Neatly managing and handling PGP/GnuPG keyrings

Reading the Keyring

As already discussed, you can group several keys together during everyday use with the help of a keyring. GnuPG maintains separate files for public and private keys, each ending with the .gpg suffix. The pubring.gpg file contains the keyring with the public keys, and the secring.gpg file encompasses the private keys. You can visually display the content of the keyring of public keys (Listing 3) with the gpg -k command (long option, --list-public-keys). The secret keys use the equivalent -K or --list-secret-keys.

Listing 3

Displaying Public Keys


Validating Keys

GnuPG has two ways to validate the key: the --edit-key [17] and --check-sigs switches. To use either, you also need the name of the key you want to check.

For --edit-key, GnuPG clarifies whether a suitable secret key exists and opens a shell in which you can make modifications to the key with GnuPG-specific commands. Checking for validity is the only thing of interest here, meaning that the check command comes into play. In Listing 4, the readout shows that the key is valid.

Listing 4

Opening a GPG Shell


In the second, shorter call in Listing 5, GnuPG identifies an expired key. In the readout, the program signals the status of the check with a flag directly following the sig text. The exclamation point indicates a successful validation, a minus sign a bad signature, and a percentage sign an error that arose during validation.

Listing 5

Checking Keys


To check the whole keyring, call up GnuPG again with the --check-sigs switch. Do not designate a specific key name this time, however, and you will receive an overview of the status of all the keys on the keyring.

Updating the Local Keyring

Keys already received can expire or be revoked, expanded, or modified by the owner. To update one of several entries in the local keyring, GnuPG has the --refresh-keys switch. If you designate a key name, the tool only updates that one; otherwise, it works for all existing entries in the keyring (Listing 6). In this context, a signature means that another user has signed and so confirmed the key.

Listing 6

Refreshing Keys


Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Encrypting Email

    The leading email applications include new features for helping users secure and authenticate their mail messages, but each tool has a different approach to handling tasks such as signing and encryption. This article describes how to add encryption and digital signatures to the Thunderbird, Kmail, and Evolution mail clients.

  • Security Lessons: Checking Signatures

    How to avoid malicious code on Linux.

  • Enigmail

    Combining the Enigmail add-on and the GnuPG encryption software gives Thunderbird users a powerful tool for encrypting and signing email.

  • Follow the Money

    Looking for software to help you manage your money? The personal finance program KMyMoney can help you track income and expenses and better plan your financial future.

  • Thunderbird Security

    Thunderbird offers several options for secure email, and the GnuPG-based Enigmail encryption add-on provides an additional layer of protection.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More