1

I find PGP to be quite a complex subject. I have gotten to a point where I need to give a client a public key for encryption. I have successfully done my homework, generating a public key from my Ubuntu desktop pushed it to keyserver.ubuntu.com, gotten a validation link, hustled to get Thunderbird open, read it, and validated it.

Now I need to send a public key of an ubuntu 10.04 to a partner to encrypt stuff for me. I opted for using a keyserver as opposed to outputting the public key to a file. If I publish the key like explained before I will have use an email, and an encrypted validation mail(sent by launchpad it seems) will be sent to my inbox with a link to confirm the publication. My question is this: The private key is in the ubuntu server How do I decrypt that validation email in order to complete the publication process? We use google apps so I will probably access the encrypted email from my work machine which doesn't have the private key generated on the ubuntu server.

Improve this question
5
  • I'm not sure what you want to achieve. Ubuntu's key server doesn't validate mail addresses at all. What validation link are you speaking of? Where do you want to encrypt, and where do you want to decrypt?
    – Jens Erat
    Commented May 6, 2014 at 12:30
  • Hello , Thanks for your answer, ubuntu keyserver actually sends an email with a verification link to the email used when creating the key. that email is encrypted with the very public key that is being published. Upon clicking on the link (after it's been decrypted) it sends the flow to launchpad.net/username-x with the message: :"The Key xxxx/xxxxxxx was successfully validated"
    – black sensei
    Commented May 6, 2014 at 12:56
  • It's the second paragraph of your question that confuses me. The way you do it is identical, just you need to generate the key pair on your server. Perhaps this is an AskUbuntu question.
    – deed02392
    Commented May 6, 2014 at 16:18
  • This is not the Ubuntu key server sending that mail, but Launchpad. It doesn't have anything to do with the Ubuntu keyserver (apart from Launchpad might query it). It is also completely independent from sending encrypted mail. Again, as both @deed02392 and me seem not to understand this part of your question: Where do you want to encrypt, and where do you want to decrypt?
    – Jens Erat
    Commented May 6, 2014 at 17:25
  • Hello All, sorry for not formulating this well, I have edited the post. I hope this time it has better explanation of the situation
    – black sensei
    Commented May 7, 2014 at 7:48

1 Answer 1

Reset to default
2

I think the key misunderstanding you have is that you think public-private key pairs are somehow tied to a machine. They are not. You can generate a key pair on any machine and export/import it to any other.

The only critical component of PGP you need to worry about is keeping the private key private.

You have two options:

  1. Generate a key-pair on your local machine and export/import the private key for all machines you want to perform decrypt/signing operations on
  2. Generate different key-pairs for every machine and access them remotely to perform your decrypt/signing operations - this option means the private keys don't need to move around, so it's less prone to mistakes that could expose your private key (very bad).

So If you don't want to manage receiving e-mails on the Ubuntu machine itself (for example by remotely controlling it with X over SSH or VNC), you need to export the private key from the Ubuntu server so you can import it to your local keychain. That's done as follows:

gpg --export-secret-key -a "User Name" > private.key

This key is unprotected so you must be careful about how you move it (use something secure like scp).

Or, do what you already know how to do and generate the key-pair on the machines themselves. If you don't have an e-mail address for every machine, just upload it to a key server that doesn't require e-mail verification, such as http://pgp.mit.edu.

E-mail verification isn't necessary, using a key server at all is unnecessary - you only need to share the public key with those who are sending you encrypted data.

Improve this answer
5
  • OK that means I can also generate the public key file and send it to the person I want. So that won't need any keyserver at all if I understand you well
    – black sensei
    Commented May 7, 2014 at 11:08
  • @blacksensei That's absolutely correct! Key servers just attempt to make things more convenient. They're like an address book. There can still be houses, even if there is no entry in the address book.
    – deed02392
    Commented May 7, 2014 at 11:31
  • One last question. If I have both public.asc and private.key gerenated and sent to a different server. How to test it? Do I need to import both public /private key into the new machine before we test? Can one also use the public key file public.asc directly when encrypting and thus use private.key directly to decrypt without having to import anything?
    – black sensei
    Commented May 7, 2014 at 15:42
  • You need to import both public and private keys. So: gpg --import public.asc and gpg --allow-secret-key-import --import private.key. You can use those keys once imported, as if you'd generated them locally.
    – deed02392
    Commented May 7, 2014 at 15:57
  • Good idea :-) Although it makes the gpg secret meta-key maybe too important.
    – peterh
    Commented May 14, 2014 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .