The SKS keyserver network is under attack. The operators of the keyserver network recommend that you do not retrieve keys from the keyserver network.
Creating your GnuPG keys
By default, when you make your PGP keys, GnuPG creates a primary key with Certify and Signing [CS] capabilities and also creates a subkey with Encryption [E] capabilities. The problem with this is if your primary key ever gets stolen or lost you’ll have to revoke and recreate your keys. When you revoke your primary key you lose all the trust and reputation you’ve gained and you’ll also have to get everyone to import your new primary key. So what we’ll do is create a primary key with Certify [C] capabilities only, and then create subkeys for Encryption [E]and Signing [S]. We’ll then remove the primary key from the keyring and back it up off-line. This way if your keys get stolen, your master key is safe and you can simply revoke and regenerate the subkeys while keeping your primary key and your reputation.
Create your primary/certify key.
This key will then be used to create your encryption, signing and auth subkeys.
gpg --quick-gen-key "Chris Stevens <email@example.com>" ed25519 cert 90d
You’ll be asked for a passphrase, then be asked to re-enter your passphrase. You’ll see the following output:
pub ed25519 2020-12-26 [C] [expires: 2021-03-26] C13718F25749550B6504106ADF12A17CFEA01E81 uid Chris Stevens <firstname.lastname@example.org>
Grab the fingerprint of the primary key. This is the 40 character string that shows up just under the “pub” output
Create a subkey for encryption
gpg --quick-add-key [fpr] cv25519 encr 90d
Create a subkey for signing
gpg --quick-add-key [fpr] ed25519 sign 90d
Optionally, create subkeys for auth
This will allow you to use GPG keys for authentication for SSH, though I haven’t played with this yet.
gpg --quick-add-key [fpr] ed25519 auth 90d
List fingerprints of all keys
gpg --with-subkey-fingerprints --list-key email@example.com
Set key expiration
You can always change the length of the key expirations. For example, to change primary key expiration:
gpg --quick-set-expire [fpr] 180d # or 6m or 1y or 52w
Set expiration of all subkeys.
gpg --quick-set-expire [fpr] 6m \*
Set expiration of a specific subkey
gpg --quick-set-expire [fpr] 26w [subfpr]
Add additional UID’s
You can add additional names and e-mail addresses to your key:
gpg quick-add-uid firstname.lastname@example.org "Chris Stevens <email@example.com>"
To edit your key information using the gpg ‘shell’, simply:
gpg --edit-key [fpr]
Export your keys
gpg --export-secret-key --armor [fpr] gpg --export --armor [fpr]
Send your keys to a keyserver
The PGP keyservers are a hot mess. However there is a keyserver out there that you can publish your keys to that’s not part of the regular keyserver pool and is not affected by the same exploits. There are some limitations. You can’t see who’s signed your or other peoples keys, so the whole “web of trust” model is broken, but you can at least find keys if you know the fingerprints, or you can search by e-mail if you’ve explicitely allowed keys.openpgp.org to display your e-mail address.
gpg --keyserver keys.openpgp.org --send-key [fpr]|[keyid]
WKD - Web Key Discovery
This is a way of publishing keys for users of your domain without using the public keyservers. To publish all e-mail addresses from pwned.com to a WKD database:
mkdir -p .well-known/openpgpkey && cd .well-known gpg --list-options show-only-fpr-mbox -k @pwned.com | /usr/lib/gnupg/gpg-wks-client -v --install-key
The .well-known directory needs to be published at openpgpkey.yourdomain.com. I used gitlab pages for this. I created a CNAME record for openpgpkey.pwned.com and pointed it to chrisstevens.gitlab.io. You’ll need to create an SSL cert for the openpgpkey subdomain.
Test Web Key Discovery
gpg -v --no-default-keyring --keyring /tmp/gpg-$$ --auto-key-locate clear,wkd --locate-keys firstname.lastname@example.org
Encrypt a file to a recipient
gpg -er <recipient> <filename>
Key / Subkey revocation