Encryption and Digital Signatures using GPG (2024)

Public key crypto

Like most modern crypto systems, GPG makes use of public key methods.You can easily generate a personal keypair which consists of a privatekey and corresponding public key.

Your private key is to be kept secret and needed tosign or decrypt messages. Thecorresponding public key should be made available toanyone that needs to verify your signature, orencrypt messages which can only be decrypted byyou.

Once we have someone’s public key, we can send them secure messagesand verify their signatures. However how do we find and authenticate thepublic key of a person or server if we have not talked to thembefore?

Web of trust

The complexity in public key systems derives from authenticatingpublic keys. If we can not trust our communication channel to be safe,we can only be sure that a public key belongs to given person if it hasbeen signed by someone that we do trust.

The major difference between GPG and PKI systems (such as HTTPS) ishow we authenticate public keys. HTTPS is based on a system withCertificate Authorities (CA). Anyone can create a keypair for anydomain/personal name, however we only trust public keys which have beensigned by an official CA. This CA is typically a commercial vendor whichverifies your identity (e.g.via a copy of your passport) and then usestheir own keypair to sign a certificate containing your public key andyour personal name / email / domain.

GPG uses a different system which does not distinguish between peersand authorities. In GPG, anyone can sign another persons key. The GPGuser determines which peers they choose to trust in their personalkeyring. For new peers, the GPG software helps you figure out which ofyour current peers has verified the identity of the new peer, perhapsindirectly via a third or fourth peer, and so on: a “web of trust”.

The easiest way to exchange public keys and key signatures is via akeyserver. GPG is compatible with existing PGP key servers. Theseservers mirror each other so most keys are available on either one. Thispackage automatically retrieves keys and signatures via thegpg_recv function.

• https://pgp.mit.edu
• https://keyserver.ubuntu.com

GPG keyservers do not need HTTPS. One should only trust GPG keys onbasis of GPG signatures, regardless of how they were obtained. For thisreason it is also valid to share GPG public keys via e.g.a website oremail.

Generate keys

Use gpg_keygen() to generate a new public privatekeypair:

(mykey <- gpg_keygen(name = "Jerry", email = "[email protected]"))

[1] "4873903B49318AEE"

gpg_list_keys()

 id name email1 4873903B49318AEE Jerry [email protected]

Import from keyserver

Use the gpg_recv function to download a given key andall available signatures for this key from a keyserver. For examplelet’s import the public key from Michael Rutter which is used to sign the Ubuntur-base packages from CRAN:

gpg_recv(id ="51716619E084DAB9")

Searching: https://keyserver.ubuntu.com

 found imported secrets signatures revoked 1 1 0 0 0 

(keyring <- gpg_list_keys())

 id name email1 4873903B49318AEE Jerry [email protected] 51716619E084DAB9 Michael Rutter [email protected]

Note that for imported keys, we do not have the private key:

(secring <- gpg_list_keys(secret = TRUE))

 id name email1 4873903B49318AEE Jerry [email protected]

Import from file

The gpg_import function reads an armored GPG key from afile or URL:

gpg_import("https://stallman.org/rms-pubkey.txt")

 found imported secrets signatures revoked 1 1 0 0 0 

However this file does not contain any signatures for this key. If weimport it from a keyserver we also get the signatures:

(rms_id <- gpg_list_keys("rms")$id)

[1] "2C6464AF2A8E4C02"

gpg_recv(rms_id)

Searching: https://keyserver.ubuntu.com

 found imported secrets signatures revoked 1 0 0 213 0 

gpg_list_signatures(rms_id)

 id timestamp name email success1 2C6464AF2A8E4C02 2013-07-20 18:32:38 Richard Stallman [email protected] TRUE2 624DC565135EA668 2013-07-20 18:37:45 FALSE3 F05DDAE40371FCE5 2013-09-15 23:18:46 FALSE4 231696C3EAE0078A 2013-09-24 23:15:58 FALSE5 7B585B30807C2A87 2013-09-28 22:59:04 FALSE6 7CEF29847562C516 2013-09-29 04:59:53 FALSE7 520E0C8369B003EF 2013-08-20 12:31:55 FALSE8 D56E1B4C135D47A1 2013-08-29 13:36:03 FALSE9 31CC32CEF78F3EE4 2013-08-29 13:37:52 FALSE10 9439E86389D0AF41 2013-08-29 13:55:01 FALSE11 C5CFD08B22247CDF 2013-09-24 15:00:05 FALSE12 20B7283AFE254C69 2013-09-28 22:44:02 FALSE13 A866D7CCAE087291 2013-09-29 17:59:25 FALSE14 6D33FBF5B5E4C71A 2013-09-30 15:52:36 FALSE15 8916CADF8ACD372A 2013-10-02 13:17:17 FALSE16 8E549D02234CC324 2013-10-03 09:36:24 FALSE17 D605848ED7E69871 2013-10-04 11:03:23 FALSE18 758EAEC123F62336 2013-10-13 00:53:08 FALSE19 7B585B30807C2A87 2013-10-18 21:27:08 FALSE20 E4A6D8A25310523C 2013-10-23 02:53:11 FALSE [ reached 'max' / getOption("max.print") -- omitted 199 rows ]

