Enigmail guide is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
Based on a work at mkaysi.github.com.
This depends on your OS. You should also read my previous guides about GPG and Icedove / Thunderbird.
+You need at least packages icedove or thunderbird and enigmail, but I recommend you to install gnupg2 and pinentry packages too.
+++aptitude install thunderbird enigmail gnupg2 pinentry-curses pinentry-gtk2 pinentry-qt4
+
NOTE: In Debian Thunderbird is called Icedove and the package is icedove.
+You need GPG-tools, Thunderbird and Enigmail
+You need GPG4Win, Thunderbird and Enigmail.
+If Enigmail wizard doesn't appear by itself, open it manually from OpenPGP (menu) --> Enigmail wizard.
+NOTE: Allow wizard to do changes, which it wants.
+You probably want to see the HTML in case the message has been sent using HTML.
+You can see the messages in original HTML easily. Open View (menu) --> Message body as --> Original HTML.
+This is documented in my Icedove / Thunderbird guide.
+Open Edit --> Account Settings --> OpenPGP security and select "Enable OpenPG support (Enigmail) with this user information". Then select "Use specific OpenPGP key" and press the "select key" button. Now just select your private key.
+After you have selected the key, I recommend you to select the first and the second boxes, which are about signing.
+Remember to do this for multiple identities. Select the account and then click the "manage identities" button.
+I have documented this in my Icedove / Thunderbird guide.
+This only changes the charset line to UTF-8 or removes the mentioning of charset in signature.
+Adele is PGP email bot. You can send email to it and it will tell you if it can decrypt your email or is it signed.
+You can get the PGP key of Adele by running
+++gpg2 --keyserver pool.sks-keyservers.net --recv-keys 92AB3FF7
+
Just send your email to adele-en@gnupp.de and it will reply shortly.
+PGP/MIME puts the signature to signature.asc ataachment and PGP/INLINE into "mess" in the bottom of email.
+WARNING: This might not work with some mailing lists (for example Ubuntu, Mozdev and GnuPG mailing lists)!
+There is open bug report about PGP/MIME not working on Ubuntu MLs at LaunchPad, 996581
+NOTE: If you want to sign emails and use HTML at the same time, you must use PGP/MIME or otherwise your signature cannot be verified!
+To send PGP/MIME by default, open Edit --> Account Settings --> OpenPGP security and check "Use always PGP/MIME".
+Remember to check to do this for your all identities in case you have more than one of them. Edit --> Account Settings --> "Manage Identities..." button and after selecting identity, you can find OpenPGP security tab.
+To enable sending OpenPGP headers, return to OpenPGP settings (mentioned above) and click "advanced".
+Select the both checkboxes and write URL where your key is located. If you don't have homepage, you can link to webui of your preferred keyserver.
+These headers appear in email source like this:
+OpenPGP: id=82A46728;
+ url=http://mkaysi.github.com/PGP/key.txt
Enigmail guide is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
Based on a work at mkaysi.github.com.
Note: If gpg2 gives you error about invalid/unknown/etc. command, use gpg instead.
+You need at least package gnupg, but I recommend installing packages icedove enigmail pinentry pinentry-curses pinentry-gtk2 pinentry-qt4 signing-party and gnupg2.
+++aptitude install gnupg gnupg2 icedove enigmail pinentry-curses pinentry-gtk2 pinentry-qt4 signing-party gnupg2
+
NOTE: If you aren't using Debian, install package "thunderbird" instead of "icedove".
+You need at least GPG-tools, but I also recommend you to install Thunderbird and Enigmail.
+You need at least GPG4Win, but I recommend installing Thunderbird and Enigmail too.
+This depends are you generating a new key or importing old key.
+Open terminal (or cmd.exe if you are using Windows) and run
+++gpg2 --gen-key
+
Notes:
+When you are asked for key size, enter the maximum size.
When you are asked for email address, leave it empty. We will add it later.
First you need to find out the ID of the key, which you just created. You can see it with two commands.
