Kleopatra on Germania Blog

PGP compendium - Encryption and Popular PGP Tools Use Guides (2026)

Sat, 14 Sep 2024 12:07:00 +0000

A collection of guides for the popular PGP tools: GPG4USB (Linux & Windows), GPA (Linux), Kleopatra (Linux & Windows), GPGSuite (macOS), OpenKeyChain (Android) and PGPro (iOS).

What is PGP / OpenPGP #

GnuPG (GPG, GNU Privacy Guard) is an open-source encryption software for secure End-to-End communication between two parties. It enables users to communicate securely by providing tools to encrypt and decrypt messages using the OpenPGP (Open Pretty Good Privacy) non-proprietary standard.

OpenPGP uses public key cryptography. To use OpenPGP, you must first generate a pair of public and private keys using GPG software. You can then share your public key with others, keeping your private key secret. Anyone who has the public key can use it to encrypt and verify information that only the holder of the private key can decrypt and sign.

Installation and configuration #

The basic GnuPG program operates from the command line, but various graphical interfaces are available for many operating systems. Since version 5.0, the Tails system includes the Kleopatra tool, which is also known from the Gpg4win package for Windows.

Installation of Kleopatra (Linux)
Installation of Kleopatra (Windows)
Installation of GPG Suite (macOS)
Installation of OpenKeychain (Android)
~~Installation of PGPro~~ (iOS)
~~Installation of GNU Privacy Assistant~~ (Linux)
~~Installation of GPG4USB~~ (Linux & Windows)

Key generation #

The user generates a pair of keys, a public key and a private key. The public key is shared with others, while the private key is kept secret. Private key is stored in GPG program files, so it is recommended to encrypt the operating system.

Key generation in Kleopatra (Linux)
Key generation in Kleopatra (Windows)
Key generation in GPG Suite (macOS)
Key generation in OpenKeychain (Android)
~~Key generation in PGPro~~ (iOS)
~~Key generation in GNU Privacy Assistant~~ (Linux)
~~Key generation in GPG4USB~~ (Linux & Windows)

Private key backup #

A backup copy of the private key should be encrypted with VeraCrypt or TrueCrypt and placed on external media for protection against data loss.

Private key backup in Kleopatra (Linux)
Private key backup in Kleopatra (Windows)
Private key backup in GPG Suite (macOS)
Private key backup in OpenKeychain (Android)
~~Private key backup in PGPro~~ (iOS)
~~Private key backup in GNU Privacy Assistant~~ (Linux)
~~Private key backup in GPG4USB~~ (Linux & Windows)

Importing public keys #

Import public keys of other users for encrypting messages and verifying digital signatures.

Importing public keys in Kleopatra (Linux)
Importing public keys in Kleopatra (Windows)
Importing public keys inGPG Suite (macOS)
Importing public keys in OpenKeychain (Android)
~~Importing public keys in PGPro~~ (iOS)
~~Importing public keys in GNU Privacy Assistant~~ (Linux)
~~Importing public keys in GPG4USB~~ (Linux & Windows)

Message encryption #

The sender uses the recipient’s public key to encrypt the message. This ensures that only the intended recipient can decrypt it.

Message encryption in Kleopatra (Linux)
Message encryption in Kleopatra (Windows)
Message encryption in GPG Suite (macOS)
Message encryption in OpenKeychain (Android)
~~Message encryption in PGPro~~ (iOS)
~~Message encryption in GNU Privacy Assistant~~ (Linux)
~~Message encryption in GPG4USB~~ (Linux & Windows)

Message decryption #

The recipient uses his private key to decrypt the encrypted message. By quoting a sufficient part of it in the reply, also confirms that has access to the private key.

Message decryption in Kleopatra (Linux)
Message decryption in Kleopatra (Windows)
Message decryption in GPG Suite (macOS)
Message decryption in OpenKeychain (Android)
~~Message decryption in PGPro~~ (iOS)
~~Message decryption in GNU Privacy Assistant~~ (Linux)
~~Message decryption in GPG4USB~~ (Linux & Windows)

Signing messages #

The sender can use his private key to digitally sign the message. The signature acts as proof that the message was written by the key owner.

Signing messages in Kleopatra (Linux)
Signing messages in Kleopatra (Windows)
Signing messages in GPG Suite (macOS)
Signing messages in OpenKeychain (Android)
~~Signing messages in PGPro~~ (iOS)
~~Signing messages in GNU Privacy Assistant~~ (Linux)
~~Signing messages in GPG4USB~~ (Linux & Windows)

Verifying messages #

After receiving a signed message, the recipient can use the sender’s public key to verify the digital signature of the message. A valid signature proves that the message was sent by the sender and has not been altered. The slightest change in the original message, even by one character, will cause the verification process to fail.

