sure
gpg-agent is running; on the command line, enter:
gpg-agent -s --daemon --write-env-file --use-standard-socket You will see something like the following (in which username is your Network ID username and Machine is the name of the system): GPG_AGENT_INFO=/N/u/username/Machine/.gnupg/S.gpg-agent:22743:1; export GPG_AGENT_INFO; 這是gpg-agent沒有運行的時候作的, 一般安裝完之後會自動運行了,就不用這一步了,執行一下也沒有關係,會給出提示gap-agen已經運行了.
- On the command line, enter:
- You will see something like the following (in which
username is your Network ID username and Machine is the name of the system):
gpg --gen-key gpg (GnuPG) 2.0.14; Copyright (C) 2009 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. gpg: keyring `/N/u/username/Machine/.gnupg/secring.gpg' created gpg: keyring `/N/u/username/Machine/.gnupg/pubring.gpg' created Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) Your selection? Enter 1 to select the default key.
- GPG will prompt you to choose a keysize (in bits). Enter
1024.
You will see: Requested keysize is 1024 bits Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) Enter a value to specify how long the key should remain valid (e.g., 2 for two days, 3w for three weeks, 10mfor 10 months, or 0 for no expiration date).
- GPG will prompt you to confirm the expiration date. If the correct date is displayed, enter
y.
- GPG will prompt for information it will use to construct a user ID to identify your key. At the prompts, enter your name, email address, and a comment.
- GPG will prompt you to confirm or correct your information. You'll see a prompt something like this:
- If the information displayed is correct, enter
o to accept the user ID. To correct errors or quit the process, enter the appropriate alternative ( n , c , e, or q ).
- If you accept the user ID, GPG will prompt you to enter and confirm a password. Afterward, GPG will begin generating your key. You'll see:
You selected this USER-ID: "Full Name (comment) <username@iu.edu>" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. This process may take several minutes to complete. When it's finished, you will see something like: gpg: key 09D2B839 marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 4 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 4u gpg: next trustdb check due at <expiration_date> pub 1024R/09D2B839 2013-06-25 [expires: <expiration_date>] Key fingerprint = 6AB2 7763 0378 9F7E 6242 77D5 F158 CDE5 09D2 B839 uid Full Name (comment) <username@indiana.edu> sub 1024R/7098E4C2 2013-06-25 [expires: <expiration_date>] You can now use the key (until it expires) to encrypt files in your account (for instructions, see the next section). 我執行2-9步的時候,只要求輸入名字和郵箱, 而後會彈出對話框讓輸入密碼,應該就是所謂的私鑰. 而後就提示文件已經建立成功了以及文件所存的路徑,是一個rev文件,打開會,裏面存的是公鑰. Back to top Encrypting a file To encrypt a file using a GPG key you created, on the command line, enter (replace user_id with the email address you specified when you created the key and my_file with the name of the file to encrypt): gpg -e -r user_id my_file GPG will create an encrypted version of the file you specified; the encrypted file will have a .gpg file extension (e.g., my_file.gpg). After confirming the encrypted version has been created, you can delete the original unencrypted file. 這裏輸入的user_id就是建立key的時候輸入的郵箱. 建立出來的加密文件是原有的文件名加上.gpg Back to top Decrypting a file To decrypt a .gpg file (e.g., my_file.gpg), on the command line, enter: gpg my_file.gpg GPG will prompt you for the password associated with the key you used to encrypt the file. When you enter the correct password, GPG will recreate the original, unencrypted version of the file (e.g., my_file). This process does not delete or alter the encrypted version of the file (my_file.gpg). 執行這個命令的時候會彈出建立key的時候要求你輸入的密碼,這個應該就是所謂的私鑰. Back to top Related documents Useful GPG commands This is document awio in the Knowledge Base.
Last modified on 2017-12-12 15:08:56. |