The signature only contains the key ID of the signer. You would needto download the corresponding pubkeys to actually verify thesesignatures.

Export a key

To export our newly created public key:

str <- gpg_export(id = mykey)cat(str)

-----BEGIN PGP PUBLIC KEY BLOCK-----mDMEYoyt6BYJKwYBBAHaRw8BAQdA1aJPM7jRZaeBjSc2cQUdCYqPFDkgLXdz1lGitC374W20F0plcnJ5IDxqZXJyeUBnbWFpbC5jb20+iJkEExYKAEEWIQTy+YvjkBKI9JifzIhIc5A7STGK7gUCYoyt6AIbAwUJA8JnAAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBIc5A7STGK7m2fAQDX5icCjlIX4iG++wVPXr57iYbDP/IXsdqSWkuHehW5swD6A6ssiExyElxsOxnNHtSusth6azr1R8KtKMoQVrQZyQm4OARijK3oEgorBgEEAZdVAQUBAQdASYepxXBcFtDZNAXtWqvaU/Q0/6Ie4fggT5fU0D23bVQDAQgHiHgEGBYKACAWIQTy+YvjkBKI9JifzIhIc5A7STGK7gUCYoyt6AIbDAAKCRBIc5A7STGK7pdCAQDVBfEz8dRzxmpNySDEr1OHCstkj4ka/kj/skDFZw3gbQEAt9l+GlEhWLq6CmOkaLnfsqeIZe/HFMaP7W9fAha0xAo==KRml-----END PGP PUBLIC KEY BLOCK-----

If you also own the private key you can export this as well:

str <- gpg_export(id = mykey, secret = TRUE)cat(str)

-----BEGIN PGP PRIVATE KEY BLOCK-----lFgEYoyt6BYJKwYBBAHaRw8BAQdA1aJPM7jRZaeBjSc2cQUdCYqPFDkgLXdz1lGitC374W0AAQCDUd2YMbw49Asfh0xCidRcKwdyhRGVbX7/NQD7RgJDfA1LtBdKZXJyeSA8amVycnlAZ21haWwuY29tPoiZBBMWCgBBFiEE8vmL45ASiPSYn8yISHOQO0kxiu4FAmKMregCGwMFCQPCZwAFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQSHOQO0kxiu5tnwEA1+YnAo5SF+IhvvsFT16+e4mGwz/yF7HaklpLh3oVubMA+gOrLIhMchJcbDsZzR7UrrLYems69UfCrSjKEFa0GckJnF0EYoyt6BIKKwYBBAGXVQEFAQEHQEmHqcVwXBbQ2TQF7Vqr2lP0NP+iHuH4IE+X1NA9t21UAwEIBwAA/0W2MldJmgyIeOE5Ynq0If10SNPtBlCuAdmxEzYTow24DwmIeAQYFgoAIBYhBPL5i+OQEoj0mJ/MiEhzkDtJMYruBQJijK3oAhsMAAoJEEhzkDtJMYrul0IBANUF8TPx1HPGak3JIMSvU4cKy2SPiRr+SP+yQMVnDeBtAQC32X4aUSFYuroKY6Roud+yp4hl78cUxo/tb18CFrTECg===77cU-----END PGP PRIVATE KEY BLOCK-----

Delete a key

Delete a key from its ID or fingerprint. Let’s delete the RMSkey:

gpg_delete('2C6464AF2A8E4C02')

[1] "2C6464AF2A8E4C02"

gpg_list_keys()

 id name email1 4873903B49318AEE Jerry [email protected] 51716619E084DAB9 Michael Rutter [email protected]

Sign a file

Let’s use the private key we generated earlier to sign a file:

myfile <- tempfile()writeLines("This is a signed message", con = myfile)sig <- gpg_sign(myfile)writeLines(sig, "sig.gpg")cat(sig)