Verifying messages in Kleopatra (Linux)
Verifying messages in Kleopatra (Windows)
Verifying messages in GPG Suite (macOS)
Verifying messages in OpenKeychain (Android)
~~Verifying messages in PGPro~~ (iOS)
~~Verifying messages in GNU Privacy Assistant~~ (Linux)
~~Verifying messages in GPG4USB~~ (Linux & Windows)

Troubleshooting

GnuPG version update in GPG4USB

Kleopatra for Windows installation and operation guide

Sat, 17 Aug 2024 12:03:00 +0000

GPG4Win is a software package that includes the Kleopatra tool for managing PGP keys. This guide describes how to install GPG4Win how and use Kleopatra tool on Windows.

Installing Kleopatra from Gpg4win on Windows #

Download the Gpg4win package from the official website: https://gpg4win.org.
Run the downloaded installer and follow the on-screen instructions, selecting the Kleopatra installation option.

After installation is complete, launch the Kleopatra application using the desktop shortcut or the Start menu.

Ensure the following components are installed: GnuPG, Kleopatra, GpgOL, GpgEX.
Select them, then click Next.

Generating keys in Kleopatra #

Open the Kleopatra application and click the New Key Pair button.

Enter your nickname. Setting a passphrase is recommended. Click Advanced Settings.

Select your preferred key algorithm and size RSA, 4096 bits, check the Authentication option, and click OK.

Set a passphrase for the key, which will be used to protect it, then click OK.

Backing up the private key in Kleopatra #

Go to the key management screen, select your private key, and click Backup Secret keys….

Select the location where you want to save the key, and click Save.

Ensure the key is saved in a secure location.
It is also recommended to export the public key.

A backup copy of the private key should be encrypted with VeraCrypt or TrueCrypt and placed on external media for protection against data loss.

Importing public keys in Kleopatra #

Open the email or other communication containing the public key.

Copy the public key to the clipboard.

Open the Kleopatra application and select the Notepad option.
Paste the public key and click Import Notepad.

Then certify the public key to confirm its authenticity by clicking Certify.

Encrypting messages in Kleopatra #

Open the Kleopatra application and click Notepad, then paste/type the content of the message you want to encrypt into the text field.

Select the recipient’s public key from the list of available keys.

Click Encrypt Notepad.

After encrypting the message, copy the resulting text to the clipboard.

You can now share the encrypted text in another app, such as via an instant messenger, or save it to a file.

We do not need to import the public key again when encrypting the next messages. The key will be saved in the program files.

Decrypting messages in Kleopatra #

Open the encrypted message.
Copy the encrypted text to the clipboard, then open the Kleopatra application.
Click Notepad and paste the encrypted text.

Click Decrypt / Verify Notepad. If prompted for a passphrase, enter the passphrase for your private key.

Signing messages in Kleopatra #

Open the Kleopatra application and click Notepad, then paste the content of the message you want to sign into the text field.

Select your private key from the dropdown list in the Sign as field.

Click Sign Notepad.

Copy the signed text to the clipboard.
You can now share the signed text in another app, such as via an instant messenger, or save it to a file.

Avoid signing messages that seem universal. For example, a signed “I agree” or “It’s me” message can be saved and used to impersonate you in another conversation. Signed messages should be complete sentences describing the purpose and circumstances of the signature.

Verifying messages in Kleopatra #

Open the signed message and copy its content to the clipboard.
Open the Kleopatra application, click Notepad, then paste the signed text into the text field.

Click Decrypt / Verify Notepad.
Kleopatra will display the verification result, informing you whether the signature is valid.

We do not need to import the public key again when verifying subsequent signatures of the same author. The key will be saved in the program files.

Kleopatra for Linux installation and operation guide

Sat, 17 Aug 2024 12:02:00 +0000

Kleopatra is a PGP tool for managing encryption keys. This guide describes how to create a public PGP key in Kleopatra on Tails and other Linux distributions.

Kleopatra on Tails #

The Kleopatra tool is installed by default on Tails since version 5.0, and no manual installation of the GPG program on that system is required.

Search for Kleopatra in the Applications menu and click to run.
To preserve access to the generated and imported keys between sessions, set up an encrypted persistent volume. Select Applications→Tails→Persistent Storage, click Contrinue, enter a strong random password twice in both Passphrase and Confirm fields, and confirm the volume creation by clicking Create Persistent Storage. Select GnuPG in the list of persistent volume features and finish setup.

Installing Kleopatra via Flatpak #

For Linux systems, installation via Flatpak is the recommended method. It does not require verification of checksums and PGP signatures. For user application installation, Flatpak does not require elevated privileges, the following steps can be performed in a default user session.

