PGP for the Working Dev (2)
Tags: bash, linux, pgp, commandline
Published: 2021-06-10 02:29:11



The goal of this post is to get you up to speed on two of the main uses of GPG: cryptographically encrypting and decrypting data.

> Note: this post is the second in a 2-part series aimed at developing a functional use of GPG for the day-to-day tasks of anyone who cares about software. Check out [Part 1](https://dev.to/thunderbiscuit/pgp-for-the-working-dev-1-4f4g) to learn about signing and verifying signatures.

One important aspect of cryptographic keys is that they are _simply numbers_. They are often really, really big numbers, but simple integers nonetheless. Another important aspect of cryptographic keys as used in GPG is that they come in pairs: a _public_ key and a _private_ key. Knowledge of these numbers (the keys) allows us to perform many tasks, two of which we'll tackle here:

1. Encrypt a message in a way that only a person with the knowledge of a specific key could decrypt.
2. Decrypt a message that was encrypted for a private key you own.

> There is much more to learn about privacy, encryption, and GPG than I cover in this series; for information on who invented this whole thing in the first place, check out [Phil Zimmermann's Wikipedia page](https://en.wikipedia.org/wiki/Phil_Zimmermann); for more on the difference between GPG and PGP, check out [this article](https://www.goanywhere.com/blog/2013/07/18/openpgp-pgp-gpg-difference); to dig deeper into the specifics of GPG, check out [their docs](https://gnupg.org/).

## Priors

If you are coming to this article without having read [Part 1](), you should go and read the _Priors_ section there. If you have already set up `gpg`, created a key, exported it, and imported other people's keys, you can safely move on to [Task 3]() on encrypting messages.

## Task 3: Encrypting Messages

You can encrypt a message addressed to a specific recipient using their public key if it is in your keyring. For information on how to export your public key in order to share it with others as well as information about how to import other people's public keys, check out [Task 1 from Part 1](https://dev.to/thunderbiscuit/pgp-for-the-working-dev-2-2ol1) of this series.

To encrypt the file `message.txt` in a way that only Morpheus will be able to decrypt it, we first check that his key in our keyring, then use the `--encrypt` command like so:

```shell
# check for the recipient's info in your keyring
# the second key here is our friend Morpheus' key we just imported
$ gpg --list-keys
pub   rsa1024 2019-09-14 [SC]
      0E94A26389C660DFE8C2F31705D085D9893479A7
uid           [ultimate] MrAnderson <MrAnderson@email.com>
sub   rsa1024 2019-09-14 [E]

pub   rsa1024 2019-09-14 [SC]
      5F357B756A571BF8A88567AF06898DFB48E3D899
uid           [ full ] Morpheus <morpheus@email.com>
sub   rsa1024 2019-09-14 [E]

# produce the encrypted file message.txt.asc
$ gpg --encrypt --armor -r Morpheus message.txt
```

Always make sure that the public key you use to encrypt is genuine! Call the person, verify on multiple channels, or message them on another encypted platform first before using their public key to encrypt a message. Note that you can enrypt a message to multiple public keys, but that will show up when people decrypt it (in other words you could not fake that a message was encrypted _only_ for someone when in fact it was also encrypted for someone else at the same time).

## Task 4: Decrypting Messages

Upon getting the encrypted file, our friend Morpheus could decrypt its content using

```shell
# print message to console
gpg --decrypt message.txt.asc

# send message to file
gpg --decrypt message.txt.asc > decryptedMessage.txt
```

And that's it. There is much more to this little piece of software than explored in these two articles, so go ahead and type `gpg --help`!