Table of Contents

PGP/GPG Usage Guide

This comprehensive guide covers practical usage of PGP/GPG across different platforms and applications, including key creation, encryption, decryption, and key management.

Prerequisites

Before following this guide, ensure you have:

Create PGP Key Pair

Creating a secure key pair is the foundation of PGP usage. We recommend using 4096-bit RSA keys for maximum security.

Kleopatra is the recommended tool for Windows as it supports 4096-bit RSA keys.

  1. Launch Kleopatra

    • Open Kleopatra from Start Menu or desktop shortcut

  2. Start Certificate Creation

    • Click File → New Certificate...
    • Select Create a personal OpenPGP key pair
    • Click Next

  3. Enter Personal Information

    Name: Your Name (or pseudonym for anonymity)
Email: your.email@example.com (or anonymous email)
Comment: Optional description

  4. Configure Advanced Settings

    • Click Advanced Settings...
    • In Key Material section:
      • Select RSA radio button
      • Choose 4,096 bits from dropdown
      • Set expiration date (recommended: 2-4 years)
    • Click OK

  5. Create the Key

    • Verify your information is correct
    • Click Create Key

  6. Set Passphrase

    • Enter a strong passphrase (minimum 12 characters)
    • Include uppercase, lowercase, numbers, and symbols
    • Re-enter to confirm
    • Click OK

  7. Generate Entropy

    • Move mouse randomly and type random text
    • This creates randomness for key generation
    • Process completes automatically

  8. Finish Creation

    • Click Finish when generation is complete
    • Your key pair is now ready for use

Export Public Key

Your public key needs to be shared with others for them to send you encrypted messages.

  1. Select Your Key

    • Open Kleopatra
    • Right-click your key in My Certificates tab

  2. Export Certificate

    • Click Export Certificates...
    • Choose save location
    • Filename: yourname-public.asc
    • Click Save

  3. Verify Export

    • Open the .asc file in text editor
    • Should start with -----BEGIN PGP PUBLIC KEY BLOCK-----
    • Should end with -----END PGP PUBLIC KEY BLOCK-----

Export Private Key

⚠️ SECURITY WARNING: Private keys should be exported only for backup purposes and stored securely.

  1. Select Your Key

    • Right-click your key in My Certificates tab

  2. Export Secret Key

    • Select Export Secret Keys...
    • Choose secure location (encrypted drive recommended)
    • Check ASCII armor option
    • Enter filename: yourname-private.asc
    • Click OK

  3. Security Confirmation

    • Confirm export in dialog box
    • Enter your passphrase when prompted

Publish Key to Key Server

Publishing your public key to key servers makes it discoverable by others.

  1. Select Your Key

    • Right-click your key in Kleopatra

  2. Publish to Server

    • Select Publish on Server...
    • Choose key server (default is usually fine)
    • Click OK

  3. Verify Publication

    • Search for your key on key server to confirm

Import Public Keys

Before encrypting messages for others, you need their public keys.

  1. Import from File

    • Click File → Import Certificates...
    • Browse to .asc file containing public key
    • Click Open

  2. Import from Clipboard

    • Copy public key text to clipboard
    • Click File → Import Certificates from Clipboard

  3. Verify Import

    • Check Other Certificates tab
    • Imported key should be listed

Encrypt Messages

Encryption ensures only the intended recipient can read your message.

  1. Prepare Your Message

    • Open Notepad or text editor
    • Type your message
    • Select all text and copy (Ctrl+C)

  2. Encrypt via System Tray

    • Right-click Kleopatra icon in system tray
    • Navigate to Clipboard → Encrypt...

  3. Select Recipients

    • Click Add Recipient...
    • Switch to Other Certificates tab
    • Select recipient's public key
    • Click OK

  4. Complete Encryption

    • Verify recipient is listed
    • Click Next
    • Encryption completes automatically

  5. Send Encrypted Message

    • Encrypted text is now in clipboard
    • Paste (Ctrl+V) into email, chat, or any application
    • Send to recipient

Decrypt Messages

Decryption requires your private key and passphrase.

