GPG Symmetric Encryption
Encrypt and decrypt files with a passphrase using GPG
-c flag enables symmetric mode — no key pair required.
Create a workspace and a secret test file:
Encrypt the file symmetrically with GPG. Use --batch --passphrase to avoid the interactive prompt in scripts:
The .gpg file is binary ciphertext — its contents are unreadable without the passphrase.
Verify the file is genuinely encrypted (should show gibberish or error):
Decrypt the file — confirm you recover the original content:
Try to decrypt with the wrong passphrase and observe the error:
This confirms the encryption is working correctly.
GPG Key Pair Operations
Generate keys, export/import, encrypt for a recipient, and digitally sign
Generate a GPG key pair in batch mode (no interactive prompts):
List your keyring to confirm the key was created:
The pub line is the public key. The sub line is the encryption subkey. [SC] = Sign+Certify, [E] = Encrypt.
Export the public key (this is what you share with others):
Encrypt a file for a recipient using their public key (-r = recipient email):
Decrypt using the private key (which lives in the keyring):
Digitally sign a file to prove authenticity (recipients verify with your public key):
OpenSSL File Encryption
Encrypt files with AES-256-CBC and generate hashes for integrity checking
openssl enc is a low-level symmetric cipher tool — fast, scriptable, and part of every Linux system. GPG is preferred for key-based workflows. OpenSSL shines for quick file encryption, TLS certificate work, and scripted pipelines.
Generate a hash of a file before encryption (to verify integrity later):
Record this hash — you will compare it after decryption to confirm no corruption.
Encrypt the file with AES-256-CBC. The -pbkdf2 flag uses a modern key derivation function that resists brute-force attacks:
Verify the encrypted file is binary ciphertext (not readable text):
The Salted__ header is a signature that openssl adds to encrypted files.
Decrypt with the same parameters and verify hash integrity:
The hashes match — the file survived encryption and decryption without modification.
Generate a random encryption key (instead of a passphrase) and use it as a key file:
chmod 400 keyfile.key), and never store them alongside the encrypted data.
SSH Key Generation and Management
Generate ed25519 and RSA key pairs, understand permissions, and manage the authorized_keys file
~/.ssh/authorized_keys. 3. On connection, server challenges with a random message. 4. Client signs with private key. 5. Server verifies signature with public key. No password ever crosses the network.
Create a test directory and generate a modern ed25519 key pair:
Examine both keys. Notice the dramatic size difference:
The public key is a single line — this is what you put in authorized_keys. The private key is multi-line and stays on the client.
Generate an RSA 4096-bit key pair for comparison (required by some older systems):
Note the permissions: private keys are 600 (owner read/write only). SSH will refuse to use keys with looser permissions.
Inspect the correct SSH file permissions structure:
Simulate adding a public key to authorized_keys (the deployment step):
View the key fingerprint (useful for verifying key identity without revealing the full key):
Ed25519
Elliptic curve algorithm. Compact keys (68 chars public), fast operations, excellent security. Modern standard — use this when possible.
RSA 4096
Traditional algorithm. Longer keys (739 chars public), slower but widely compatible with older SSH servers and systems requiring FIPS compliance.
LUKS Disk Encryption (Concept + Safe Practice)
Understand the LUKS workflow and practice with a loop device
cryptsetup luksFormat against a real disk or partition (/dev/sda, /dev/nvme0n1) without understanding the consequences. This exercise uses a loop device backed by a file — safe for any system.
luksFormat — writes LUKS header and encrypts. 2) luksOpen — creates a device mapper entry at /dev/mapper/name. 3) Use the mapper device normally (mkfs, mount, read/write). 4) luksClose — removes the mapper entry and secures the device.
Create a 50MB file to use as a loop device (safe substitute for a real disk):
Set up a loop device backed by the image file:
Format the loop device with LUKS encryption:
Open (unlock) the LUKS volume and create a filesystem on the mapper device:
Mount the encrypted volume, write a file, then close and verify data is inaccessible:
Clean up the loop device:
cryptsetup luksAddKey to add recovery passphrases, cryptsetup luksKillSlot to revoke individual keys. If all key slots are wiped, the data is permanently unrecoverable.
Lab Complete
You encrypted files with GPG (symmetric and asymmetric), used OpenSSL for AES-256-CBC encryption with integrity verification, generated and managed SSH key pairs, and practiced LUKS full-disk encryption with a loop device.