GnuPG/zh-cn

这篇短小的指南将教给你GnuPG——一个用于安全通讯的工具——的基本用法.

你能从本指南中得到什么
This guide assumes the reader is familiar with public-key cryptography, encryption, and digital signatures. If this is not the case take a look at the official GnuPG handbook, specifically the second chapter, and then come back to this article.

本指南将教给你如何安装GnuPG，如何创建密钥对，如何将密钥添加到公钥环当中，如何将你的公钥提交到密钥服务器以及如何签名、加密、验证或者解密你发送或者接受到的消息. 你还可以了解到如何对本地计算机上的文件加密，以防止他人读到其中内容.

Other software
At a very basic level GnuPG must be emerged. Many applications today have some sort of support for PGP, so having  as a USE variable is a good idea. When desiring an email client capable of using GnuPG any of the following options are well suited:
 * PinePGP ;
 * Mutt — A small but very powerful text-based mail client;
 * Thunderbird — Mozilla's e-mail solution;
 * Evolution — A GNOME Microsoft Outlook work alike;
 * KMail — KDE's mail client.

Installing Kgpg might be of interest if using the KDE desktop enviroment. This small program allows for the generation key pairs, importing of keys from ASCII files, signing imported keys, exporting keys, among a few other features.

创建密钥
To create a key, use the gpg --gen-key command. The first time it is ran, it will create some directories essential to the correct operation and implementation of GnuPG; run it again to create the keys:

此时，你可以选择你想使用的密钥的类型. 大多数用户会选择默认的DSA和ElGamal类型. 接下来就是密钥的大小；需要注意，虽然密钥越大越好，但是可不要对DSA/ElGamal使用大于2048的值. 对于普通的电子邮件来说，2048已经足够了.

在指定密钥大小之后，需要指定的是密钥的有效期. 在这里，有效期却是越小越好，但是大多数用户会选择一个永远不会过期的密钥，或者指定有效期为2、3年.

现在，你需要键入一些你自己的个人信息. 如果你想将自己的公钥送给其他人，那么在这里必须使用真实的电子邮件地址.

在这儿，请键入你的密码两次. 我推荐你使用一个比较复杂的密码. 因为，如果有人得到你的私钥并破解了你的密码，他们就可以发送冒充你的名义签名的消息，从而欺骗所有人相信这个邮件是你发送的.

接下来，GnuPG才会产生你的密钥. 动一下鼠标或者在后台播放一个mp3将有助于加速这个过程，因为这些动作都会帮助产生随机数据.

生成吊销证书
每当你创建了密钥，你必须同时创建这个密钥的吊销证书. 因为，一旦你的密钥发生不测（例如有人得到了你的密钥和密码），只有你提前这样做了，你才有能力吊销你的密钥使它无效.

The gpg --list-keys command lists keys in the public keyring. It may be used to see the ID of the key so that a revocation certificate can be created. It is a good idea to copy the entire directory and the revocation certificate (in ASCII armor - ) to some secure medium (a CD-R or a USB drive stored in a safe location). Remember that the file can be used to revoke the keys and make them unusable in the future.

导出密钥
To export a key, type gpg --armor --output larry.asc --export Larry@TheBarn.someplace.flick. You can almost always use the key ID or something that identifies the key (in this example an email address was used). Larry now has a that he can send his friends, or place on his web page so that others can communicate safely with him.

导入密钥
为了将文件添加到你的公钥环中去，你必须先导入它，并且验证这个密钥的指纹才行. 在验证指纹之后，你还需要将它设为有效.

Now we will be adding Luis Pinto's (a friend of mine) public key to our public keyring. After giving him a call and asking him for his key fingerprint, I compare the fingerprint with the output of the fpr command. As the key is authentic, I add it to the public keyring. In this particular case, Luis's key will expire in 2003-12-01 so I am asked if I want my signature on his key to expire at the same time.

向密钥服务器发送密钥
Now that a key has been generated, it is probably a good idea to send it to a world key server. There are a lot of key servers in the world and most of them exchange keys. In this next example Larry the cow's key will be sent to the keys.gnupg.net server. Sending keys uses HTTP, so if a proxy is used for HTTP traffic do not forget to set it accordingly (export http_proxy= http://proxy_host:port/ ). The command for sending the key is: gpg --keyserver keys.gnupg.net --keyserver-options honor-http-proxy --send-key 75447B14 where  is the key ID. If a HTTP proxy is not needed then the  option can be removed.

你也可以将你签过名的其他人的密钥发送到密钥服务器上去. 比如，我们可以将Luis Pinto的密钥送上去. 这样的话，那些信任你的密钥的人可以使用你发送上去的签名来同样得信任Luis的密钥.

从密钥服务器取得密钥
Now we are going to search for Gustavo Felisberto's key and add it to the keyring of Larry the cow (just in case you did not notice Gustavo Felisberto is the author this guide :)).

From the server response it is possible to see few keys have been submitted to the key server, however only  is used. Now Larry the cow can get the key and sign it if he trusts it.

What is a GPG agent?
Sometimes working with certain applications requires the use of a GPG key very frequently, which means that a passphrase must be frequently entered. In the past many applications supported a passphrase caching mechanism. This would make life easier for users because passphrases were automatically entered. However, this disallowed sharing this cache across programs (how secure would that be?) and forced applications to reinvent the wheel over and over again.

A GPG agent is a separate application that GPG uses to cache the passphrase in a standard and secure way. It allows applications to use GPG concurrently: if the passphrase is entered while working in one application, the other application can work with GPG without reiterating the request for the passphrase to unlock the key — if the GPG Agent is configured to allow so, of course.

