Making sure we deal with secrets properly.

Why GPG

We use GPG to encrypt our secrets (passwords, backups ec). GPG allows us to encrypt data for a recipient by using their public key. A GPG solution consists out of a private and public key.

Never disclose your private key.

https://gnupg.org/faq/gnupg-faq.html#whats_gnupg

Generating your GPG key

Check here how to generate your GPG key

https://help.github.com/articles/generating-a-new-gpg-key/

Uploading your GPG key to the key server

First list your keys, and then pick your fingerprint and upload it to the MIT edu key server.

how-we-work (master) ∆ gpg --list-keys
/Users/emilebosch/.gnupg/pubring.gpg
------------------------------------
pub   rsa2048 2017-01-08 [SC] [expires: 2018-01-08]
      38BC7A67156617E04F47E6912D62BCF27C07F5F3
uid           [ultimate] Emile Bosch (Sup yo, beers n keys) <[email protected]>
sub   rsa2048 2017-01-08 [E] [expires: 2018-01-08]

pub   rsa4096 2015-11-26 [SC]
      FEF6637E9E91A7A5C4149A68D7E9BD71DD1C57D4
uid           [ unknown] Mathijs Baaijens <[email protected]>
sub   rsa4096 2015-11-26 [E]

pub   rsa2048 2017-09-26 [SC] [expires: 2019-09-26]
      178F252BE532FE912DA596F017C489BAE7957BC7
uid           [ unknown] groenewege <[email protected]>
sub   rsa2048 2017-09-26 [E] [expires: 2019-09-26]

In this case 38BC7A67156617E04F47E6912D62BCF27C07F5F3 is my fingerprint. We work with fingerprints only. Check out your own fingerprint.

Then upload your public key to:

gpg --send-keys --keyserver hkp://pgp.mit.edu  38BC7A67156617E04F47E6912D62BCF27C07F5F3

After you have been generating your key.

Getting your teammates public GPG from the key server

You can retrieve the GPG public keys from our key server by fetching the keys fingerprints.

Emile’s public key

gpg --recv-keys --keyserver hkp://pgp.mit.edu 38BC7A67156617E04F47E6912D62BCF27C07F5F3

Mathijs’s public key

gpg --recv-keys --keyserver hkp://pgp.mit.edu FEF6637E9E91A7A5C4149A68D7E9BD71DD1C57D4

Rory’s public key

gpg --recv-keys --keyserver hkp://pgp.mit.edu 178F252BE532FE912DA596F017C489BAE7957BC7

Encrypting notes for a team mate

You can encrypt it via the fingerprint of the user see, --list-keys to see the fingerprints.

gpg --encrypt --armor --recipient FEF6637E9E91A7A5C4149A68D7E9BD71DD1C57D4

It will start showing an empty screen, you can type there press CTRL+D to get the encrypted story. Like this.

how-we-work (master) ∆ gpg --encrypt --armor --recipient FEF6637E9E91A7A5C4149A68D7E9BD71DD1C57D4
gpg: 5EF4A5079F05243A: There is no assurance this key belongs to the named user
sub  rsa4096/5EF4A5079F05243A 2015-11-26 Mathijs Baaijens <[email protected]>
 Primary key fingerprint: FEF6 637E 9E91 A7A5 C414  9A68 D7E9 BD71 DD1C 57D4
      Subkey fingerprint: 956D 829D 450D 306A 2F83  E0F3 5EF4 A507 9F05 243A

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y
Hello world
-----BEGIN PGP MESSAGE-----

hQIMA170pQefBSQ6ARAAhAEnJ7viM7orwgTY42Rbypf0oHbye1Z/TlV0J32JIwNG
ATPbx3KoFwWd/WQsLugB8etOYOzxkZzAQcjZOJmySmXj79unzV4UIuglFP1Qbdam
YMptR/7izIRLI4KLKlH00aEay+L6jss2w3zNbifzJlBseUTIzhTFDCMWPaPcD3Km
WMIECNTezQTrEhTr+f6+MW0iT3Tv/0L3tbu3uO6VZYRm1rsN2z+0FdCHagAHfq8m
VDCIVdFALI8cfLqNc2vyoTbcIX6lFgM0RbGdfePtMgWZUf7H7vAEimRiYg+XzHJF
T2fts6NUBwnsb685e+jckQv89sT/iiF56/mNSXjXTmGqVbj3rHUD9V/JVjDH8caV
ThLm5sthhbIY4qWUCQzRukvpzX4f8g7aKSji9JEr2WiVb+vrRUfTykxiA2TavRIK
NT++1SMcp+Lt7fYLjan/Tm+8s0itFa6KOW4YvfVdv/4O3g08ocS7S4ScasBy0Qwe
voc8EpIrgFb384IVbYPlMpGb/5GO6PF7TWncaS1UYRijvp/enH//uvYLwFCjafK/
+9OXVV8TbJcQ2z5PeKSHD/Pg+NRmONakda8ayqEpNBcxW/vsZV5yz/ZwbfBHY2ee
6SrEX+0pPyo494lbnxDt7PXLO6Q/1hqBVHyau82mKfwaptUmHM/2nRyfSYsmybTS
RwE369NIAMkVAn+Cj+8yxwbhQoG+eamvF0XNogTy6cztnUoIPk63dbFg+F5pQ1fh
4fuUTDLJQfV5RmdE6Pvdgj/VHm9hmuTr
=ky1O
-----END PGP MESSAGE-----

You can then copy send the the data over an insecure channel like slack.

Decrypting notes from a teammate

When you copy the data from an insecure channel you want to decrypt the data.

You start the decrypt and past the message in the code:

how-we-work (master) ∆ gpg --decrypt --armor
-----BEGIN PGP MESSAGE-----

hQEMAzV4dnhFYjdAAQgA32+Knbqr36nJEFNY0BFpixv1HS1V5JTJgIEHJQu8bvsm
ORXiLX0B2DJGlq80eBkVg8kyU5+F5+XoMtDle/K41ezYtFFKJUETCdR0isnvcFbp
56GFW8ONhO13kJsVW4XSqMd4PmEU5iWEswzFTldCvjGaJvb54XD2VVZumsqozWAf
2cpHUXiKo50enkyZ/1PxVrVg2vIUcmST71hCu5TJUCO4e51dJHjSa6MVq3PwWSiN
Lu2gunBwtSD1MOi8bFoBmtyrKRCz2HFDDzqwv+nB6L/nvlHBG/nKHtiKO10QjUZS
kqFrwo634XsAEQ8b0YOJRSR4KJTXo/kmi3aAV3HoE9JGAe+dXCnKMUdSD6EFt7WQ
CAKcqh5fQi5isTrC7/zpwlMftyfXA8tgIc1m6CW6be/qk/3zXukKoP6uCSPNtvwB
JFT1vxid1w==
=YCRm
gpg: encrypted with 2048-bit RSA key, ID 3578767845623740, created 2017-01-08
      "Emile Bosch (Sup yo, beers n keys) <[email protected]>"
Hello wold

Encrypting files

To encrypt files or backups use the encrypt without --armor

 gpg --encrypt --recipient 38BC7A67156617E04F47E6912D62BCF27C07F5F3 backup.tar

This will then create a backup.tar.gpg which you can distribute

Decrypting files

Then go decrypt some files via the following text

gpg --output backup.tar --decrypt backup.tar.gpg

Great!