GPG Command Tutorial: The Encryption Trick Real SOC Analysts Use

GPG Command Complete Tutorial: Encrypt, Sign, and Verify Files Like a Real SOC Analyst

A mid-sized fintech startup once lost a client contract not because of a breach, but because of a leak. An internal PDF containing pricing structures ended up in a competitor's inbox. The forensic team spent three days trying to prove who sent it — but there was no signature, no encryption, no chain of custody. Just a plain email attachment anyone could have forwarded, altered, or intercepted.

That single incident is the reason GPG (GNU Privacy Guard) still matters in 2026, even in a world full of Slack DMs and cloud drives. When you encrypt and sign a file with GPG, you're not just hiding data — you're creating cryptographic proof of authorship and integrity. In enterprise SOC environments, GPG underpins secure code signing, encrypted backup pipelines, secure email (PGP/MIME), and even Linux package verification (think apt and yum repo signing).

This guide walks through every core GPG command a security professional, sysadmin, or privacy-conscious developer should know — explained the way I'd explain it to a junior analyst on their first day handling sensitive data.

Table of Contents

• What Is GPG and Why It Still Matters
• Real-World Scenario: Why Signing Beats "Trust Me"
• GPG Commands Explained One by One
• Detection & Prevention: Where GPG Fits in a Security Stack
• Expert Tips From the Field
• Related Articles
• FAQ
• Conclusion

What Is GPG and Why It Still Matters

GPG is an open-source implementation of the OpenPGP standard, used for asymmetric encryption, digital signatures, and key management. Unlike symmetric encryption (same key to lock and unlock), GPG uses a public/private key pair: your public key can be shared with anyone, while your private key stays locked down and is used to decrypt messages or sign files.

In a modern SOC or DevSecOps pipeline, GPG shows up in places most people don't expect:

• Signing Git commits to prevent supply chain tampering
• Verifying Linux package integrity before installation
• Encrypting sensitive log exports before sending them off-site
• Securing communication between incident responders during a breach investigation

Real-World Scenario: Why Signing Beats "Trust Me"

Picture an incident response team collaborating remotely during a ransomware investigation. One analyst needs to send a memory dump to a malware reverse engineer at a partner firm. Email alone isn't safe — the dump could contain credentials, and interception risk is real. Instead, the analyst encrypts the file with the reverse engineer's public key using gpg -e -r, then signs it with their own private key. The recipient decrypts it, verifies the signature, and instantly knows two things: the file wasn't tampered with in transit, and it genuinely came from the sender it claims to.

This exact workflow is standard practice across CERT teams, red team engagements, and bug bounty communication where confidentiality and non-repudiation both matter.

GPG Commands Explained One by One

1. Check GPG Version

gpg --version

What it does: Displays the installed GPG version, home directory, and supported ciphers, hash algorithms, and compression methods.

When to use it: Always run this first when setting up a new machine or troubleshooting compatibility issues between GPG versions (2.2.x vs 2.4.x behave differently for some flags).

Expected output: Version number, library info, and a list of supported algorithms like AES256, SHA512, and ZLIB.

2. Create a New Key Pair

gpg --gen-key

What it does: Walks you through a simplified wizard to generate a public/private key pair using default algorithm settings.

When to use it: Good for quick personal use or testing. Not ideal for enterprise deployments where you need control over key type and expiration.

3. Create a Full-Featured Key

gpg --full-generate-key

What it does: Opens the advanced key generation wizard, letting you choose key type (RSA, ECC), key size, and expiration date.

When to use it: This is the production-grade choice. Security teams should always set an expiration date (1–2 years) so compromised or abandoned keys don't stay valid forever.

4. List Public Keys

gpg --list-keys

What it does: Displays every public key currently stored in your keyring, along with key IDs and user identities.

Expected output: A list showing key type, creation date, and associated email/user ID.

5. List Secret Keys

gpg --list-secret-keys

What it does: Shows all private keys available for decryption or signing on this machine.

When to use it: Useful during audits to confirm exactly which private keys exist locally — a critical step when decommissioning a workstation.

6. Encrypt a File

gpg -e -r user file.txt

What it does: Encrypts file.txt using the public key belonging to user, producing file.txt.gpg.

When to use it: Any time you're sending sensitive data to someone whose public key you already have.

7. Decrypt a File

gpg -d file.txt.gpg

What it does: Decrypts the file using your private key, prompting for your passphrase.

Expected output: The original plaintext content printed to the terminal (or redirected to a new file).

8. Sign a File

gpg --sign file.txt

What it does: Produces a compressed, signed version of the file that bundles content and signature together.

9. Create a Detached Signature

gpg --detach-sign file.txt

What it does: Generates a separate .sig file instead of embedding the signature — ideal when you don't want to modify the original file, such as signing software release binaries.

10. Verify a Signature

gpg --verify file.txt.sig file.txt

What it does: Confirms the file hasn't been altered and matches the signer's private key.

Expected output: "Good signature from [user]" if valid, or a warning if the key is untrusted or the file was tampered with.

11. Encrypt and Sign a File

gpg -se -r user file.txt

What it does: Combines confidentiality and authenticity in one step — encrypts for the recipient and signs with your key.

When to use it: This is the gold standard for sensitive incident response communications.