The Flatpak tool is installed by default in many Linux distributions, including available in Whonix-Workstation 18. If the flatpak command is not available in the console, install Flatpak according to the instructions for your chosen distribution.
Add the Flathub repository, set the visibility of FLOSS applications (Free/Libre and Open Source Software), and install the org.kde.kleopatra package with the following commands:

1
2
3

flatpak --user remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak --user remote-modify --subset=floss flathub
flatpak --user install -y flathub org.kde.kleopatra

Because all connections are anonymized in Whonix-Workstation, application installation may take longer, and the occasional [28] Timeout was reached error may require you to repeat the last command several times.

The Kleopatra application requires a GnuPG agent process running in the background. In Whonix-Workstation 18, it is installed by default, so we skip this step.

Debian/Ubuntu and derivatives:

1
2

sudo apt update
sudo apt install -y gnupg2

Fedora/RHEL/CentOS and derivatives:

`1`	`sudo dnf install -y gnupg2`

Arch Linux and derivatives:

1
2

sudo pacman -Sy
sudo pacman -S --noconfirm gnupg

openSUSE:

1
2

sudo zypper refresh
sudo zypper install -y gpg2

We configure the GnuPG agent autostart with the command:

`1`	`echo 'pgrep -x gpg-agent > /dev/null \|\| gpg-agent --daemon' >> ~/.profile`

Then, before the first launch of the Kleopatra application, we ensure that the GnuPG agent is running with the command:

`1`	`pgrep -x gpg-agent > /dev/null \|\| gpg-agent --daemon`

You can launch the Kleopatra application using the shortcut in the applications menu or with the command:

`1`	`flatpak run org.kde.kleopatra`

On Qubes OS, for an app qube created from the whonix-workstation-18 template (for example, the default anon-whonix), after installing the application, click Refresh applications in the Settings→Applications menu, wait for synchronization to complete, then check Kleopatra in the All available applications list, click > to move the application to the Applications shown in App Menu list, and confirm the changes by clicking OK. The application shortcut will be visible in the Qubes system menu for the selected app qube.

Generating keys in Kleopatra #

Open the Kleopatra application and click the New Key Pair button.

Enter your nickname. It is recommended to set a passphrase. Click Advanced Settings.

Select your preferred key algorithm and size RSA, 4096 bits, check the Authentication option, and click OK.
Set a passphrase for the key, which will be used to protect it, and then click OK.

Backing up the private key in Kleopatra #

Go to the key management screen, select your private key, and click Export Secret keys….

Select the location where you want to save the key, and click Save.

Ensure the key is saved in a secure location.

It is also recommended to create a backup of the public key.

A backup copy of the private key should be encrypted with VeraCrypt or TrueCrypt and placed on external media for protection against data loss.

Importing public keys in Kleopatra #

Open the email or other communication containing the public key.

Copy the public key to the clipboard.
Open the Kleopatra application and select the Notepad option. Paste the public key and click Import Notepad.

You will then need to certify the new certificate. You will likely be prompted for a passphrase.

Your new PGP key has been imported.

Encrypting messages in Kleopatra #

Open the Kleopatra application and click Notepad.

Paste the content of the message you want to encrypt into the text field.

Select the recipient’s public key from the list of available keys.

Click Encrypt Notepad.
After encrypting the message, copy the resulting text to the clipboard.
You can now share the encrypted text in another app, such as via an instant messenger, or save it to a file.

We do not need to import the public key again when encrypting the next messages. The key will be saved in the program files.

Decrypting messages in Kleopatra #

Open the encrypted message in any text editor.
Copy the encrypted text to the clipboard, then open the Kleopatra application.
Click Notepad and paste the encrypted text.

Click Decrypt / Verify Notepad. If prompted for a passphrase, enter the passphrase for your private key.

Signing messages in Kleopatra #

Open the Kleopatra application and click Notepad.
Paste the content of the message you want to sign into the text field.

Select your private key.

Then click Sign Notepad. Copy the signed text to the clipboard.

You can now share the signed text in another app, such as via an instant messenger, or save it to a file.

Avoid signing messages that seem universal. For example, a signed “I agree” or “It’s me” message can be saved and used to impersonate you in another conversation. Signed messages should be complete sentences describing the purpose and circumstances of the signature.

Verifying messages in Kleopatra #

Open the signed message and copy its content to the clipboard.
Open the Kleopatra application, click Notepad and paste the signed text into the text field.

Click Decrypt / Verify Notepad. Kleopatra will display the verification result, informing you whether the signature is valid.

We do not need to import the public key again when verifying subsequent signatures of the same author. The key will be saved in the program files.