rnp - Man Page

By default, rnp will apply a COMMAND, additionally configured with Options, to all INPUT_FILE(s) or stdin if no INPUT_FILE is given. There are some special cases for INPUT_FILE :

• - (dash) substitutes to stdin
• env:VARIABLE_NAME substitutes to the contents of environment variable VARIABLE_NAME

Depending on the input, output may be written:

• if --output option is given output is written to the path specified (or to the stdout if - is used)
• to the INPUT_FILE with a removed or added file extension (.pgp, .gpg, .asc, .sig), depending on operation.
• to the stdout if input was read from the stdin.

If output file already exists, it will not be overwritten, unless --overwrite option is given.

Without the --armor option, output will be in binary.

If COMMAND requires public or private keys, rnp will look for the keyrings in ~/.rnp. The options --homedir and --keyfile override this (see below).

If COMMAND needs a password, rnp will ask for it via stdin or tty, unless the --password or --pass-fd option was specified.

-h,  --help

Displays a short help message. No options are expected.

-V,  --version

Displays version information. No options are expected.

-e,  --encrypt

Encrypt data with public key(s), and optionally sign, if the --sign command is added.

You would likely want to specify one or more --recipient(s) or pick a --cipher (instead of the default).

Additional options:

--recipient

Specify one or more recipients.

--cipher

Select a specific cipher.

-z 0..9, --zlib,  --zip,  --bzip

Select a compression algorithm and level.

--armor

Output ASCII data instead of binary via the --armor option. If the input file is file.ext, and --output is not specified, then the data will be written (depending on --armor option) to file.ext.pgp or file.ext.asc.

--no-wrap

Do not wrap the output in literal data packet. This could be used to encrypt a file which is already signed or encrypted. By default this would also disable compression, use option -z to override.

--overwrite

If the destination file already exists, and the --overwrite option is not given, the caller will be asked for the permission to overwrite or to provide a new file name. Please see the Options section for more information.

-c,  --symmetric

Encrypt data with password(s).

Can be combined with the commands --encrypt and --sign.

Options that apply to the --encrypt command also apply here.

Additional options:

--passwords

Encryption to multiple passwords is possible with --passwords option. Each password would be asked via stdin/tty unless --password or --pass-fd is specified.

-s,  --sign

Digitally sign data, using one or more secret keys you own.

Public-key or password-based encryption may be added via the --encrypt and --symmetric commands.

Additional options:

-u,  --userid

By default, the first secret key you own will be selected for signing. Apply this option to select a different key or to use multiple keys.

--detach

By default, the signature is stored together with signed data. This option detaches the data signature to a separate file (file.ext.sig).

--hash

You may want to use --hash option to override default hash algorithm settings. As with encryption, output may be converted to ascii via the --armor option.

Compression options also apply here. Since the secret key is usually stored encrypted, you will be asked for the password to decrypt it via stdin/tty unless --password or --pass-fd is specified.

--clearsign

Digitally sign text data, producing human-readable output with the signature attached.

In this mode, data cannot be additionally encrypted or compressed.

Other signing options, --hash, -u, --password, can still be used here.

-d,  --decrypt

Decrypt and verify data from the INPUT_FILE or stdin.

If the data is signed, signature verification information will be printed to stdout/tty.

Additional options:

--output

Override the default output selection with a file name or stdout specifier (-). For the default output path selection see the Basics section.

--password,  --pass-fd

Depending on encryption options, you may be asked for the password of one of your secret keys, or for the encryption password. These options override that behavior such that you can input the password through automated means.

-v,  --verify

Verify signature(s) without writing embedded data out, if any (unless option --output is specified).

To verify the detached signature of a file file.ext, the detached signature file in the file name pattern of file.ext.sig or file.ext.asc must exist.

Also you may use option --source to specify the exact source for the signed data.

If data is encrypted, you may be asked for password as in the --decrypt command.

--list-packets

Show detailed information about the OpenPGP data in INPUT_FILE or stdin. Useful for curiosity, troubleshooting or debugging.

Additional options can be used:

--json

output JSON data instead of human-readable information

--grips

print out key fingerprints and grips

--mpi

print out all MPI values

--raw

print raw, hex-encoded packets too

--enarmor[=msg|pubkey|seckey|sign]

Convert binary data to the ASCII-armored as per OpenPGP standard. This includes the -----BEGIN PGP MESSAGE----- header and footer, and Base64-encoded data.

Output for file.ext will be written to file.ext.asc (if it does not exist) or to stdout.

The following OpenPGP headers may be specified:

msg (default)

-----BEGIN PGP MESSAGE-----

pubkey

-----BEGIN PGP PUBLIC KEY BLOCK-----

seckey

-----BEGIN PGP SECRET KEY BLOCK-----

sign

-----BEGIN PGP SIGNATURE-----

Additional options:

--overwrite

Forcefully overwrite existing destination file if it exists.

--output

Specify destination file path.

--dearmor

Attempts to convert data from an armored format to the binary format.

The file.ext.asc output file would be written to file.ext. If the destination file already exists, it will prompt the user for a new filename.

Additional options:

--overwrite

Forcefully overwrite existing destination file if it exists.

--output

Specify destination file path.

rnp --homedir .rnp --encrypt -r 0x6E69636B6F6C6179 --output document.txt.encrypted document.txt

Load keyrings from the .rnp folder, encrypt the document.txt file using the key with keyid 0x6E69636B6F6C6179.

rnp --keyfile john-sec.asc -s --detach --hash SHA512 document.txt

Generate a detached signature over the file document.txt, using the secret key stored in the file. Additionally override the hash algorithm to SHA512.

rnp --keyfile john-pub.asc --verify document.txt.sig

Verify detached signature, using the key stored in the john-pub.asc file. The signed data is assumed to be available from the file document.txt.

rnp -e -c -s --passwords 3 -r 0x526F6E616C642054 -r "john@doe.com" -u 0x44616E69656C2057 document.txt

Encrypt document.txt with 2 keys (specified via keyid 0x526F6E616C642054 and userid john@doe.com), and 3 passwords, so any of these may be used to decrypt the resulting file.

Additionally, the message will be signed with key 0x44616E69656C2057.

printf "Message" | rnp --keyfile env:PGP_ENCRYPTION_KEY -e - --armor

Encrypt message, passed via stdin, using the key, stored in environment variable PGP_ENCRYPTION_KEY, add ascii armoring, and print result to the stdout.