Generating a GnuPG Key

Crypt_GPG does not yet support generating GnuPG keys. Generating a GnuPG key for use with Crypt_GPG is much the same as generating any other GnuPG key on a system.

Though Crypt_GPG supports specifying the keyring to use, Crypt_GPG, by default, uses the keyring of the current user. If using Crypt_GPG with a webserver such as Apache, the current user is the Apache user and the key will need to be generated as the Apache user. To do this, run the gen-key command as:

 $ sudo -u apache gpg --gen-key     

The following example walks through the process of generating a key that supports both encrypting and signing. First, run the command:

 $ gpg --gen-key   

This will display the following copyright information and a list of available key types:

 gpg (GnuPG) 1.4.6; Copyright (C) 2006 Free Software Foundation, Inc. This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the file COPYING for details. Please select what kind of key you want:    (1) DSA and Elgamal (default)    (2) DSA (sign only)    (5) RSA (sign only) Your selection? 1 DSA keypair will have 1024 bits.   

Select (1) DSA and Elgamal (default) to allow the generated key to both encrypt and sign data. This will generate a public-private key pair in the GPG keyring and prompt for the size of the encryption key:

 ELG-E keys may be between 1024 and 4096 bits long. What keysize do you want? (2048)   

Select the default value of 2048. Enter greater or fewer bits depending on how secure the encryption must be. The default value is considered safe for most applications. GnuPG then prompts for the time period over which the generated key will be valid:

 Please specify how long the key should be valid.          0 = key does not expire       <n> = key expires in n days       <n>w = key expires in n weeks       <n>m = key expires in n months       <n>y = key expires in n years Key is valid for? (0) Key does not expire at all Is this correct? (y/N) y   

Unless the key needs to expire after a certain time period (preventing subsequent decryption), a key that does not expire should be used. Next, enter the three parts of the key's user id. The first part of the user id is the real name of the person or organization that will use the key to sign or encrypt data. The second part is an email address and the third is a comment about the key. Both the email address and comment are optional:

 You need a user ID to identify your key; the software constructs the user ID from the Real Name, Comment and Email Address in this form:     "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>" Real name: Test User Email address: test@example.com Comment: test key Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o   

After entering the primary user id of the new key, the passphrase must be selected. A secret passphrase is essential to securing encrypted data. Guessable passphrases will render encryption useless. For critical data such as credit card numbers, a non-dictionary word that is at least 8 characters long is recommended.

 You need a Passphrase to protect your secret key. Enter passphrase: Repeat passphrase:   

Following the passphrase, GnuPG will gather entropy for a period to ensure the generated key uses sutitably random numbers. When enough entropy is collected the key is generated and added to the keyring:

 We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy.  ... snip ...  gpg: key DB15A2C9 marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid:    1 signed:    0 trust: 0-, 0q, 0n, 0m, 0f, 1u pub   1024D/DB15A2C9 2008-08-05       Key fingerprint = F94A F628 5725 7147 0569 F9FF E995 8292 DB15 A2C9 uid                  Test User (test key) <test@example.com> sub   2048g/6AD96F48 2008-08-05   

At this point the key is in the GnuPG keyring and ready to be used by Crypt_GPG.