Creating a key pair:
gpg --gen-key OR gpg --full-generate-key
Backing up the secret/private key:
gpg --list-secret-keys gpg --export-secret-keys -a '[email protected]' > priv.asc
List the keys on the system, export from the machine that holds the key, and import on the machine that will use it to encrypt files:
gpg --list-keys gpg --export -a '[email protected]' > pub.asc gpg --import pub.asc
NOTE: the argument -a sets the output format to asc. Without it, the key will be in binary format.
Replace the email with the recipient email associated with the key.
List the keys to confirm the import was successful, then edit the key:
gpg --list-keys gpg --edit-key 9DC8C540E9FF1344
Replace 9DC8C540E9FF1344 with the identifier you find.
Trusting the key is important. Without it, scripts that automate encrypted backups will prompt for confirmation each time:
gpg> trust gpg> quit
Answer 5 and confirm.
You can now encrypt files using the imported and trusted key:
gpg -a -r "[email protected]" --yes --encrypt FILE.TXT
OR
cat FILE.TXT | gpg -r "[email protected]" --yes --encrypt - > FILE.TXT.GPG
To decrypt the file later:
gpg --decrypt FILE.TXT.asc > FILE.TXT
To encrypt and decrypt files via the Nautilus file browser, install the following tool:
sudo apt install seahorse-nautilus