Gentoo provides a few GPG agent applications. The package contains what could be considered the reference one, and will be the primary choice used in this article.

Configuring gpg-agent and pinentry
GnuPG includes gpg-agent. Pinentry is a helper application that gpg-agent uses to request the passphrase in a graphical window. It comes in three flavors: it can popup a window using the GTK+, QT, or curses libraries (depending on the USE flags set in ).

If was installed with more than one popup window type, it is possible to choose between the windows with the eselect pinentry</tt> command:

Now create a file called and enter the following lines which define the default timeout of the passphrase (e.g. 30 minutes) and the application to be called for when the passphrase should be retrieved the first time (e.g. the GTK+ version of Pinentry).

Now configure GnuPG to use an agent when appropriate. Edit and add the following line:

Now the system is (almost) ready to use the GPG agent.

Automatically starting the GPG agent
If KDE is used as the desktop environment, edit the following (system-wide) or  (local user) file. Add the following command to the appropriate file to have KDE automatically starting the GPG Agent:

Additionally, uncomment the following lines in (system-wide) or add it to  (local user):

When using a desktop environment other than KDE, put that line (the same as mentioned above) in the file (if the startx</tt> command is used to invoke the GUI) or the  file (if XDM, GDM, KDM are used).

Encrypting and signing
Lets say that Larry has a file he wishes to send Luis. Larry can encrypt it, sign it, or encrypt it and sign it. Encrypting means that only Luis will be able to open it. The signature tells Luis that it was really Larry who created the file.

The next three commands will do just that: encrypt, sign and encrypt/sign.

This will create binary files. When wishing to create ASCII files, just add a  option to the beginning of the command.

Decrypting and verifying signatures
Suppose that Larry has received a file which is encrypted to him. The command used to decrypt it is gpg --output document --decrypt encrypted_doc.gpg</tt>. This will decrypt the document and verify the signature (if there is one).

Encrypting and decrypting without keys
It is possible to encrypt files using passwords instead of keys. The password itself will function as the key — it will be used as a symmetric cypher. The file can be encrypted using gpg --symmetric</tt>; decrypting uses the same command as mentioned previously.

GnuPG will ask for a passphrase and a passphrase verification.

Advanced features
There are some nice advanced features in GnuPG. To find them, open the file.

Search for the above two lines and uncomment them. With this modification made, any time GnuPG needs to check a signature and does not find the public key on the local keyring it will contact the key server at keys.gnupg.net in attempt to fetch the public key from from the server.

Another nice command is gpg --refresh-keys</tt>. This will contact the key server defined in the configuration file and refresh the public keys in the local key ring from there. It is capable of searching for revoked keys, new IDs, and new signatures on keys. It is a wise idea run this command once or twice a month; if a user revokes their key this can provide a notification the key can no longer be trusted.

About email signatures
95% of the time GnuPG is used with email by signing/encrypting outgoing messages or reading signed/encrypted messages.

There are two ways two sign/encrypt a email with GnuPG, the old way and the new way. In the old way messages would appear in plain text, with no possible formatting and attached files would be unsigned/unencrypted. Here is an example of a message signed the old way:

Messages this way are not good in today's world, where there are nice GUIs and email readers that understand HTML.

To solve this an addition to the MIME (Multipurpose Internet Mail Extensions) was created. This adds a field to the email that tells the mail reader that the full content of the message is signed and/or encrypted. The problem with this is that not all mail readers support such features. Some even mess up the content (Microsoft's Outlook is famous for not working with this).

Kgpg
Kgpg is a wonderful GUI for GnuPG. The main screen provides an area to paste text to signed or encrypted, the reverse is also true; ASCII armored text to be decrypted can also be entered.

From within the main screen text decrypted (a password is needed), files encrypted, and pasted text can be signed.

Seahorse
Seahorse aims to be a GnuPG GUI interface for the Gnome desktop. The software has been evolving fast, but it still lacks many important features that can be found in Kgpg or the command line version.

KMail
If the  USE flag is set, KMail will be compiled with gpg support, and will be able to encrypt and decrypt inline PGP mails automatically as well as encrypting OpenPGP/MIME mails. To decrypt OpenPGP/MIME mails as well (most users want) a GPG agent must be running.

To verify if KMail is properly configured navigate to. A GpgME-based backend should be listed and the OpenPGP checkbox should be checked. If it is listed but grayed out, click on. If the GpgME-based backend remains grayed out, KMail is not working properly.

When unable to get KMail to behave, see the official KMail PGP page for more information.

Claws-Mail
This mail reader is very fast with big mailboxes, has all the nice features one wants in mail readers and works well with GPG. The only problem is that it does not work with the old PGP signatures, so when receiving those kind of mails the signatures must be hand-checked.

To use a GPG key with Claws-Mail navigate to. Once there choose which key to use, most users should go with the default key.

Some problems
I had some problems with photos in keys. Check the version you are using. If you have GnuPG 1.2.1-r1 and up you are probably OK, older versions may have problems. Also most key servers do not like keys with photos, so you are better if you don't add photos.

The latest versions of GnuPG do not seem to work with the gpg --send-keys</tt> that was used to send all keys in a keyring to the public server.

What is not here
gpg</tt> is a very complex tool, it lets user do much more than what has been covered here. This document is for users who are new to GnuPG. For more information check out the official GnuPG website.

This article does not cover tools such as pgp4pine</tt>, gpgpine</tt>, evolution</tt>, and or Windows GPG tools.

Credits
John Michael Ashley's GnuPG Handbook it is a very good book for beginners.

Swift (Sven Vermeulen) for pushing me to re-write this.

Everyone in the #gentoo-doc team you guys rock.

Tiago Serra for getting me back to the privacy track.