首先，让我们确认一下系统。如果你是 Windows 操作系统的话，只需要下载并安装 Gpg4win 就好了，因为作者并不建议你使用 Windows 在正式的实战环节，所以默认的配置一路 Next 就可以了。安装好后，执行 gpg --version ，如果输出的内容和下面的大差不差，那么就说明你的操作并无异常。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
PS C:\Users\apple> gpg --version gpg (GnuPG) 2.4.7 libgcrypt 1.11.0 Copyright (C) 2024 g10 Code GmbH License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
那么，如果你是 Linux 系统，你的系统如果是由社区维护的，那么大概率已经带有了一个 GnuPG，因为你的包管理器需要它来实现对软件包的信任。对每个系统如何安装，在此就不多赘述了，总之，安装完成后，执行 gpg --version ，如果和下面的大差不差，也说明你成功安装了 GnuPG。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
apple@centos:~$ gpg --version gpg (GnuPG) 2.2.27 libgcrypt 1.9.4 Copyright (C) 2021 Free Software Foundation, Inc. License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
apple@centos:~$ gpg --full-gen-key # Step 0，键入命令 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) (14) Existing key from card Your selection? 1 #Step 1，输入数字选择密钥类型，我们选择最广泛的 RSA RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (3072) 4096 #Step 2，输入 RSA 密钥长度，我们直接拉满 Requested keysize is 4096 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 10y #Step 3，输入密钥过期时间，因为只要过期前我们就能修改过期时间，所以设置一个不会忽略掉的时间就可以，这里我偷懒写了10年 Key expires at Tue Nov 28 02:09:38 2034 CST Is this correct? (y/N) y #Step 4，如果上面没输错的话，这里写y表示正确
GnuPG needs to construct a user ID to identify your key.
Real name: INXINX #Step 5，这里写你的名字，可以真名可以网名，如果要上传 Keyserver 建议慎重考虑是否要自己透露真名。注意：不同于 Kleopatra，这里必须是5字符以上的名字。 Email address: [email protected]#Step 6，这里写你的邮箱，可以真的可以假的，如果要上传 Keyserver 建议慎重考虑是否需要透露真实邮箱。如果是 GitHub 使用的话，可以选择后期添加 UID，也可以这里写真实邮箱。 Comment: #Step 7，备注，可以不填 You selected this USER-ID: "INXINX <[email protected]>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o #Step 8，前面没写错就填o，这里会让你创建密码，请一定记住，不可以调过。 #Step 9，这里如果你是桌面发行版就随机大幅度晃鼠标，如果是命令行就随机扣键盘，总之就是为系统随机源增加额外的熵来更安全、也更快的生成私钥 We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: /home/apple/.gnupg/trustdb.gpg: trustdb created gpg: key 21E0EC557D72FA40 marked as ultimately trusted gpg: directory '/home/apple/.gnupg/openpgp-revocs.d' created gpg: revocation certificate stored as '/home/apple/.gnupg/openpgp-revocs.d/A707BC2D981BF018B66B62A021E0EC557D72FA40.rev' public and secret key created and signed.
A => Authentication C => Certify E => Encrypt S => Sign ? => Unknown capability sec => Secret Key ssb => Secret SuBkey pub => Public Key sub => Public Subkey
apple@centos:~$ gpg --edit-key 7D72FA40 #Step 0, 进入交互模式 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
gpg> addkey #Step 1, 为密钥对添加子密钥 Please select what kind of key you want: (3) DSA (sign only) (4) RSA (sign only) (5) Elgamal (encrypt only) (6) RSA (encrypt only) (14) Existing key from card Your selection? 4 #Setp 2, 这里，我们添加一个适用于签名(S)的 RSA 子密钥 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (3072) #Step 3, 这里，由于是 RSA 密钥，需要输入密钥长度，这里可以直接回车选择默认的长度，也可以输入一个1024到4096中间的数（比如2048）来创建不同长度的子密钥 Requested keysize is 3072 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 3y #Step 4, 这里是输入子密钥的过期时间，按情况输入即可，后续可以修改 Key expires at Tue Nov 30 15:14:36 2027 CST Is this correct? (y/N) y #Step 5, 如果信息没错的话就输入 y 然后回车 Really create? (y/N) y #Step 6, 确认是否创建，确认的话输入 y 然后回车，会提示你输入密钥库的密码。 We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy.
