Can I specify a public key file instead of recipient when encrypting with GPG

Question

1. Can I do something like:

   gpg --public-key my.pub  -e file.txt
   

2. If I can, any reason that I should not do that?

P/s: I think I don't need to know about the recipient because my machine only has one public key at a time.
But that key will change soon (and I can delete all the old encrypted files, so no need to keep them).

Answer 1

GnuPG does not support encrypting to a recipient specified by a key file. The key must be imported in advance, and the recipient defined with either their mail address or key ID.

I would recommend to use a cleaner approach as expected by GnuPG and hard-code either the key's fingerprint, or a user ID given by that key and import it as usual.

If you really do not want to import the key, you could do following as workaround (which actually imports the key, but to a temporary GnuPG home directory):

1. Import the key to a temporary folder, for example using

    gpg --homedir /tmp/gnupg --import my.pub
   

2. Determine the key ID of the key stored in the file:

    KEYID=`gpg --list-public-keys --batch --with-colons --homedir /tmp/gnupg | head -n1 | cut -d: -f5`
   

3. Encrypt a message to the recipient

    gpg --homedir /tmp/gnupg --recipient ${KEYID} --encrypt
   

4. Clean up temporary GnuPG home directory

    rm -f /tmp/gnupg
   

You could of course save this as a script to make using it more convenient.

Answer 2

Since GnuPG 2.1.14 there is a new option allowing to encrypt from a keyfile: --recipient-file FILENAME. It works from an binary or an ascii armored file.

Check the release notes or the dev mailing list.

Answer 3

It is possible.

TL;DR: gpg -e -f file_with_key file_to_encrypt.thing

More complete answer:

Jens' answer has not been correct for a long while now, but the information is HARD to find. as of 2023-04-26, the official GPG online man page does not even mention it, you have to execute man gpg on your machine to get to the documentation (macOS, gpg 2.4.0).

if you do this, just search for --recipient-file, and you'll read this:

 --recipient-file file
 -f     This option is similar to --recipient except that it encrypts to
        a key stored in the given file.  file must be the name of a file
        containing exactly one key.  gpg assumes that the key in this
        file is fully valid.

(again, on 2023-04-26, gpg version 2.4.0, macOS, homebrew installation)

Answer 4

It appears from reviewing your question that you're interested in encrypting using your own public key which you'd already have (my.pub in the example).

Indeed, not only is it possible, it's desirable as it serves to provide non-interactive automation of encryption. If it's YOUR public key, then you trust it implicitly and can do the following without worry:

gpg --batch --yes --trust-model always -r $GPGPUBKEYRECIPIENTEMAIL -e ./file.txt

No interactive prompts that require an answer so encryption can be scripted. NOTE: I upload my PUBLIC key to the public server I want to protect data on, keeping the PRIVATE key apart from it.

However, if you're NOT encrypting with your own key, the --trust-model always switch could be dodgy. Also note that when decrypting, you'll be prompted for a password unless you automate that of course. HTH bud- Terrence Houlahan

Answer 5

As far as I know, the recipient's public key IDs, key Validity dates, name, and email address are embedded in the GPG ASCII Armor file (GnuPG Manual )

pub  1024D/BB7576AC 1999-06-04 Alice (Judge) <[email protected]>

So using pub key file / Key ID / Name / Email to identify which public key to use should all be equivalent.

BUT I don't have access to a linux machine right now, so can't check.