GPG Keys

Download and install the GnuPG command line tools for your operating system. It is commonly advisable to install the latest version for your operating system.

Checking for existing GnuPG keys

Prior to generating a GnuPG key, check to see if you have any existing GnuPG keys.

1. Open the console.

2. Use the gpg --list-secret-keys --keyid-format=long command to display the long form of the GnuPG keys for which you have both a public and private key. Note that a private key is needed to read encrypted files (such as encrypted PCAP files that will get produced on sensors).

$ gpg --list-secret-keys --keyid-format=long

3. Verify the command output to detect if you have a GnuPG key pair.

gpg --list-secret-keys --keyid-format=long
/home/jdoe/.gnupg/pubring.kbx
------------------------------------
sec   4096R/E112110E159CAAF7 2020-01-01 [expires: 2025-01-01]
uid                          John Doe 
ssb   4096R/B190940F788985D2 2020-01-01

• If there are no GnuPG key pairs, simply generate a new GnuPG key.

4. From the list of GnuPG keys, copy the long form of the GnuPG key ID that you would like to use. For this example, the GnuPG key ID is E112110E159CAAF7:

gpg --list-secret-keys --keyid-format=long
/home/jdoe/.gnupg/pubring.kbx
------------------------------------
sec   4096R/E112110E159CAAF7 2020-01-01 [expires: 2025-01-01]
uid                          John Doe 
ssb   4096R/B190940F788985D2 2020-01-01

5. Paste the text below, replacing with the GnuPG key ID that you would like to use. For this example, the GnuPG key ID is E112110E159CAAF7:

$ gpg --armor --export `E112110E159CAAF7`
# Prints the GPG key ID, in ASCII armor format

6. Copy your GnuPG key, starting with -----BEGIN PGP PUBLIC KEY BLOCK----- and ending with -----END PGP PUBLIC KEY BLOCK-----.

7. Write the GnuPG key to a file, and upload this file in the proper Analytics setting panel.

Generating a new GnuPG key

If you don't already have a GnuPG key, you can generate a new GnuPG key and seen next.

Generating a GnuPG key

1. Open the console.

2. Generate a GnuPG key pair. Because there are numerous GnuPG versions, you may have to refer to the applicable man page in order to locate the relevant key generation command. Note that the key must use RSA.

• If you are on version 2.1.17 or greater, paste the text below in order to generate a GnuPG key pair.

$ gpg --full-generate-key

• If you are not on version 2.1.17 or greater, the gpg -full-generate-key command will not work. Simply paste the text below and then jump to step 5.

$ gpg --default-new-key-algo rsa4096 --gen-key

3. Once at the prompt, determine the kind of key you would like, or simply press Enter to accept the default.

4. At the prompt, determine the key size that you would like, or press Enter to accept the default. Note that your key must be 4096 bits at the minimum.

5. Enter the length of time the key should be valid. Press Enter to specify the default selection and signify that the key does not expire.

6. Validate that your selections are accurate.

7. Enter your user ID information.

8. Create a secure passphrase.

9. Use the gpg --list-secret-keys --keyid-format=long command in order to list the long form of the GnuPG keys for which you have both a public and private key.

$ gpg --list-secret-keys --keyid-format=long

10. From the list of GnuPG keys, copy the long form of the GnuPG key ID that you would like to use. For this example, the GnuPG key ID is E112110E159CAAF7:

gpg --list-secret-keys --keyid-format=long
/home/jdoe/.gnupg/pubring.kbx
------------------------------------
sec   4096R/E112110E159CAAF7 2020-01-01 [expires: 2025-01-01]
uid                          John Doe 
ssb   4096R/B190940F788985D2 2020-01-01

11. Paste the text below, replacing with the GnuPG key ID that you would like to use. For this example, the GnuPG key ID is E112110E159CAAF7:

$ gpg --armor --export `E112110E159CAAF7`
# Prints the GPG key ID, in ASCII armor format

12. Copy your GnuPG key, starting with -----BEGIN PGP PUBLIC KEY BLOCK----- and ending with -----END PGP PUBLIC KEY BLOCK-----.

13. Write the GnuPG key to a file, and upload this file in the proper Analytics setting panel.

Adding a new GnuPG key to (relevant setting panel in the UI)

TBD