# Using a PGP Key Pair > Generation of a Pretty Good Privacy (PGP) Key Pair for automated AWS IAM user access key creation with Terraform. - Source: https://www.itwonderlab.com/installing-using-pgp/ - Published: 2023-11-14 - Updated: 2026-10-05 - Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/) - Site: IT Wonder Lab (https://www.itwonderlab.com/) --- ## A Pretty Good Privacy (PGP) key pair allows the signing and encryption of files and fields. This how-to shows how to install the [GNU Privacy Guard](https://gnupg.org/) (GnuPG, an implementation of the OpenPGP standard) and create a PGP key pair. Pretty Good Privacy (PGP) is a data encryption and decryption program that provides cryptographic privacy and authentication for data communication. It’s commonly used for securing emails, ensuring that only the intended recipient can read the message. Intended usage: - Terraform and OpenTofu allow base-64 encoded PGP public keys for the [generation of IAM access keys](https://www.itwonderlab.com/terraform-aws-iam-users/). - GitHub allows signing commits with a GPG key. See also [Public Key Authentication](https://www.itwonderlab.com/public-key-authentication/) for the concepts behind key pairs. ### Install GnuPG To install in Ubuntu, update the repository and install the package `gnupg`. ```bash sudo apt update sudo apt install gnupg ``` ### Check GnuPG installation Check that the GnuPG package has been installed: ```bash gpg --version gpg (GnuPG) 2.2.27 libgcrypt 1.9.4 Copyright (C) 2021 Free Software Foundation, Inc. License GNU GPL-3.0-or-later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /root/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 ``` ### Generate a PGP Key Pair There are multiple ways to generate PGP Key Pairs depending on the needs. See [How to Manage Your Keys](https://www.gnupg.org/documentation/manuals/gnupg/OpenPGP-Key-Management.html) for additional options. #### Command line quick generation without a passphrase Specify the Name of the user, its e-mail address (IT Wonder Lab ditwl\_infradmin@itwonderlab.com), type of key (default = rsa), key size (default = 3072), and expiration (never). The parameters `--quick-generate-key`, `--passphrase ''` and `--batch` are used to avoid questions from `gpg`. A key without a passphrase is convenient for demos; protect real keys with a passphrase. ``` gpg --quick-generate-key --passphrase '' --batch "IT Wonder Lab " default default never ``` #### Command line detailed generation For advanced selection of the algorithm use the interactive key generation ``` gpg --full-generate-key gpg (GnuPG) 2.2.27; Copyright (C) 2021 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) (14) Existing key from card Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (3072) 4096 Requested keysize is 4096 bits Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: IT Wonder Lab Email address: ditwl_infradmin_gpg3@itwonderlab.com Comment: IT Wonder Lab Tutorial 3 You selected this USER-ID: "IT Wonder Lab (IT Wonder Lab Tutorial 3) " Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy ``` #### Command line batch generation - See GPG Official Manual for [Unattended key generation](). ### List PGP Keys Use `gpg -k` for listing the generated keys ``` gpg -k /home/user/.gnupg/pubring.kbx ------------------------------ pub rsa3072 2023-11-14 [SC] 4FFFF70506DFFCA9AC9303B811E695F8A4A14CB4 uid [ultimate] IT Wonder Lab (IT Wonder Lab Tutorial) sub rsa3072 2023-11-14 [E] ``` ### Exporting the Public and Private Keys Export the keys using `--export` and `--export-secret-key` with the email used for the key. - ditwl\_infradmin\_gpg\_public.key: The Public Key in Binary format - itwl\_infradmin\_gpg\_b64\_public.key: The Public Key in base64 format (for Terraform) - ditwl\_infradmin\_gpg\_private.key: The Private Key in base64 format ``` gpg --export ditwl_infradmin_gpg@itwonderlab.com > ditwl_infradmin_gpg_public.key gpg --export ditwl_infradmin_gpg@itwonderlab.com | base64 > ditwl_infradmin_gpg_b64_public.key gpg --export-secret-key -a ditwl_infradmin_gpg@itwonderlab.com > ditwl_infradmin_gpg_private.key ``` Convert the public key to base64 for usage in Terraform: ``` cat ditwl_infradmin_gpg_public.key | base64 > ditwl_infradmin_gpg_b64_public.key ``` ### Deleting the Key Pair Use gpg `--delete-secret-key` and `--delete-key` with the email used for the key to delete the key pair. ```shell $ gpg --delete-secret-key ditwl_infradmin_gpg@itwonderlab.com $ gpg --delete-key ditwl_infradmin_gpg@itwonderlab.com ```