12. Export a Public Key

gpg --export -a user > pubkey.asc

What it does: Exports your public key in ASCII-armored (text-readable) format so it can be shared via email or posted on a keyserver.

13. Export a Private Key

gpg --export-secret-keys -a user > privatekey.asc

What it does: Exports your private key in ASCII format.

Security warning: Never transmit this file over unencrypted channels or store it in cloud sync folders. A leaked private key is equivalent to a leaked master password.

14. Import a Public Key

gpg --import pubkey.asc

What it does: Adds someone else's public key to your keyring so you can encrypt messages to them or verify their signatures.

15. Import a Private Key

gpg --import privatekey.asc

What it does: Restores a private key onto a new machine, typically during key migration or disaster recovery.

16. Delete a Public Key

gpg --delete-key user

What it does: Removes a public key from your keyring — useful when a key has been revoked or is no longer trusted.

17. Delete a Secret Key

gpg --delete-secret-key user

What it does: Removes a private key permanently from the local keyring. Do this only after secure backup, since it cannot be undone.

18. Edit a Key

gpg --edit-key user

What it does: Opens an interactive shell for managing trust level, adding/removing user IDs, extending expiration, or adding subkeys.

19. Show Key Fingerprint

gpg --fingerprint user

What it does: Displays the unique fingerprint of a key — the most reliable way to verify a key's authenticity outside of a trusted signature chain.

When to use it: Always compare fingerprints over a secondary channel (phone call, in-person, verified chat) before trusting a new key.

20. List Key Signatures

gpg --list-sigs user

What it does: Shows the web of trust — who has signed a given public key, which helps establish its credibility within a trust network.

Detection & Prevention: Where GPG Fits in a Security Stack

From a blue team perspective, GPG isn't just a tool you use — it's also something you monitor for misuse. Consider these practical points:

• Monitor for unauthorized key exports. Command-line auditing (via auditd on Linux) should flag --export-secret-keys executions on production servers — this is a common step in insider data exfiltration.
• Verify software packages. Malicious package repositories have been used in real supply-chain attacks; GPG signature verification on packages and Git commits helps catch tampered code before it reaches production.
• Rotate and expire keys. Long-lived keys without expiration dates are a common finding in security audits — enforce 1–2 year expiration policies.
• Protect private key files. Treat exported .asc private key files the same as plaintext passwords — encrypt at rest, restrict permissions with chmod 600, and avoid syncing to cloud storage.

Expert Tips From the Field

• Always set a passphrase on your private key — an unprotected key defeats the purpose of encryption entirely.
• Use --full-generate-key over --gen-key in any professional setting; the extra control over key size and expiration is worth the two extra prompts.
• For automated pipelines (like CI/CD signing), use a dedicated signing subkey rather than your primary identity key, so it can be revoked independently if compromised.
• Back up your revocation certificate the moment you generate a key — if you lose access to your private key, this is the only way to tell others to stop trusting it.

Related Cybersecurity Topics You Should Explore

• AI Found a Chrome Bug Hiding for 13 Years. Here's How.
  
• This Open-Source AI Agent Turns ChatGPT Into a Hacker
  
• GenieLocker Ransomware Explained: How Toy Ghouls Hack ESXi Servers
  
• ln Command Explained: How Hackers Abuse Symlinks to Hack Root
  
• NVIDIA BlueField Flaw Lets Hackers Hijack Cloud Servers
  
• NGINX Buffer Overflow (CVE-2026-42533): Patch Before It's Exploited
  
• Windows 11 Finally Fixes Its Slowest File Deletion Problem
  
• Microsoft Just Killed the Fake KMS Server Trick for Good
  
• GitLab RCE Bug: How a Simple Notebook Diff Gave Attackers Root
  
• PentesterFlow: The AI Tool That Hacks Like a Human
  
• Bash History Forensics: A SOC Analyst's Real Breach Story
  
• Bing Images Bug Let Hackers Run Code as SYSTEM — Here's How
  
• Dolphin X Malware: New AI Stealer Hits 300+ Apps

FAQ

Q1: Is GPG the same as PGP?
GPG is a free, open-source implementation of the OpenPGP standard, which itself descended from the original PGP software. They're compatible with each other.

Q2: Can GPG-encrypted files be cracked?
With modern algorithms like RSA-4096 or AES-256, brute-forcing a properly generated key is computationally infeasible with current technology.

Q3: What happens if I lose my private key?
Any data encrypted to that key becomes permanently unrecoverable unless you have a backup. This is why secure key backup is essential.

Q4: Do I need a keyserver?
Not required, but publishing your public key to a keyserver (or your own website) makes it easier for others to find and verify it.

Q5: Is GPG still relevant with modern tools like Signal or ProtonMail?
Yes — GPG remains the backbone for code signing, package verification, and scenarios requiring file-based (not just messaging-based) encryption.

Q6: What's the difference between signing and encrypting?
Signing proves authorship and integrity; encrypting hides content from anyone without the private key. Use -se to do both at once.

Conclusion

GPG isn't flashy, and it won't trend on social media — but it's one of the most dependable tools a security professional can master. Whether you're securing incident response communications, verifying software integrity, or protecting sensitive exports, these twenty commands cover nearly everything you'll need in day-to-day operations. Master the fundamentals here, and you'll have a cryptographic toolkit that's stood the test of decades — and will likely outlast whatever chat app is popular next year.