Create a revocation certificate for this key? (y/N) y #Step 1, 输入 y 确认创建吊销证书 Please select the reason for the revocation: # 在下面我会给这五个选项逐一翻译 0 = No reason specified # 没有标注理由 1 = Key has been compromised # 密钥已被泄漏 2 = Key is superseded # 密钥已被取代 3 = Key is no longer used # 密钥不再使用 Q = Cancel # 退出创建流程 (Probably you want to select 1 here) Your decision? 3 #Step 2, 选择你的原因，我们这里选择3，密钥不再使用 Enter an optional description; end it with an empty line: > #Step 3, 输入额外的说明，可以不填直接回车 Reason for revocation: Key is no longer used (No description given) Is this okay? (y/N) y #Step 4, 确认创建吊销证书 Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory gets access to this certificate he can use it to make your key unusable. It is smart to print this certificate and store it away, just incase your media become unreadable. But have some caution: The print system of your machine might store the data and make it available to others!
apple@centos:~/gpg-tutorial$ gpg --delete-secret-keys INXINX #Step 0, 删除私钥 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
apple@centos:~/gpg-tutorial$ gpg --delete-keys INX #Step 0, 删除密钥 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
apple@centos:~/gpg-tutorial$ gpg --delete-keys INX # 删除公钥 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
gpg: there is a secret key for public key "INX"! gpg: use option "--delete-secret-keys" to delete it first.
apple@centos:~/gpg-tutorial$ gpg --edit-key inx #Step 0, 进入密钥编辑模式 gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
Secret key is available.
sec rsa4096/21E0EC557D72FA40 created: 2024-11-29 expires: 2034-11-27 usage: SC trust: unknown validity: unknown sub rsa4096/C02468B357B3AD0E created: 2024-11-29 expires: 2034-11-27 usage: E sub rsa3072/AFF13A388E7B909B created: 2024-11-30 expires: 2027-11-30 usage: S [ unknown] (1). INXINX <[email protected]>
gpg> trust #Step 1, 修改信任等级 sec rsa4096/21E0EC557D72FA40 created: 2024-11-29 expires: 2034-11-27 usage: SC trust: unknown validity: unknown sub rsa4096/C02468B357B3AD0E created: 2024-11-29 expires: 2034-11-27 usage: E sub rsa3072/AFF13A388E7B909B created: 2024-11-30 expires: 2027-11-30 usage: S [ unknown] (1). INXINX <[email protected]>
Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) # 接下来是对信任等级的逐个翻译 1 = I don't know or won't say # 我不知道，抑或是我不想说 2 = I do NOT trust # 我坚决不信 3 = I trust marginally # 我半信半疑，适合网友 4 = I trust fully # 我完全相信，适合已经线下确认过对方的身份 5 = I trust ultimately # 我终极相信。请只用在自己的密钥上 m = back to the main menu Your decision? 5 #Step 2, 输入选择由于是自己的密钥，我们选择5，终极相信 Do you really want to set this key to ultimate trust? (y/N) y sec rsa4096/21E0EC557D72FA40 created: 2024-11-29 expires: 2034-11-27 usage: SC trust: ultimate validity: unknown sub rsa4096/C02468B357B3AD0E created: 2024-11-29 expires: 2034-11-27 usage: E sub rsa3072/AFF13A388E7B909B created: 2024-11-30 expires: 2027-11-30 usage: S [ unknown] (1). INXINX <[email protected]> Please note that the shown key validity is not necessarily correct unless you restart the program. gpg> save #Step 3, 保存密钥 Key not changed so no update needed. apple@centos:~/gpg-tutorial$ gpg -K # 查看信任情况 gpg: checking the trustdb gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: next trustdb check due at 2034-11-27 /home/apple/.gnupg/pubring.kbx ------------------------------ sec rsa4096 2024-11-29 [SC] [expires: 2034-11-27] A707BC2D981BF018B66B62A021E0EC557D72FA40 uid [ultimate] INXINX <[email protected]> # 可以发现信任等级恢复了 ssb# rsa4096 2024-11-29 [E] [expires: 2034-11-27] ssb# rsa3072 2024-11-30 [S] [expires: 2027-11-30]