GPG for Linux: A Practical Guide to Encrypting Files and Signing Data

The Danger of Plaintext Data

Sending sensitive data over the internet is like mailing a postcard. Anyone handling that card—from your ISP to a bored hacker sniffing public Wi-Fi—can read your message. Imagine your database backups or .env files, loaded with Stripe API keys, traveling across the web in plain text. If a malicious actor intercepts that traffic, your entire infrastructure is wide open.

One night, after watching my server logs fill up with thousands of SSH brute-force attempts from a single IP in Russia, I stopped taking transport security for granted. Perimeter defense is rarely enough. You have to assume your transport layers are compromised. GnuPG (GPG) solves this by protecting the data itself. Even if a file falls into the wrong hands, it remains a useless pile of encrypted bits without your specific key.

Core Concepts: How GPG Works

GnuPG follows the OpenPGP standard and relies on Asymmetric Cryptography. This system uses a pair of mathematically linked keys: a Public Key and a Private Key.

• Public Key: Think of this as an open padlock. You can hand it out to anyone. If a colleague wants to send you a secure file, they use this “lock” to secure the data.
• Private Key: This is your physical key. Keep it secret. Only this key can open the data locked by your public key.

GPG also handles Digital Signatures. This doesn’t hide the content, but it proves the file hasn’t been tampered with. It’s like a wax seal on an envelope that guarantees the sender’s identity.

Setting Up Your GPG Environment

Most Linux distributions have GPG ready to go. You can confirm you’re ready by checking the version:

gpg --version

If your system returns a “command not found” error, install it via your package manager. On Ubuntu, Debian, or Pop!_OS, run:

sudo apt update && sudo apt install gnupg -y

Generating Your Key Pair

I recommend using the --full-generate-key flag. While the default generation tool is faster, the “full” version gives you granular control over the algorithm and key strength.

gpg --full-generate-key

When the prompts appear, follow these steps:

1. Algorithm: Choose (1) RSA and RSA (default). If you prefer modern, shorter keys with faster performance, (9) ECC is an excellent alternative.
2. Key Size: Select 4096 bits. While 2048-bit keys are still common, 4096-bit RSA provides a significantly larger safety margin against brute-force advances.
3. Validity: Set an expiration date like 2y (two years). Avoid the “never expire” option for production keys. If you lose access to a key that never expires, it stays on keyservers forever as a ghost identity.
4. Identity: Use your real name and professional email. This helps colleagues find the right key.
5. Passphrase: This is your last line of defense. Use a long passphrase—think 20+ characters—rather than a simple password.

Managing Your Keys

Once the generation process finishes, you can view your new identity with a quick command:

gpg --list-keys

Exporting Your Public Key

To receive encrypted files, you must share your public key. Export it to a text file (ASCII-armored) so you can easily paste it into an email or upload it to a server:

gpg --armor --export "Your Name" > mypublickey.asc

Importing a Colleague’s Key

When a teammate sends you their key, you need to add it to your local keyring before you can send them anything secure:

gpg --import colleague_public_key.asc

Always verify the fingerprint after importing. Call your colleague or message them on a secure channel like Signal to confirm the strings match. This prevents man-in-the-middle attacks.

gpg --fingerprint "Colleague Name"

Hands-on Practice: Encrypting and Decrypting

Imagine you have a file named confidential_report.pdf. You need to get it to a teammate named Alice without anyone else seeing the contents.

Encrypting a File

Use the --encrypt flag and specify the recipient. GPG will look for Alice’s public key in your keyring.

gpg --encrypt --recipient "Alice" confidential_report.pdf

This generates confidential_report.pdf.gpg. You can now upload this to Slack, Google Drive, or an email without worrying about prying eyes.

Decrypting a File

When Alice receives the file, she runs a simple decryption command. GPG is smart enough to identify which private key is required:

gpg --decrypt confidential_report.pdf.gpg > confidential_report.pdf

She will be prompted for her passphrase before the file is unlocked.

Symmetric Encryption (The Quick Way)

If you just want to password-protect a local backup for yourself, you don’t need a public/private key pair. Use symmetric encryption instead:

gpg --symmetric backup.tar.gz

This uses the AES256 algorithm by default. Only the password you enter at the prompt can unlock the resulting .gpg file.

Ensuring Integrity with Digital Signatures

Encryption hides data, but signatures prove it hasn’t been touched. I always sign Bash scripts before distributing them to my team. This ensures no one has injected malicious code into the script during transit.

Creating a Detached Signature

A detached signature creates a tiny .sig file alongside your original file. This way, you don’t have to modify the source file itself.

gpg --detach-sign script.sh

Verifying a Signature

To check if script.sh is authentic, run:

gpg --verify script.sh.sig script.sh

If the output says “Good signature,” the file is exactly as you left it.

Hard-Earned Best Practices

I’ve seen users lose years of data because they misplaced a single file. Don’t let that be you. Follow these three rules to keep your data safe and accessible.

1. Create a Revocation Certificate Now

If your laptop is stolen, you must tell the world your key is compromised. You can’t do that if you don’t have a revocation certificate. Generate it immediately after your key pair.

gpg --output revoke.asc --gen-revoke "Your Name"

Print this file out or store it on a dedicated, encrypted USB drive kept in a physical safe.

2. Backup Your Private Key

GPG has no “Forgot Password” link. If your SSD dies and you don’t have a backup of your private key, your encrypted data is gone forever. Export it securely:

gpg --armor --export-secret-keys "Your Name" > private_key_backup.asc

3. Use Subkeys for Daily Tasks

Advanced users should keep their Master Key offline. Create “subkeys” for daily signing and encryption. If your laptop is stolen, you only revoke the subkeys, keeping your main identity intact. It’s a bit more setup, but it saves hours of headache during a security breach.

Securing Your Daily Workflow

Integrating GPG into your routine might feel clunky at first, but it quickly becomes muscle memory. Whether you are locking down server backups or signing Git commits, GPG provides a level of certainty that passwords alone cannot match. Start by generating your key pair today and encrypting a few test files. It is the most effective way to ensure your private data stays private in an era of constant data leaks.