安装 security/gnupg。在 ~/.gnupg/gpg.conf 中输入以下几行以设置签名和新密钥首选项的最低可接受默认值(有关更多详细信息,请参见 GnuPG 选项文档)
# Sorted list of preferred algorithms for signing (strongest to weakest). personal-digest-preferences SHA512 SHA384 SHA256 SHA224 # Default preferences for new keys default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 CAMELLIA256 AES192 CAMELLIA192 AES CAMELLIA128 CAST5 BZIP2 ZLIB ZIP Uncompressed
生成密钥
% gpg --full-gen-key gpg (GnuPG) 2.1.8; Copyright (C) 2015 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Warning: using insecure memory! Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) 2048 (1) Requested keysize is 2048 bits Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 3y (2) Key expires at Wed Nov 4 17:20:20 2015 MST Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: Chucky Daemon (3) Email address: notreal@example.com Comment: You selected this USER-ID: "Chucky Daemon <notreal@example.com>" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o You need a Passphrase to protect your secret key.
1 | 目前 (2022-10),2048 位密钥和三年有效期提供了足够的保护。 |
2 | 三年的密钥生命周期足够短,可以使被不断增长的计算机能力削弱的密钥过时,但又足够长,可以减少密钥管理问题。 |
3 | 在这里使用您的真实姓名,最好与政府颁发的身份证上的姓名一致,以便其他人更容易验证您的身份。可以在“注释”部分输入有助于其他人识别您的文本。 输入电子邮件地址后,将请求您输入密码。创建安全密码的方法存在争议。这里没有建议单一方法,而是提供了一些链接到描述各种方法的网站:https://world.std.com/~reinhold/diceware.html、https://www.iusmentis.com/security/passphrasefaq/、https://xkcd.com/936/、https://en.wikipedia.org/wiki/Passphrase. |