GPG

• Also known as GNU Privacy Guard or GnuPG
• Alternative to keychain/keyring for managing your secrets

Config

• ~/.gnupg/gpg-agent.conf
  • ~/.gnupg should have 700 permissions
• default-cache-ttl ... to lock a key after the given number of seconds if unused
• max-cache-ttl ... to lock a key after the given number of seconds no matter what

Share

• Typically you will generate a secret key per account and system for decryption, and copy its public key to other places for encryption there
• gpg --full-generate-key to make a new key
  • You should specify an expiry e.g. 1 year, this can always be extended
• gpg --output payload --export ...@... to dump its public key
• gpg --import payload on a target system to import the public key
  • Then you need to trust it, see below

Migrate

• When upgrading a server for example, key material including secrets can be exported from a backup using --homedir

Shell

• gpg --edit-key ...@...
• trust to make an imported public key usable for encryption
• expire to update expiry of a secret key
  • key 1 to select the first subkey
• passwd to change the passphrase of a secret key

Agent

• gpg-connect-agent <<<help for list of commands
  • gpg-connect-agent <<<'help ...' for help on a specific command
• gpg-connect-agent <<<reloadagent to pick up new config
  • This also forgets cached passphrases
• gpg-connect-agent <<<'keyinfo --list' to check which keys (by keygrip) are currently unlocked, look for a 1
  • Note that all keys with the same passphrase are unlocked even if this shows just one of them is
  • gpg --list-secret-keys --with-keygrip to show what keygrips your secret keys have

SSH

When attempting to decrypt something on another machine via ssh this can hang and eventually timeout, presumably due to a passphrase dialog popping up there. (Perhaps caused by earlier locking the screen on that machine instead of logging out?) One solution is to set DBUS_SESSION_BUS_ADDRESS to garbage in which case gpg appears to fallback to console mode passphrase entry. A more sophisticated option is to install a custom pinentry program that delegates to pinentry-curses if ssh detected.