-----BEGIN PGP SIGNATURE-----iHUEABYKAB0WIQTy+YvjkBKI9JifzIhIc5A7STGK7gUCYoyt6gAKCRBIc5A7STGK7thMAP9W4h8p8whnhPVPn+9CPNJDRC6t7WsLpLay7EQMbJ9xJgD/W7/X094mCfa*gK2SLC+k9N/HueL0YfgtUuDFAp63d8gw==9pnc-----END PGP SIGNATURE-----

You can also create a signed message which includes the data itselfby setting mode to normal orclear, which is useful for email:

clearsig <- gpg_sign(myfile, mode = "clear")writeLines(clearsig, "clearsig.gpg")cat(clearsig)

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512This is a signed message-----BEGIN PGP SIGNATURE-----iHUEARYKAB0WIQTy+YvjkBKI9JifzIhIc5A7STGK7gUCYoyt6gAKCRBIc5A7STGK7ozyAP0c/Aaakyx4VSxVgP4iULVd1x/AbNqRCjSlXfaL9TgHUQEA2mUP3Ek8/hoXd57V6yfOg7ywdzuOSqHscvhqqBVX0AE==ODvd-----END PGP SIGNATURE-----

Verify a signature

The gpg_verify function will see if a signature is validfor any of the keys in the keyring:

gpg_verify("sig.gpg", data = myfile)

 fingerprint timestamp hash pubkey success1 F2F98BE3901288F4989FCC884873903B49318AEE 2022-05-24 12:05:30 SHA512 EdDSA TRUE

If the signature is in clear or normalmode, the signature file contains both the message and signature:

gpg_verify("clearsig.gpg")

 fingerprint timestamp hash pubkey success1 F2F98BE3901288F4989FCC884873903B49318AEE 2022-05-24 12:05:30 SHA512 EdDSA TRUE

Debian example

Let’s verify a Debian file. The Debian page onCRAN says the following:

Since 16th of November 2021, the buster40 and bullseye40repositories are signed with a new key with the key ID0xB8F25A8A73EACF41, fingerprint 95C0FAF38DB3CCAD0C080A7BDC78B2DDEABC47B7and user ID Johannes Ranke [email protected].

Let’s import his key so that we can verify the Releasefile, which contains checksums for all files in the repository:

# take out the spacesjohannes <- "0xB8F25A8A73EACF41"gpg_recv(johannes)

 found imported secrets signatures revoked 1 1 0 0 0 

If you don’t trust the CRAN homepage, you could check who has signedthis key. You’d need to import the corresponding peer keys for moreinformation.

gpg_list_signatures(johannes)

 id timestamp name email success1 DC78B2DDEABC47B7 2021-11-16 11:17:18 Johannes Ranke [email protected] TRUE

Now lets verify the release files:

# Verify the filelibrary(curl)

Using libcurl 7.64.1 with LibreSSL/2.8.3

curl_download('https://cran.r-project.org/bin/linux/debian/bullseye-cran40/Release', 'Release')curl_download('https://cran.r-project.org/bin/linux/debian/bullseye-cran40/Release.gpg','Release.gpg')gpg_verify('Release.gpg', 'Release')

 fingerprint timestamp hash pubkey success1 7BA040A510E4E66ED3743EC1B8F25A8A73EACF41 2022-04-26 06:51:50 SHA512 RSA TRUE

Looking good! We can trust the checksums in the Releasefile to be legitimate.

Encrypt a message

For example we want to send an email Jeroen containing top secretinformation that may not be snooped by our ISP or email provider. Firstwe import Jeroen’s public key using the ID as listed e.g.here:

jeroen <- '16C019F96112961CEB4F38B76094FC5BDA955A42'gpg_recv(jeroen)

 found imported secrets signatures revoked 1 1 0 0 0 

writeLines("Pizza delivery is on it's way!", "secret.txt")msg <- gpg_encrypt("secret.txt", receiver = jeroen)writeLines(msg, "msg.gpg")unlink("secret.txt")cat(msg)

-----BEGIN PGP MESSAGE-----hQEMA4BQ/mdnc2saAQf/S7x4bnWPte7ryuJLg0Sf320qDoqurY++pIXBqXH8pxjs6ZVux0B+QD04Oc9MmmxrqNs7srv4pExBDTFIq7kLR9jVaP4I7VbBqL33JrwqvmmEjeoQRYvyB33KKoLSE9G8aNyxe9JAAjYxmx9zWGaDhDPV790sJS9hMGpRzTv14N8rWq5XeDjPR7mIWC484LgYv/U4B8CIweVXli4YkmiBAuZTRVv7SDLnmyjXGh+ssfTUwY+b0WJ4AYL+r+6vmHDaCK5qysfabhIDVqWY7dh3V88B2i9mmYn3JH3yl0orUR5T39iPiBTcacGKN5/GYweZ1Dh2JLch4vWuHN7Xnc32nNJaARxqLyDv4sH1MxFEWkp3uJn9YN/49AJXU+8rEX84eYlCqatKDf8QnPB99vVa1X2/YLa/eksA1XphrdOT9/yR2y8KGoPA+4QDSB+1laU3QzPF1kv2r2oe5mZv=xbeq-----END PGP MESSAGE-----

Now you can safely send this message over any channel (email,twitter, etc). Nobody in the world besides Jeroen will be able todecipher this message (not even you).