  1. Copy Encrypted Message

    • Select entire encrypted message block
    • Include -----BEGIN PGP MESSAGE----- and -----END PGP MESSAGE-----
    • Copy to clipboard (Ctrl+C)

  2. Decrypt via System Tray

    • Right-click Kleopatra icon in system tray
    • Navigate to Clipboard → Decrypt/Verify...

  3. Enter Passphrase

    • Enter your private key passphrase
    • Click OK

  4. View Decrypted Message

    • Decrypted text is copied to clipboard
    • Paste into text editor to read
    • Message is also displayed in verification window

Sign Messages

Digital signatures provide authentication and integrity verification.

  1. Prepare Message

    • Create message in text editor
    • Copy message to clipboard

  2. Sign Message

    • Right-click Kleopatra system tray icon
    • Select Clipboard → Sign...
    • Choose your signing key
    • Enter passphrase
    • Click OK

  3. Send Signed Message

    • Signed message is in clipboard
    • Paste into email or communication method

Verify Signatures

Signature verification confirms message authenticity and integrity.

  1. Copy Signed Message

    • Include entire message with signature blocks
    • Copy to clipboard

  2. Verify Signature

    • Right-click Kleopatra system tray icon
    • Select Clipboard → Decrypt/Verify...

  3. Review Results

    • Verification window shows signature status
    • Green checkmark indicates valid signature
    • Red X indicates invalid or missing signature

Key Management

Trust Levels

Understanding and setting appropriate trust levels is crucial for PGP security.

Trust Levels Explained:

  • Unknown: No trust information
  • None: Explicitly marked as not trusted
  • Marginal: Some confidence in key ownership
  • Full: High confidence in key ownership
  • Ultimate: Your own keys

  1. Access Key Properties

    • Right-click on key
    • Select Details...

  2. Change Trust Level

    • Click Change Owner Trust...
    • Select appropriate trust level
    • Click OK

Best Practices

Security Recommendations

  1. Strong Passphrases

    • Minimum 12 characters
    • Include uppercase, lowercase, numbers, symbols
    • Consider using passphrases instead of passwords

  2. Key Size

    • Use 4096-bit RSA keys minimum
    • Consider Ed25519 for new keys (newer algorithm)

  3. Key Expiration

    • Set expiration dates (2-4 years recommended)
    • Regularly extend or replace keys

  4. Backup Strategy

    • Create secure backups of private keys
    • Store revocation certificates safely
    • Test backup restoration periodically

Operational Security

  1. Key Verification

    • Always verify key fingerprints through secure channels
    • Use multiple verification methods when possible

  2. Software Updates

    • Keep PGP software updated
    • Monitor security advisories

  3. Environment Security

    • Use secure, updated operating systems
    • Avoid public/shared computers for key operations
    • Consider using dedicated hardware for key generation

Common Mistakes to Avoid

  1. Weak Passphrases: Using dictionary words or personal information
  2. Unverified Keys: Trusting keys without proper verification
  3. Insecure Backups: Storing private keys without encryption
  4. Key Reuse: Using same keys across multiple identities
  5. Outdated Software: Using vulnerable PGP implementations

Troubleshooting

Common Issues

Error: "No public key"

# Solution: Import recipient's public key
gpg --keyserver hkps://keys.openpgp.org --search-keys recipient@example.com

Error: "Bad passphrase"

  • Verify caps lock status
  • Try typing passphrase in text editor first
  • Check for special character issues

Error: "Key expired"

# Check key expiration
gpg --list-keys

# Extend expiration if it's your key
gpg --edit-key your.email@example.com

GPG Agent Issues

# Restart GPG agent
gpgconf --kill gpg-agent
gpgconf --launch gpg-agent

This comprehensive usage guide should cover all essential PGP/GPG operations across different platforms and interfaces.

Edit this page