Reading the Keyring

As already discussed, you can group several keys together during everyday use with the help of a keyring. GnuPG maintains separate files for public and private keys, each ending with the .gpg suffix. The pubring.gpg file contains the keyring with the public keys, and the secring.gpg file encompasses the private keys. You can visually display the content of the keyring of public keys (Listing 3) with the gpg -k command (long option, --list-public-keys). The secret keys use the equivalent -K or --list-secret-keys.

Validating Keys

GnuPG has two ways to validate the key: the --edit-key [17] and --check-sigs switches. To use either, you also need the name of the key you want to check.

For --edit-key, GnuPG clarifies whether a suitable secret key exists and opens a shell in which you can make modifications to the key with GnuPG-specific commands. Checking for validity is the only thing of interest here, meaning that the check command comes into play. In Listing 4, the readout shows that the key is valid.

In the second, shorter call in Listing 5, GnuPG identifies an expired key. In the readout, the program signals the status of the check with a flag directly following the sig text. The exclamation point indicates a successful validation, a minus sign a bad signature, and a percentage sign an error that arose during validation.

To check the whole keyring, call up GnuPG again with the --check-sigs switch. Do not designate a specific key name this time, however, and you will receive an overview of the status of all the keys on the keyring.

Updating the Local Keyring

Keys already received can expire or be revoked, expanded, or modified by the owner. To update one of several entries in the local keyring, GnuPG has the --refresh-keys switch. If you designate a key name, the tool only updates that one; otherwise, it works for all existing entries in the keyring (Listing 6). In this context, a signature means that another user has signed and so confirmed the key.