-
Notifications
You must be signed in to change notification settings - Fork 0
/
gpg.conf
143 lines (108 loc) · 5.84 KB
/
gpg.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
###############################################################
# DURACONF #
# A GnuPG configuration file with hardened security settings. #
###############################################################
# Put this file at ~/.gnupg/gpg.conf
# Forked from these sources:
# https://github.com/EFForg/duraconf/blob/master/configs/gnupg/gpg.conf
# https://gitweb.torproject.org/torbirdy.git/tree/gpg.conf
# https://github.com/ioerror/duraconf/blob/master/configs/gnupg/gpg.conf
# This is an implementation of the Riseup OpenPGP Best Practices.
# https://help.riseup.net/en/security/message-security/openpgp/best-practices
# DEFAULT KEY
#---------------------------------------
# The default key to use for signing. If this option is not used, the default
# key is the first key found in the secret keyring.
#default-key 0xD8692123C4065DEA5E0F3AB5249B39D24F25E3B6
# BEHAVIOR
#---------------------------------------
# Disable inclusion of the version string in ASCII armored output.
no-emit-version
# Disable comment string in clear text signatures and ASCII armored messages.
no-comments
# Long keyids are more collision-resistant than short keyids (it's trivial to
# make a key with any desired short keyid).
keyid-format 0xlong
# List all keys (or the specified ones) along with their fingerprints.
with-fingerprint
# Display the calculated validity of user IDs during key listings.
list-options show-uid-validity
verify-options show-uid-validity
# Try to use the GnuPG-Agent. With this option, GnuPG first tries to connect to
# the agent before it asks for a passphrase.
use-agent
# When verifying a signature made from a subkey, ensure that the cross
# certification "back signature" on the subkey is present and valid. This
# protects against a subtle attack against subkeys that can sign.
require-cross-certification
# When outputting certificates, view user IDs distinctly from keys.
fixed-list-mode
# Set the name of the native character set. This is used to convert some
# informational strings like user IDs to the proper UTF-8 encoding. Note
# that this has nothing to do with the character set of data to be encrypted
# or signed; GnuPG does not recode user-supplied data. If this option is not
# used, the default character set is determined from the current locale.
display-charset utf-8
# Include an unambiguous indicator of which key made a signature.
# (See http://thread.gmane.org/gmane.mail.notmuch.general/3721/focus=7234)
sig-notation [email protected]=%g
# KEYSERVER
#---------------------------------------
# This is the server that --recv-keys, --send-keys, and --search-keys will
# communicate with to receive keys from, send keys to, and search for keys on.
# To use hkps servers, on Debian-based systems you need to install gnupg-curl.
keyserver hkps://keys.openpgp.org
# If using the keyserver hkps://hkps.pool.sks-keyservers.net,
# provide a certificate store to override the system default.
# Get this from https://sks-keyservers.net/sks-keyservers.netCA.pem
# In GnuPG 2.1.11 or later, this is not necessary and should be disabled.
#keyserver-options ca-cert-file=/usr/local/etc/ssl/certs/hkps.pool.sks-keyservers.net.pem
# Set the proxy to use for HTTP and HKP keyservers - default to the standard
# local Tor socks proxy.
# It is encouraged to use Tor for improved anonymity. Preferrably use either a
# dedicated SOCKSPort for GnuPG and/or enable IsolateDestPort and
# IsolateDestAddr.
# For some systems, this setting isn't needed to proxy through Tor; simply
# specify a .onion keyserver and GnuPG may proxy through Tor automatically.
#keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050
# If proxying through Tor, use a Tor onion service as the keyserver.
# To use this, you should comment-out the non-Tor keyserver setting above.
# (qdigse2yzvuglcix.onion = zimmermann.mayfirst.org)
#keyserver hkp://qdigse2yzvuglcix.onion
# If proxying through Tor, don't leak DNS requests.
# See https://trac.torproject.org/projects/tor/ticket/2846
# This option is ignored and not applicable in GnuPG 2.1 or later.
keyserver-options no-try-dns-srv
# When using --refresh-keys, if the key in question has a preferred keyserver
# URL, then disable use of that preferred keyserver to refresh the key from.
# When creating a key, individuals may designate a specific keyserver to use
# for refreshing their keys. This option will disregard that designation and
# use the pool instead, which is useful because (1) it prevents someone from
# designating an insecure method for pulling their key and (2) if the server
# designated uses hkps, the refresh will fail because the ca-cert will not
# match, so the keys will never be refreshed.
keyserver-options no-honor-keyserver-url
# When searching for a key with --search-keys, include keys that are marked on
# the keyserver as revoked.
keyserver-options include-revoked
# ALGORITHMS AND CIPHERS
#---------------------------------------
# List of personal cipher preferences. When multiple ciphers are supported by
# all recipients, choose the strongest one.
personal-cipher-preferences AES256 AES192 AES CAST5
# List of personal digest preferences. When multiple digests are supported by
# all recipients, choose the strongest one.
personal-digest-preferences SHA512 SHA384 SHA256 SHA224
# Message digest algorithm used when signing a key.
cert-digest-algo SHA512
# This preference list is used for new keys and becomes the default for
# "setpref" in the edit menu.
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
# Cipher and digest algorithms used when encrypting private keys. That's the
# maximum s2k-count, and it makes your passphrase much harder to bruteforce if
# someone finds your key. You need to change your passphrase for it to take
# effect, though.
s2k-cipher-algo AES256
s2k-digest-algo SHA512
s2k-mode 3
s2k-count 65011712