linux:gpg加密和解密
- 1 创建密钥
- 2 查看私钥
- 3 导出公钥
- 4 导出私钥
- 5 导入秘钥
- 5.1 公钥
- 6 公钥加密
- 7 私钥解密
创建密钥
gpg --gen-key
你要求输入一下内容,这些内容,基本英文,还是很好明白
[email protected]:~# gpg --gen-key gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. gpg: directory `/root/.gnupg‘ created gpg: new configuration file `/root/.gnupg/gpg.conf‘ created gpg: WARNING: options in `/root/.gnupg/gpg.conf‘ are not yet active during this run gpg: keyring `/root/.gnupg/secring.gpg‘ created gpg: keyring `/root/.gnupg/pubring.gpg‘ created Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) Your selection? RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) Requested keysize is 2048 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) Key does not expire at all Is this correct? (y/N) y You need a user ID to identify your key; the software constructs the user ID from the Real Name, Comment and Email Address in this form: "Heinrich Heine (Der Dichter) <[email protected]>" Real name: chenshake Email address: [email protected] Comment: You selected this USER-ID: "chenshake <[email protected]>" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O You need a Passphrase to protect your secret key. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: /root/.gnupg/trustdb.gpg: trustdb created gpg: key AEAA16F3 marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u pub 2048R/AEAA16F3 2013-10-21 Key fingerprint = B93B 05F8 9D63 5464 6DEE 6A08 EB9E D2BB AEAA 16F3 uid chenshake <[email protected]> sub 2048R/02B4038D 2013-10-21
就是上面这个过程
在这个生成密钥的过程中,有个步骤很重要,就是生成内存随机数,命令如下:
dd if=/dev/zero of=test.dbf bs=9000 count=1000k .直到生成key为止
查看私钥
# gpg -k /root/.gnupg/pubring.gpg ------------------------ pub 2048R/AEAA16F3 2013-10-21 uid chenshake <[email protected]> sub 2048R/02B4038D 2013-10-21
查看公钥
# gpg --list-keys /root/.gnupg/pubring.gpg ------------------------ pub 2048R/AEAA16F3 2013-10-21 uid chenshake <[email protected]> sub 2048R/02B4038D 2013-10-21
导出公钥
gpg -o chenshake.gpg -a --export chenshake
其中chenshake为用户ID
chenshake.gpg为导出的公钥文件
导出私钥
gpg -o chenshake-private.gpg --export-secret-keys chenshake
导入秘钥
公钥和私钥的导入,都是一样。
gpg --import filename
公钥
(另外一台机器)
当然你需要通过scp把公钥复制到远程的机器
# gpg --import chenshake.gpg gpg: directory `/root/.gnupg‘ created gpg: new configuration file `/root/.gnupg/gpg.conf‘ created gpg: WARNING: options in `/root/.gnupg/gpg.conf‘ are not yet active during this run gpg: keyring `/root/.gnupg/secring.gpg‘ created gpg: keyring `/root/.gnupg/pubring.gpg‘ created gpg: /root/.gnupg/trustdb.gpg: trustdb created gpg: key AEAA16F3: public key "chenshake <[email protected]>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)
你也可以查看到导入的公钥
# gpg --list-keys /root/.gnupg/pubring.gpg ------------------------ pub 2048R/AEAA16F3 2013-10-21 uid chenshake <[email protected]> sub 2048R/02B4038D 2013-10-21
公钥加密
一个文件,我这里是加密cobbler.ks 这个文件,加密后是 cobbler.ks.gpg文件,需要私钥才能查看。
# gpg -o cobbler.ks.gpg -er chenshake cobbler.ks gpg: 02B4038D: There is no assurance this key belongs to the named user pub 2048R/02B4038D 2013-10-21 chenshake <[email protected]> Primary key fingerprint: B93B 05F8 9D63 5464 6DEE 6A08 EB9E D2BB AEAA 16F3 Subkey fingerprint: FCCA 50DD C98D 644E 00FB 804C 4CD2 9544 02B4 038D It is NOT certain that the key belongs to the person named in the user ID. If you *really* know what you are doing, you may answer the next question with yes. Use this key anyway? (y/N) y
私钥解密
私钥查看 cobbler.ks.gpg
# gpg -o cobbler.ks -d cobbler.ks.gpg You need a passphrase to unlock the secret key for user: "chenshake <[email protected]>" 2048-bit RSA key, ID 02B4038D, created 2013-10-21 (main key ID AEAA16F3) gpg: gpg-agent is not available in this session gpg: encrypted with 2048-bit RSA key, ID 02B4038D, created 2013-10-21 "chenshake <[email protected]>"
需要你输入你当初创建秘钥的时候设置的那个密码。这个时候,你就可以查看到加密的文件。
注明:这篇文章是转载,但是说明了最重要的一个步骤!
时间: 2024-11-05 23:32:40