# GPG Key Management and Encryption
*Source: [dev-notes/git-setting-up-github-keys.md at main · brotherkaif/dev-notes](https://github.com/brotherkaif/dev-notes/blob/main/gpg/gpg-key-management.md)*
## Contents
- [[#Import Keys|Import Keys]]
- [[#List Keys|List Keys]]
- [[#Trust Keys|Trust Keys]]
- [[#Export Keys|Export Keys]]
- [[#Delete Keys|Delete Keys]]
- [[#Encrypt|Encrypt]]
- [[#Decrypt|Decrypt]]
- [[#Verify|Verify]]
- [[#Appendix: Links and References|Appendix: Links and References]]
## Generate Keys
```bash
gpg --full-generate-key
gpg --full-gen-key
```
Generate a new key pair with dialog for all options. This is an extended version of `--generate-key`.
## Import Keys
```bash
gpg --import KEY_FILE
```
Import/merge keys. This adds the given keys to the *keyring*. The fast version is currently just a synonym.
## List Keys
```bash
gpg --list-keys
gpg --list-secret-keys
gpg -k
```
List the specified public/private keys. If no keys are specified, then all keys from the configured public keyrings are listed.
## Trust Keys
```bash
gpg --edit-key KEY_ID
gpg> trust
```
Present a menu which enables you to do most of the key management related tasks. It expects the specification of a key on the command line.
## Export Keys
```bash
gpg --export -armor KEY_ID > KEY.pub.asc
gpg --export-secret-keys -armor KEY_ID > KEY.asc
```
Either export all keys from all keyrings (default keyrings and those registered via option `--keyring`), or if at least one name is given, those of the given name. The exported keys are written to STDOUT or to the file given with option `--output`. Use together with `--armor` to mail those keys.
## Delete Keys
```bash
gpg --delete-keys KEY_ID
gpg --delete-secret-keys KEY_ID
```
Allows you to delete keys from your system.
## Encrypt
```bash
gpg --encrypt --armor --recipient KEY_ID INPUT_FILE
gpg -ear KEY_ID INPUT_FILE
```
Encrypt data to one or more public keys. This command may be combined with:
- `--sign`: To sign and encrypt a message
- `--symmetric`: To encrypt a message that can decrypted using a secret key or a passphrase
- `--sign` and `--symmetric`: For a signed message that can be decrypted using a secret key or a passphrase
- `--recipient` and related options: specify which public keys to use for encryption
## Decrypt
```bash
# with a file
gpg --decrypt INPUT_FILE > OUTPUT_FILE
```
Decrypt the file given on the command line (or STDIN if no file is specified) and write it to STDOUT (or the file specified with `--output`). If the decrypted file is signed, the signature is also verified. This command differs from the default operation, as it never writes to the filename which is included in the file and it rejects files that don't begin with an encrypted message.
## Verify
```bash
# with a file
gpg --verify INPUT_FILE
# with a "here" file
gpg --verify << EOF
[content]
EOF
```
Will verify the signature of the message provided against a key on your system.
***
## Appendix: Links and References
- [[2022-09-04]]
- [[Git]]
- [[GPG]]
- [[GitHub]]
***
Jimmy Briggs <
[email protected]> | 2022
*Backlinks:*
```dataview
list from [[GPG Key Management and Encryption]] AND -"Changelog"
```