+++gpg2 --list-keys
+
Example output:
+% gpg --list-keys
+pub 4096R/82A46728 2012-03-27
+uid Mika Suomalainen
+sub 4096R/A4271AC5 2012-03-27or
+++gpg2 --fingerprint
+
Example output:
+% gpg2 --fingerprint
+pub 4096R/82A46728 2012-03-27
+Key fingerprint = 24BC 1573 B8EE D666 D10A AA65 4DB5 3CFE 82A4 6728
+uid Mika Suomalainen
+sub 4096R/A4271AC5 2012-03-27The second command also shows the key fingerprint which is usually used to identify the key. Note that you can see both keyid formats in fingerprint. The last eght characters in keyid are the short format and the last sixteen characters are the long format. If you want to see the long keyid, run
+++gpg2 --list-keys --keyid-format long
+
Now add the uid with the following commands:
+++gpg2 --edit-key KEYID
+
and enter command:
+++adduid
+
and you are asked for name and email address again. This time you can give them both.
+If that UID which has only your first name isn't the first UID, select it by giving command, which is the number of the UID, for example:
+++2
+
and * appears to that UID to tell you that that UID is selected. Now give command
+++primary
+
to make it the primary UID again.
+Now you can exit from GPG with
+++quit
+
and confirm to save changes with
+++y
+
You can import your old private key same way as you import public keys. This means:
+++gpg2 --import key.asc
+
Where key.asc is the file, which contains the (private) key(s)
+You need to know your keyid. I told you how to get it in "Adding new uids". To back up your private key, run
+++gpg2 --export-secret-keys -a KEYID
+
and save the output of that command to file. If you are on Linux or Mac OS X, you can forward the output directly to file, with
+++gpg2 --export-secret-keys -a KEYID > privatekey.asc
+
The previous command creates a file called "privatekey.asc", which contains the output of the first command.
+The configuring of gpg happens in gpg configuration directory. In Linux and Mac this is ~/.gnupg/gpg.conf.
+I recommend you to add following lines to it. I'll try to explain them with my best ability.
+# Options for GnuPG # Copyright 1998, 1999, 2000, 2001, 2002, 2003, # 2010 Free Software Foundation, Inc. # # This file is free software; as a special exception the author gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. # # This file is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY, to the extent permitted by law; without even the # implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. License information so I won't break license of the default config file, which I have appended.
++default-key KEYID
+
So KEYID is used by default if there are multiple secret keys.
+default-recipient-self
+encrypt-to KEYIDSo everything what you encrypt is also encrypted to you.
+++charset UTF-8
+
So UTF-8 is used as default character set and most of characters can be used.
+keyserver hkp://pool.sks-keyservers.net
+keyserver-options auto-key-retrieve no-include-revoked verboseSo default keyserver is specified and unknown keys are always received when something what requires missing key is procressses and revoked keys aren't included in search results and verbose output is used.
+By the way, you can find my gpg.conf here.
+Group lines are a way to write email to one recepient and have it encrypted to multiple keys automatically.
+Example group line:
+++group =82A46728 8449A12B 666CC0DD 4EC00206
+
With that line, when recepient is touchlay-server@googlegroups.com, then emails are encrypted to those 4 keys.
+NOTE: I think that group lines require email addresses to be in format
++ ++
See also my Enigmail instructions about group lines.
+GPG can automatically add comments to signed and encrypted content. They are usually hidden by email clients, which support GPG.
+Example comment:
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+Signed content.
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (GNU/Linux)
+Comment: This is a comment.
+
+iQIcBAEBAgAGBQJP0ypzAAoJEE21PP6CpGcojpsP/jV8o398xaCOCtdk5gyZtSZG
+KYDbyV8dNk1jxyNb7yPuEHGdm2BNXuKDHoG1vOli1yfavDvZ7Ir6i6HqDINRt6QF
+TFcWQgurMtXEJ4zCbMwBHM5OCpRL0gtuK/ERZFWeA+zDuM/pDKWLcX9REriT5CaG
+CWBBvCIf/C2imGqe3+KBKSy13pis7MXARCTHesTOV/z04vKfsVqh7+M60ss/sc48
+kkL7CR/RiovomeoDhWuwS63oDE49eG+hlMDswgehnx71bvYr2NBZ3qfls4utx3fj
+ro4ubRGW52tY9wIC1tZoNiqa/n9Z6jOIq76Vn5DaJQ1dKWn3MnA5Sv2ztV4GlaIO
+iTLkvavAe7KHVxDCKcHpI7vnj9JlahF1u8+JDHXbTePDE3MiQvK1uEK91EQP9kYT
+EYQwuClDfVGNBgqORTzZUpszYrT1dCdLte+29RdkHzsC+32x540xLvkDFvkZ+92Y
+7LxCX83aKzIdAZmehNmSrzQAL+NCfMW3YjkvWOYoFFMd//nSVifCbxvRLsyv7npr
+Fowb/UnnZW3ScT/sFNJWH/xY5skDS8WZd3H6O7MJ8gHUeOR9YQepQX56kvSRVtbj
+ncnVEtqLjlbMpHEFy9ykKgM6rzuRTzLRct7Tf787Ww4hgSN92lhetPZmi6BGcS1z
+ZRzFq367A+HsVMlihBjd
+=HKS4
+-----END PGP SIGNATURE-----To add comments, use "--comment" flag or add "comment" lines to gpg.conf:
+For example:
+++comment "Something"
+
Appears as
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+
+This is signed content, which has comment, which reads "Something".
