# GnuPG Cryptographic Key Management & Pinentry Guide

Subsystem: Snigdha Privacy Suite
Application: GnuPG 2.4.x / Pinentry
Distribution: Snigdha OS Decentralized

---

# 1. Overview & Operational Standards

GnuPG provides standard OpenPGP public-key cryptography for document signing, verification, file encryption, and identity verification.

---

# 2. Key Lifecycle Operations

# A. Key Generation

Generate modern ECC keys (Ed25519 for signing, Curve25519 for encryption):

gpg --full-generate-key
# Select: (9) ECC (Sign and Encrypt) -> Curve 25519

# B. Revocation Certificates

A revocation certificate is generated automatically upon key creation and stored in: ~/.gnupg/openpgp-revocs.d/<FINGERPRINT>.rev

Critical Step: Store this revocation certificate securely on independent, offline storage. If your private key or passphrase is lost, this certificate is the only method to revoke the key.

# C. Exporting Keys

# Export public key for distribution
gpg --armor --export <KEY-ID> > public-key.asc

# Export encrypted private key backup
gpg --armor --export-secret-keys <KEY-ID> > secret-backup.asc

# D. Verification and Signing

# Sign a document
gpg --armor --detach-sign document.pdf

# Verify a signature
gpg --verify document.pdf.asc document.pdf

---

# 3. Storage & Volatility Architecture

• Agent Volatility: gpg-agent sockets reside in /run/user/1000/gnupg/ (RAM tmpfs). Passphrase caches are destroyed immediately upon process exit or system lock.
• Persistence Integration: Secret keyrings persist across boots ONLY when the Phase 4 gnupg persistence feature adapter is activated. Bind-mounts ~/.gnupg/ to /run/snigdha/persistence/features/gnupg with Mode 0700.
• No Automatic Telemetry or Keyserver Uploads: Keyservers are never contacted automatically without explicit user flags (--keyserver).