PEM2OPENPGP(1)

💅 PEM2OPENPGP(1) — the group chat version ✨

okay bestie, so this is a page from the General Commands Manual (section 1, the classic "user commands" energy) and it's about a lil tool called pem2openpgp. sit down, grab a strawberry 🍓, we're doing crypto plumbing.

---

🌸 NAME 🌸

pem2openpgp — translate PEM-encoded RSA keys to OpenPGP certificates. that's the whole vibe. PEM goes in, OpenPGP comes out. ✨

---

🎀 SYNOPSIS 🎀

pem2openpgp $USERID < mykey.pem | gpg --import

PEM2OPENPGP_EXPIRATION=$((86400 * $DAYS))
            PEM2OPENPGP_USAGE_FLAGS=authenticate,certify pem2openpgp
            $USERID <mykey.pem

yeah it's a pipe situation. we love a pipeline. 🫶

---

🦋 DESCRIPTION 🦋

pem2openpgp is a low-level utility for transforming raw, PEM-encoded RSA secret keys into OpenPGP-formatted certificates. it's giving backstage-pass, not front-of-house. 💅

🚨 okay so major thing: the generated certificates include the secret key material, so they should be handled carefully. like, actually carefully. no cap. this is not the file to be posting in the group chat. 💀

it works as an element within a pipeline: feed it the raw key on stdin, supply the desired User ID as a command line argument. and bestie — note that you may need to quote the string to ensure that it is entirely in a single argument. one argument. singular. don't let the shell split your User ID, it will and you'll be sad. 😭

other choices about how to generate the new OpenPGP certificate are governed by environment variables. yes, env vars. that's the whole control panel. ✨

---

🌈 ENVIRONMENT 🌈

the following environment variables influence the behavior of pem2openpgp:

• PEM2OPENPGP_TIMESTAMP controls the timestamp (measured in seconds since the UNIX epoch) indicated as the creation time (a.k.a "not valid before") of the generated certificate (self-signature) and the key itself. by default, pem2openpgp uses the current time. ⏰ iconic default tbh.
• PEM2OPENPGP_KEY_TIMESTAMP controls the timestamp (measured in seconds since the UNIX epoch) indicated as the creation time of just the key itself (not the self-signature). by default, pem2openpgp uses the value from PEM2OPENPGP_TIMESTAMP. so it inherits. like a good little sibling. 🫶
• PEM2OPENPGP_USAGE_FLAGS should contain a comma-separated list of valid OpenPGP usage flags (see section 5.2.3.21 of RFC 4880 for what these mean, iykyk). the available choices are:
  • certify
  • sign
  • encrypt_comms
  • encrypt_storage
  • encrypt (this means both encrypt_comms and encrypt_storage) 👑
  • authenticate
  • split
  • shared

by default, pem2openpgp only sets the certify flag. minimalist. respect. ✨

• PEM2OPENPGP_EXPIRATION sets an expiration (measured in seconds after the creation time of the key) in each self-signature packet. by default, no expiration subpacket is included. forever and ever, allegedly. 🙈
• PEM2OPENPGP_NEWKEY indicates that pem2openpgp should ignore stdin, and instead generate a new key internally and build the certificate based on this new key. set this variable to the number of bits for the new RSA key (e.g. 3072). by default (when this is unset), pem2openpgp will read the key from stdin. 🧚

---

👑 AUTHOR 👑

pem2openpgp and this man page were written by Daniel Kahn Gillmor <dkg@fifthhorseman.net>. absolute main character energy. we stan. 💖

---

💀 BUGS 💀

okay so here's the honesty section, and honestly? refreshing. 😌

• only handles RSA keys at the moment. it might be nice to handle DSA keys as well.
• currently only creates certificates with a single User ID. should be able to create certificates with multiple User IDs.
• currently only accepts unencrypted RSA keys. it should be able to deal with passphrase-locked key material.
• currently outputs OpenPGP certificates with cleartext secret key material. it would be good to be able to lock the output with a passphrase.

🙈 bestie, that last one is a whole mood and not in a cute way. cleartext secret key material. protect that file like it's your notes app. 🔥

if you find other bugs, please report them at https://labs.riseup.net/code/projects/show/monkeysphere — go be helpful, it's a slay. 🫶

---

🎀 SEE ALSO 🎀

• openpgp2ssh(1)
• monkeysphere(1)
• monkeysphere(7)
• ssh(1)
• monkeysphere-host(8)
• monkeysphere-authentication(8)

the whole friend group fr fr. 🦋

---

✨ and that's the page, bestie ✨ this one's shipped by Debian, dated Jan 22,, 2019 (yes, that's the date as written, double comma and all, I don't make the rules 💅), and it's still PEM2OPENPGP(1) at the bottom too. periodt. 💖