Decrypt a message

Decrypting a message is just as easy. GPG will automatically find thecorrect private key from your keyring, or raise an error if you don’thave it. For example we will not be able to decrypt the message wecreated above for Jeroen

# This will error, we do not have this private keygpg_decrypt("msg.gpg")

Error: GnuPG verify signatures and decrypt message error: No secret key

To demonstrate decryption, we encrypt a message using our own keypair(for which we own the private key).

writeLines("This is a test!", "secret.txt")msg <- gpg_encrypt("secret.txt", receiver = mykey)writeLines(msg, "msg.gpg")cat(msg)

-----BEGIN PGP MESSAGE-----hF4DskhirNAetCQSAQdAlZa9W98XMeSWUJmyAr0rvSJjnOb+BgAnUWxXhoKO2lAw7VaxBMQkUGiuqAcX/Aut/yYXa+FVQcRQwHBhEyDrQE/vO7nqtAFzIpatNt6qmQ/i1FQBCQIQBAlqsccwm9Ezbz5gAx/ZuI3jz8Ee3Atjm9otwZTnGNQ2dkQRsmjumJO6mMqxy53U8cSc0jRXlbYocbYgSHltvFobo0ncz6Zf6r1147Ghkw0==jc2h-----END PGP MESSAGE-----

Decryption is simple, given that we own the secret key for themessage:

gpg_decrypt("msg.gpg")

[1] "This is a test!\n"

Sign and Encrypt

In signed encryption, also known as authenticated encryption, usescombined encryption and signing. The public key of the receiver is usedto encrypt the message, and the private key of the sender to sign themessage. This way the message is both confidential and the integrity ofthe sender can be checked and verified, only by the receiver.

msg <- gpg_encrypt("secret.txt", receiver = jeroen, signer = mykey)writeLines(msg, "msg.gpg")cat(msg)

-----BEGIN PGP MESSAGE-----hQEMA4BQ/mdnc2saAQf/ffPggKj7G/tA0Qox/kYiXFfJyjYl3kRJDD68Hi0SMWyAJLE/3EHBAAIQlwoY08/TjnosTJ1+I3YmqgA952ru27C7p+vrw1lBqXnACjVhFwZ6S761fPXNQoTzuPHwMxjwIzIZTYqR/Ruj6jNXw/CHBgnYCErblZ+AQcdGLm3ufrvQSHnaXFID43nhZbB2U4k0s3lG17Imxbz0ulrKvTMZHEkMDIkI2uy/vYz/LxccfMwn72j06DqBfoNFqeAUjCgHprKoXCk9VEfeDrjqeTsWUuifqhK8RmDpqHJpQ0arkiQ57n7k9IEXhDLmfgEtQ27UE2W8775OYdtPL2mw1n7UQtLABgGng9ZQFZ4+EvdT9uF+/mZUc2cETuDha645ZPtn5kkN4SUpofqJk4SOXVZh/5IpwFVpXjXebXDewrTLb4jRSiXKAYocJTLzKakXiv3iPMXYxPrV454/TBKqgf6oTLWagKfMTuzK2wzqSApRvpxPVPyzauU6uQiGqcM0ZQb6WkglBr93vUxBlC3pqyDwvmnQVBPIi+3iCm/RAlKn3RQxiDu14fAIhygSpCRyUG5OTKGcI41cgrpTavhEFWS1puR5Y3B/lMVruQ===beBb-----END PGP MESSAGE-----

Decrypt and Verify

If the encrypted message contains a signature, it will automaticallybe verified when the message is decrypted. The function raises an errorotherwise.

For purpose of illustrating authenticated decryption, we encrypt andsign using our own key (which usually does not make sense):

msg <- gpg_encrypt("secret.txt", receiver = mykey, signer = mykey)writeLines(msg, "msg.gpg")gpg_decrypt("msg.gpg")

[1] "This is a test!\n"attr(,"signer")[1] "F2F98BE3901288F4989FCC884873903B49318AEE"

The signer fingerprint (if any) will be added as an attribute to thedecrypted message.