+
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.19 (GNU/Linux)
+Comment: Something
+
+iQIcBAEBAgAGBQJP0yt8AAoJEE21PP6CpGcoHskP/jLift0y8tA7VnmbIyFfOr2J
+RVJfcc/cl8xvbnhSKIOa5rS47Z9MgVqf8KDY373E1CZMvOsdx4yPINMJb4901iBQ
+71RCRcg45YUI+yWRlZ2+ZsE7NBgUWm2cdSbwfaWrxH2eL8zRN+G5c3qiAQu0pXY5
+Mc1MG6ZQQzz3v+SrYPB6aZn8R8uNQR6U1YfbhtG1daxIfzdbXQNqMi/pIDV+M5GY
+IS3Wbbp57pvJ8R3EjvqMsDKv76L/ZFySlrAugQaZIj4lQVUzXhivBwzkaHslj6dP
+HSGamz3C4yX5GPe/QBJ8jgANAtmdx2+1IpoRRqiLrOOT48vRkCFM40VwjMVO4W+B
+wNg9BQUpB53/QBtpQ5kDHrpPA+6bS4QkzUIzMsMuSvF9w15vG+Ae7qozD/YTLeD/
+IBaRlqPIRI/CrOEfUfn0DE6bFKTMgf4WE5M8IZ2kBVAE/mBqicJ9QKI53it8Ru4M
+hznPzwtmQTHf02yaj06LjB1P0SYU3gjwioRN+3RVoCRC92rjW5gN4MBYR0jKydp6
+MHf2Mg+ped1BegBDEVD4FyDPw/LNmveZb5O8/KIpjdb9dMgP5uqDpvJEzS64OQf0
+vtzYEnCrJW+/1ABuGoF2aKG7+i24gLt9re+jOb02dj5NxRc1tWmhVNVM/acwReVr
+1ELecm6kOS0qlPF//OnU
+=Ilhi
+-----END PGP SIGNATURE-----Comments can be whatever you want. For example they can have link to your homepage or command to receive your key from keyserver etc.
+There are two ways to share your key. I personally use and recommend them both.
+If you have homepage, it's recommended that you put your key there. My key can be found at PGP/key.txt
+You can get your public key with command
+++gpg2 --export -a KEYID
+
or if you use Linux and have installed package signing-party, you can use
+++pgp-clean KEYID
+
to get your public key without signatures (I will explain them later). WARNING: pgp-clean seems to also remove encryption subkey.
+If you followed my configuration, you are usng pool.sks-keyservers.net as your keyserver and you are automatically receiving unknown keys from t, whenever you try to verify something, what is signed with unknown key.
+To send your public key to keyserver, run
+++gpg2 --send-keys KEYID
+
To receive key from keyserver, run
+++gpg2 --recv-keys KEYID
+
To search keys from keyserver, use
+++gpg2 --search-keys QUERY WORDS
+
or if you are using Linux and have packages signing-party and dialog installed, you can use
+++keylookup QUERY WORDS
+
Keyservers only append content. Information on keyserver cannot be removed. This means, that when you delete uid, signature or whatever, it reappears when you run
+++gpg2 --refresh-keys
+
or receive your key from keyserver again. Thought content (uids, signatures, keys etc.) can be revoked.
+But you should continue reading to understand how to use GPG without email client.
+If you want to make gpg know that you trust key of another person, you have two opinons. Enter the "key editing shell", with
+++gpg2 --edit-key KEYID
+
and
+Lsign signs the key locally making it impossible to export the signature. Use it if you trust the key owner to be who the key says, but you haven't met him/her personally.
