As many of you likely know, duplicity is a software program primarily used on Linux operating systems for creating backups of your desktop environment. The software is known to use gpg to encrypt the backup files for privacy reasons.

Now my question is the following: how do you both encrypt and digitally sign your backup files? When used without any command parameters, the software simply prompts the user for a passphrase and then it symmetrically encrypts the files by default using it.

But how do you also digitally sign in the process. The manual talks about the --sign-key and --encrypt-key parameters that need to be passed but trying different combinations, I could never figure out how to do it.

UPDATE: as pointed out in the comment section, I was using the encrypt command wrong. Apparently you need to use the same keyID from GPG for both --sign-key or --encrypt-key (and thus the same passphrase for both). A revised question now would be: how is passing a public-private keypair to GPG for symmetric encryption via the keyID work (does it encrypt using the private key? And if so, is it the standard symmetric algorithm used for encryption?). Also, is it possible to symmetrically encrypt with one keyID and sign with a different key from gpg?

Thank you

  • What have you tried exactly? My little of research seems to indicate how you do this is straight forward.Duplicity - secure incremental backup, How To Use Duplicity with GPG to Securely Automate Backups on Ubuntu duplicity --encrypt-key "gpg key id" --sign-key "gpg key id" seems straight forward. – Ramhound May 10 '16 at 20:37
  • 1
    Yes, simple encryption is straightforward. But signing requires the --sign-key parameter which prompts for 1 passphrase and 1 passphrase for signing in the command line. If they are different, it will say something along the lines of "signing passphrase must be equal to encryption passphrase". If they are the same though, it gives me another error of "secret key not found". Doing it with the --encrypt-key parameter yields the same results. – Alex May 10 '16 at 20:43
  • 1
    You are correct, in order to encrypt and digital sign the file created, the gpg key must be the same per the example I provided. I didn't provide the entire command, but command I provided, is based on the linked command which does work. Error messages that are not the exact error messages you get are not that helpful, I can't perform research on, something along the lines of "signing passphrase must be equal to encryption passphrase" – Ramhound May 10 '16 at 20:46
  • OK, to reproduce: I entered "duplicity --sign-key <my key> Testing/ file:///home/alex/Desktop/" in terminal. The "GnuPG passphrase: " string then followed. I input a passphrase then. Then a "GnuPG passphrase for signing key: " string appeared. I entered my passphrase for <my key> this time. A different passphrase from the first one (which I chose randomly). Then the error "When using symmetric encryption, the signing passphrase must equal the encryption passphrase." appeared. I don't understand why this error appeared at all – Alex May 10 '16 at 21:16
  • Feel free to update your quesiton, so it includes, all relevant information. I thought you were getting an error, based on this last infomration, it sounds like you are not getting an error after all. Why are you entering a differerent passphrase, if you know, you have to use the same gpa key? – Ramhound May 10 '16 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.