sq-decrypt1
Decrypt a message
Usage
sq decrypt
[OPTIONS]
FILE
Overview
Decrypt a message.
Decrypt a message using either supplied keys, or by prompting for a password. If message tampering is detected, an error is returned. See below for details.
If certificates are supplied using the `--signer-file` option, any signatures that are found are checked using these certificates. Verification is only successful if there is no bad signature, and the number of successfully verified signatures reaches the threshold configured with the `--signatures` parameter.
If the signature verification fails, or if message tampering is detected, the program terminates with an exit status indicating failure. and the output file is deleted. If the output was sent to stdout, then the last 25 MiB of the message are withheld (consequently, if the message is smaller than 25 MiB, no output is produced).
The converse operation is `sq encrypt`.
Options
Subcommand options
-
--dump-session-key -
Print the session key to stderr
-
--output=FILE -
Write to FILE or stdout if omitted
-
[default:
-]
-
--recipient-file=KEY_FILE -
Decrypt the message using the key in KEY_FILE
-
--session-key=SESSION-KEY -
Decrypt an encrypted message using SESSION-KEY
-
--signatures=N -
Set the threshold of valid signatures to N
-
The message will only be considered verified if this threshold is reached. [default: 1 if at least one signer cert file is given, 0 otherwise]
-
--signer=FINGERPRINT|KEYID -
Require a signature from a certificate with the specified fingerprint or key ID
-
--signer-domain=DOMAIN -
Require a signature from a certificate where a user ID includes an email address for the specified domain
-
--signer-email=EMAIL -
Require a signature from a certificate where a user ID includes the specified email address
-
--signer-file=PATH -
Require a signature from a certificate read from PATH
-
--signer-userid=USERID -
Require a signature from a certificate with the specified user ID
FILE
|
Read from FILE or stdin if FILE is '-' |
|---|---|
|
[default: |
Global options
See sq(1) for a description of the global options.
Examples
Decrypt a file using a secret key
sq decrypt --recipient-file juliet-secret.pgp ciphertext.pgp
Decrypt a file verifying signatures
sq decrypt --recipient-file juliet-secret.pgp --signer-file \ romeo.pgp ciphertext.pgp
decrypt a file using the key store
sq decrypt ciphertext.pgp
Version
1.4.1
Releases
4 releases since Debian 11 (Bullseye); the text changed 3 times.
--dump-session-key since Debian 12 (Bookworm);
--recipient-file since Debian 13 (Trixie);
--session-key since Debian 12 (Bookworm);
--signer since Debian 13 (Trixie);
--signer-domain since Debian 13 (Trixie);
--signer-email since Debian 13 (Trixie);
--signer-file since Debian 13 (Trixie);
--signer-userid since Debian 13 (Trixie).
--dump until Debian 12 (Bookworm);
--help until Debian 12 (Bookworm);
--hex until Debian 12 (Bookworm);
--private-key-store until Debian 12 (Bookworm);
--recipient-key until Debian 12 (Bookworm);
--signer-cert until Debian 12 (Bookworm);
-h until Debian 12 (Bookworm);
-n until Debian 12 (Bookworm);
-o until Debian 12 (Bookworm);
-x until Debian 12 (Bookworm).