16

when I export a gpg private or public key, and specify armored as a switch, I get plain text key, however, the gnupgp website seems to state that these keys are actually encrypted. What's the point in calling it armored if its just plain text? I don't get it.

The key is exported in a binary format, but this can be inconvenient when the key is to be sent though email or published on a web page. GnuPG therefore supports a command-line option --armor that that causes output to be generated in an ASCII-armored format similar to uuencoded documents. In general, any output from GnuPG, e.g., keys, encrypted documents, and signatures, can be ASCII-armored by adding the --armor option.

https://www.gnupg.org/gph/en/manual/x56.html

muru
  • 72,889
John Smith
  • 161
  • 1
  • 1
  • 3

2 Answers2

18

gpg --export outputs binary data. This cannot directly be displayed as text, but in base16 (i.e. hexadecimal) encoding, it looks something like:

f53e9c4b013d3c6554c3161116face55f11db56dab1a941fe3a6e5ad246d4eb7

gpg --export --armor outputs base64 encoded data, alongside a plaintext header + footer:

-----BEGIN PGP PUBLIC KEY BLOCK-----

9T6cSwE9PGVUwxYRFvrOVfEdtW2rGpQf46blrSRtTrc=


-----END PGP PUBLIC KEY BLOCK-----

This is a more conventional format used when sharing keys in email and other text-oriented mediums. This is used because binary data can't be transmitted as ASCII text. Furthermore, base64 is much more compact than other traditional methods of representing binary data as text such as base16 (i.e. hexadecimal).

NOTE: The examples have been simplified for pedagogical reasons.

Mateen Ulhaq
  • 743
16

PGP (including GPG) 'armoring' is not encryption. Encryption prevents unauthorized use of data (formally, provides confidentiality) by making it unreadable in a way that can only be reversed by someone who has the secret key. Armoring is a simple process (mostly base64, although not the same base64 used by uuencode) that can be easily reversed by anybody who reads the specification. Armoring looks like text while unarmored (binary) data looks like garbage to a person who uses inappropriate tools like cat or a text editor, but they are equally readable by someone competent.

In particular, a signed but not encrypted PGP message can be read by anyone competent, whether it is armored or not. A PGP public key ditto. An encrypted PGP message can only be read by someone who has the key -- depending on the way the message was encrypted this could be a private key, a passphrase, or both -- and again this is the same whether armored or not. A PGP private key is always encrypted, and can only be fully read by someone with the (KEK) key (in this case, always a passphrase); however, the public part of a private key can still be read by anyone competent, again regardless of armor.

The purpose of armor is to assist in correct processing. In the days when PGP was created to be used for email, most email systems could only handle text and would damage, mangle, or entirely discard binary data. For PGP messages, and keyblocks, which are inherently binary, to be successfully transmitted, they were 'armored' into textual form, and un-armored when received and processed. Nowadays nearly all email systems do handle binary data and this is rarely needed, but armoring still can be useful if you want to process the data using tools designed for text, for example cut-and-paste, or as your quote suggests a webpage (HTML handles text but not binary). It also has the advantage of being easily recognized by people without any use of tools.

dave_thompson_085
  • 4,062