+Lsign the key with
+++lsign
+
and then you can exit gpg with
+++quit
+
confirming to svae changes with
+++y
+
If you trust the key owner to be whom the key says and you have met him/her personally and have seen proof of his/her identify (i.e. passport) or he/she is member of your family or long time friend, you can sign the key with
+++sign
+
making the signature exportable or sendable to keyserver. Now exit gpg with
+++quit
+
saving the changes with
+++y
+
and send the signed key to keyserver with
+++gpg2 --send-keys KEYID
+
Other people will see your signature next time when they receive the key agan or run
+++gpg2 --refresh-keys
+
NOTE: You can upgrade lsigned signature to signed signature with the "sign" command.
+Trust determines does gpg trust the key to validate other keys. Trust is only visible to you. You can se trust with
+++trust
+
and then exit gpg with
+++quit
+
saving the changes with
+++y
+
Run
+++gpg2 --clearsign
+
and write your message. When you are ready, add one empty line and press CTRL-D and gpg outputs signed message.
+Just run
+++gpg2 --clearsign file.txt
+
and the signed content will be found from file.txt.asc
+NOTE: .asc is same as .txt and can be opened with normal text editor.
+Just run
+++gpg2
+
and paste the signed content, add one empty line and press CTRL-D.
+Run
+++gpg2 --verify file.sig
+
and you are asked for signed file.
+To encrypt a message, just run
+++gpg2 --encrypt -a -r receiver (-r receiver...)
+
If you followed my configuration instructions, you are automatically receiver. Replace "receiver" with KEYID. Write your message, add empty line and press CTRL-D and gpg outputs encrypted content.
+Just run
+++gpg2 --decrypt
+
paste the encrypted content, add empty line and press CTRL-D and gpg outputs, the decrypted content.
+My Icedove / Thunderbird guide and Enigmail guide.
+
GPG guide by Mika Suomalainen is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
Just email me, the addresses can be found from my GPG key, which has been mentioned on this page some times. Please cleasign your question, so I won't get power to fake it, and please don't use HTML.
diff --git a/articles/guides/GPG/GPG.html.md b/articles/guides/GPG/GPG.html.md new file mode 100644 index 0000000..5022ba0 --- /dev/null +++ b/articles/guides/GPG/GPG.html.md @@ -0,0 +1,447 @@ +# Quick GPG guide + +Note: If gpg2 gives you error about invalid/unknown/etc. command, use gpg instead. + +## What do you need:? + +### Linux (Debian based distributions) + +You need at least package gnupg, but I recommend installing packages +icedove enigmail pinentry pinentry-curses pinentry-gtk2 pinentry-qt4 signing-party and gnupg2. + +> # aptitude install gnupg gnupg2 icedove enigmail pinentry-curses pinentry-gtk2 pinentry-qt4 signing-party gnupg2 + +NOTE: If you aren't using Debian, install package "thunderbird" instead of "icedove". + +### Mac OS X + +You need at least [GPG-tools], but I also recommend you to install [Thunderbird] and [Enigmail]. + +[GPG-tools]:http://www.gpgtools.org/ +[Thunderbird]:https://www.mozilla.org/en-US/thunderbird/ +[Enigmail]:http://enigmail.mozdev.org/home/index.php.html + +### Windows + +You need at least [GPG4Win], but I recommend installing [Thunderbird] and [Enigmail] too. + +[GPG4Win]:http://www.gpg4win.org/ +[Thunderbird]:https://www.mozilla.org/en-US/thunderbird/ +[Enigmail]:http://enigmail.mozdev.org/home/index.php.html + +### Step 1 + +This depends are you generating a new key or importing old key. + +#### Step 1: Generating a new key + +Open terminal (or cmd.exe if you are using Windows) and run + +> gpg2 --gen-key + +Notes: + +1. When you are asked for key size, enter the maximum size. + +2. When you are asked for email address, leave it empty. We will add it later. + +##### Adding new UIDs (User IDentities) + +First you need to find out the ID of the key, which you just created. You can see it with two commands. + +> gpg2 --list-keys + +Example output: + +``` +% gpg --list-keys +pub 4096R/82A46728 2012-03-27 +uid Mika Suomalainen +sub 4096R/A4271AC5 2012-03-27 +``` + +or + +> gpg2 --fingerprint + +Example output: + +``` +% gpg2 --fingerprint +pub 4096R/82A46728 2012-03-27 +Key fingerprint = 24BC 1573 B8EE D666 D10A AA65 4DB5 3CFE 82A4 6728 +uid Mika Suomalainen +sub 4096R/A4271AC5 2012-03-27 +``` + +The second command also shows the key fingerprint which is usually used to identify the key. Note that you can see both keyid formats in fingerprint. The last eght characters in keyid are the short format and the last sixteen characters are the long format. +If you want to see the long keyid, run + +> gpg2 --list-keys --keyid-format long + +Now add the uid with the following commands: + +> gpg2 --edit-key KEYID + +and