Install and configure Gnupg & Use Gnupg to encrypt file in PHP
I am using FreeBSD 7.0. Now let's start to install Gnupg.
First, use ports to install Gnupg. Create a directory .gnupg in /home/username, Most people said chmod 777 /home/username/.gnupg. (May cause a warning later, chmod 700 recommended)
Alternatively, you can use pkg_add or sysinstall (text based GUI utility) command to install the same:
Second, install pinentry.
Unforturnately, I met some error after a long time wait. It says:
I checked /usr/ports/UPDATING, use :
and search for 20080323 typing "/20080323" (without quotes)
It says:
If you tried both commands above, and they return "portmaster: not found" or "portupgrade: not found", you need to install portmaster or portupgrade from ports.
then you can run
after it finished, continue to run
You may met another error, it says:
It's caused by your pixman's version. Uninstall and install again
After this, you should update to 0.10.0 version.
Retry
You should success this time. (Please leave the comment if you met some other problems.)
Okay, let's start to configure Gnupg.
First, generate a new key.
GnuPG is able to create several different types of keypairs, but a primary key must be capable of making signatures. There are therefore only three options. Option 1 actually creates two keypairs. A DSA keypair is the primary keypair usable only for making signatures. An ElGamal subordinate keypair is also created for encryption. Option 2 is similar but creates only a DSA keypair. Option 4[1] creates a single ElGamal keypair usable for both making signatures and performing encryption. In all cases it is possible to later add additional subkeys for encryption and signing. For most users the default option is fine.
You must also choose a key size. The size of a DSA key must be between 512 and 1024 bits, and an ElGamal key may be of any size. GnuPG, however, requires that keys be no smaller than 768 bits. Therefore, if Option 1 was chosen and you choose a keysize larger than 1024 bits, the ElGamal key will have the requested size, but the DSA key will be 1024 bits.
The longer the key the more secure it is against brute-force attacks, but for almost all purposes the default keysize is adequate since it would be cheaper to circumvent the encryption than try to break it. Also, encryption and decryption will be slower as the key size is increased, and a larger keysize may affect signature length. Once selected, the keysize can never be changed.
Finally, you must choose an expiration date. If Option 1 was chosen, the expiration date will be used for both the ElGamal and DSA keypairs.
For most users a key that does not expire is adequate. The expiration time should be chosen with care, however, since although it is possible to change the expiration date after the key is created, it may be difficult to communicate a change to users who have your public key.
You must provide a user ID in addition to the key parameters. The user ID is used to associate the key being created with a real person.
Only one user ID is created when a key is created, but it is possible to create additional user IDs if you want to use the key in two or more contexts, e.g., as an employee at work and a political activist on the side. A user ID should be created carefully since it cannot be edited after it is created.
GnuPG needs a passphrase to protect the primary and subordinate private keys that you keep in your possession.
You need a Passphrase to protect your private key.
And repeat passphrase.
There is no limit on the length of a passphrase, and it should be carefully chosen. From the perspective of security, the passphrase to unlock the private key is one of the weakest points in GnuPG (and other public-key encryption systems as well) since it is the only protection you have if another individual gets your private key. Ideally, the passphrase should not use words from a dictionary and should mix the case of alphabetic characters as well as use non-alphabetic characters. A good passphrase is crucial to the secure use of GnuPG.
To communicate with others you must exchange public keys. To list the keys on your public keyring use the command-line option --list-keys.
To check the new key, you can run
again.
Once a key is imported it should be validated. GnuPG uses a powerful and flexible trust model that does not require you to personally validate each key you import. Some keys may need to be personally validated, however. A key is validated by verifying the key's fingerprint and then signing the key to certify it as a valid key. A key's fingerprint can be quickly viewed with the --fingerprint command-line option, but in order to certify the key you must edit it.
A key's fingerprint is verified with the key's owner. This may be done in person or over the phone or through any other means as long as you can guarantee that you are communicating with the key's true owner. If the fingerprint you get is the same as the fingerprint the key's owner gets, then you can be sure that you have a correct copy of the key.
After checking the fingerprint, you may sign the key to validate it. Since key verification is a weak point in public-key cryptography, you should be extremely careful and always check a key's fingerprint with the owner before signing the key.
Once signed you can check the key to list the signatures on it and see the signature that you have added. Every user ID on the key will have one or more self-signatures as well as a signature for each user that has validated the key.
Now, let's use it in PHP.
This one will generate an encrypted file named "test.php.asc". Remove the "-a" option, it will generate "test.php.gpg".
If you got nothing generated, and you can generate the encrypted file in shell command. That's the permission issue. You can chmod 644 /home/username/.gnupg/*, but you will get a warning for the gpg.conf.
Run chmod 600 gpg.conf
Another common warning messages is as follows:
This message is shown if the file permissions of the directory that contains the configuration file allows others to read its contents. If you see this warning, it is recommended that you execute the following command to change the file permissions:
That's all. Really a hard work takes me lots of time to make it worked. Good luck to you guys. Hope this article can help you.
SEE ALSO:
http://www.gnupg.org/gph/en/manual/c14.html
http://centos.org/docs/4/html/rhel-sbs-en-4/s1-gnupg-warnings.html