valmis@dicarlo:~$
ES | EN
← Back to All Writeups

OpenPGP and GnuPG in Practice: Cryptographic Sovereignty, Signatures, and Secrets Management

📅 ⏱ 3 min read (413 words)
#openpgp #gnupg #gpg #cryptography #privacy #digital-signatures #git

In an ecosystem dominated by walled-garden messaging platforms, cloud-managed corporate keys, and centralized Certificate Authorities (CAs), OpenPGP (standardized in RFC 4880 and refreshed in RFC 9580) remains the most mature, decentralized standard for peer-to-peer authenticity, integrity, and confidentiality.

Through its reference open-source implementation, GnuPG (Gnu Privacy Guard / gpg), engineers and organizations can establish sovereign cryptographic identities independent of any third party.

1. The Three Cryptographic Pillars of OpenPGP

+-------------------------------------------------------------------------------+
|                        CORE OPENPGP OPERATIONS                                |
+-------------------------------------------------------------------------------+
|                                                                               |
|   1. CONFIDENTIALITY (Encryption):                                            |
|      Plaintext + Recipient's Public Key        --->  Ciphertext (.asc)        |
|                                                                               |
|   2. INTEGRITY & NON-REPUDIATION (Digital Signature):                         |
|      Document / Binary + Your Private Key      --->  Digital Signature (.sig) |
|      (Anyone with your Public Key can mathematically verify authenticity)     |
|                                                                               |
|   3. AUTHENTICATION:                                                          |
|      Cryptographic challenge-response for SSH login or secure sessions        |
|                                                                               |
+-------------------------------------------------------------------------------+

2. Essential Engineering Use Cases

A. Signing Git Commits and Releases

Git commit author metadata can be trivially spoofed. Cryptographically signing commits with GPG (git commit -S) proves mathematically that changes originated from you:

git config --global user.signingkey 88CE0017C5623596B9E1FE81CE0C3FD2AD58CD23
git config --global commit.gpgsign true
git config --global tag.gpgSign true

B. Verifying Operating System Images and Packages

Verifying detached signatures (.asc / .sig) before deploying OS images (OpenBSD, Debian) protects against malicious mirrors and man-in-the-middle tampering:

gpg --verify checksums.txt.asc checksums.txt

C. Password and Secrets Management with pass

The standard UNIX password manager (pass) uses GPG to encrypt individual password files inside ~/.password-store/, protected by your master private key and passphrase.

3. Essential GnuPG Command Reference

1. Generate a Key Pair

gpg --full-generate-key

2. Inspect Fingerprint and Key ID

gpg --fingerprint valmis@dicarlo.cc

3. Export ASCII Armored Public Key

gpg --armor --export valmis@dicarlo.cc > valmis.pub.asc

4. Encrypt and Decrypt Files

  • Encrypt: 
    gpg --armor --encrypt --recipient user@example.com audit_report.pdf
  • Decrypt: 
    gpg --decrypt audit_report.pdf.asc > audit_report.pdf

5. Detached Signatures

gpg --armor --detach-sign release-bundle.tar.gz
gpg --verify release-bundle.tar.gz.asc release-bundle.tar.gz

4. Operational Security Best Practices

  1. Generate a Revocation Certificate: 
    gpg --output revoke-valmis.asc --gen-revoke valmis@dicarlo.cc
  2. Use Dedicated Subkeys: Keep the Master Certification Key ([C]) offline and deploy subkeys for Signing ([S]), Encryption ([E]), and Authentication ([A]).
  3. Hardware Storage (Smartcards / YubiKeys): Moving private subkeys to a cryptographic smartcard ensures the private material never enters host RAM.