enter command: + +> adduid + +and you are asked for name and email address again. This time you can give them both. + +If that UID which has only your first name isn't the first UID, select it by giving command, which is the number of the UID, for example: + +> 2 + +and * appears to that UID to tell you that that UID is selected. Now give command + +> primary + +to make it the primary UID again. + +Now you can exit from GPG with + +> quit + +and confirm to save changes with + +> y + +#### Step 1: Importing old key + +You can import your old private key same way as you import public keys. This means: + +> gpg2 --import key.asc + +Where key.asc is the file, which contains the (private) key(s) + +### Step 2: backing up the key + +You need to know your keyid. I told you how to get it in "Adding new uids". To back up your private key, run + +> gpg2 --export-secret-keys -a KEYID + +and save the output of that command to file. If you are on Linux or Mac OS X, you can forward the output directly to file, with + +> gpg2 --export-secret-keys -a KEYID > privatekey.asc + +The previous command creates a file called "privatekey.asc", which contains the output of the first command. + +### Step 3: Configuring gpg(2) + +The configuring of gpg happens in gpg configuration directory. In Linux and Mac this is ~/.gnupg/gpg.conf. + +I recommend you to add following lines to it. I'll try to explain them with my best ability. + +``` +# Options for GnuPG +# Copyright 1998, 1999, 2000, 2001, 2002, 2003, +# 2010 Free Software Foundation, Inc. +# +# This file is free software; as a special exception the author gives +# unlimited permission to copy and/or distribute it, with or without +# modifications, as long as this notice is preserved. +# +# This file is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the +# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +``` +License information so I won't break license of the default config file, which I have appended. + +> default-key KEYID + +So KEYID is used by default if there are multiple secret keys. + +``` +default-recipient-self +encrypt-to KEYID +``` + +So everything what you encrypt is also encrypted to you. + +> charset UTF-8 + +So UTF-8 is used as default character set and most of characters can be used. + +``` +keyserver hkp://pool.sks-keyservers.net +keyserver-options auto-key-retrieve no-include-revoked verbose +``` + +So default keyserver is specified and unknown keys are always received when something what requires missing key is procressses and revoked keys aren't included in search results and verbose output is used. + +By the way, you can find my gpg.conf [here]. + +[here]:https://raw.github.com/Mkaysi/shell-things/master/gnupg/gpg.conf + +#### Group lines + +Group lines are a way to write email to one recepient and have it encrypted to multiple keys automatically. + +Example group line: + +> groupOn Debian you need package Icedove, but you should also install Enigmail and GnuPG and GnuPG2
+++aptitude install icedove enigmail gnupg gnupg2
+
On Ubuntu you should install same packages as with Debian, but Icedove is called as Thunderbird.
+++aptitude install icedove enigmail gnupg gnupg2
+
You need Thunderbird, but you should also install GPG-Tools and Enigmail.
+You need at Thunderbird, but you should also install GPG4Win and Enigmail.
+When you open Thunderbird / Icedove for the first time, it will ask for email address and password. Give them and Thunderbird will attempt to find the details and after that it downloads emails from the server.
+To send emails in plaintext, open Edit --> Account settings --> Composition & Addressing and uncheck the box "Compose messages in HTML format.
+See my complaining about HTML usage here.
+This doesn't affect emails with any visible way. It might just remove some charters in message source and it will allow you to send more charters than some latin1 charset. It might also remove charset line in PGP/INLINE signed emails.
+Open Edit --> Preferences --> Display --> Formatting --> Advanced... --> Character Encodings and set both "Outgoing Mail" and "Incoming Mail" as "Unicode UTF-8" and check the checkbox "When possible, use the default character encoding in replies."
+I am going to write explaining for this later.
+My GPG guide and my Enigmail guide.
+
Thunderbird / Icedove guide is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
Based on a work at mkaysi.github.com.
This mirror might be outdated unless you are looking at http://mkaysi.github.com/
[GitHub]
cadoth — cadoth doesn't have any other address than IP right now.
- +[marduk]
mkaysi.github.com by Mika Suomalainen is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
Based on a work at mkaysi.github.com.