Neatly managing and handling PGP/GnuPG keyrings

Reading the Keyring

As already discussed, you can group several keys together during everyday use with the help of a keyring. GnuPG maintains separate files for public and private keys, each ending with the .gpg suffix. The pubring.gpg file contains the keyring with the public keys, and the secring.gpg file encompasses the private keys. You can visually display the content of the keyring of public keys (Listing 3) with the gpg -k command (long option, --list-public-keys). The secret keys use the equivalent -K or --list-secret-keys.

Listing 3

Displaying Public Keys

 

Validating Keys

GnuPG has two ways to validate the key: the --edit-key [17] and --check-sigs switches. To use either, you also need the name of the key you want to check.

For --edit-key, GnuPG clarifies whether a suitable secret key exists and opens a shell in which you can make modifications to the key with GnuPG-specific commands. Checking for validity is the only thing of interest here, meaning that the check command comes into play. In Listing 4, the readout shows that the key is valid.

Listing 4

Opening a GPG Shell

 

In the second, shorter call in Listing 5, GnuPG identifies an expired key. In the readout, the program signals the status of the check with a flag directly following the sig text. The exclamation point indicates a successful validation, a minus sign a bad signature, and a percentage sign an error that arose during validation.

Listing 5

Checking Keys

 

To check the whole keyring, call up GnuPG again with the --check-sigs switch. Do not designate a specific key name this time, however, and you will receive an overview of the status of all the keys on the keyring.

Updating the Local Keyring

Keys already received can expire or be revoked, expanded, or modified by the owner. To update one of several entries in the local keyring, GnuPG has the --refresh-keys switch. If you designate a key name, the tool only updates that one; otherwise, it works for all existing entries in the keyring (Listing 6). In this context, a signature means that another user has signed and so confirmed the key.

Listing 6

Refreshing Keys

 

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Encrypting Email

    The leading email applications include new features for helping users secure and authenticate their mail messages, but each tool has a different approach to handling tasks such as signing and encryption. This article describes how to add encryption and digital signatures to the Thunderbird, Kmail, and Evolution mail clients.

  • Security Lessons: Checking Signatures

    How to avoid malicious code on Linux.

  • Enigmail

    Combining the Enigmail add-on and the GnuPG encryption software gives Thunderbird users a powerful tool for encrypting and signing email.

  • Follow the Money

    Looking for software to help you manage your money? The personal finance program KMyMoney can help you track income and expenses and better plan your financial future.

  • Thunderbird Security

    Thunderbird offers several options for secure email, and the GnuPG-based Enigmail encryption add-on provides an additional layer of protection.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95

News