Using PGP with supported e-mail applications

If you have an e-mail application that is supported by the PGP plug-ins, you can access PGP functions by clicking the appropriate buttons in your application's toolbar. For example, if you are using Eudora, you click the lock icon to indicate that you want to encrypt your message and the quill icon to indicate that you want to sign it. To send your message, you click the PGP button to initiate the encryption and signing functions and then send the scrambled text to the intended recipient.

When you receive e-mail from another PGP user, you decrypt the message and verify the person's digital signature by clicking the open lock.

Tip

•	If you are exchanging e-mail with someone who is also using PGP and Eudora (or some other e-mail application that supports the PGP/MIME standard), both of you can automatically encrypt and decrypt your e-mail messages and any attached files when you exchange mail. All you have to do is turn on the PGP/MIME encryption and signatory functions from the PGP preferences dialog box.  For more information, click [image].

When you receive e-mail from someone who uses the PGP/MIME feature, the mail arrives with an attached icon indicating that it is PGP/MIME encoded.

When you receive PGP/MIME encapsulated mail, to decrypt its contents and verify any digital signatures, double-click the key icon.

What do you want to do?

  Open the PGPkeys Window

  Use PGP for Secure File Storage

  Encrypt and sign your e-mail

  Decrypt and verify your e-mail


Encrypting and signing your e-mail

After you have generated your key pair and have exchanged public keys, you can begin encrypting and signing e-mail messages and file attachments.

•	If you are using an e-mail application supported by the plug-ins, you can encrypt and sign your messages by selecting the appropriate options from your application’s tool bar.

•	In addition, if you are communicating with other PGP users who are using an e-mail application that supports the PGP/MIME standard, you can encrypt and sign messages as well as file attachments automatically when you send your mail.

•	If your e-mail application is not supported by the plug-ins, you can copy the message to the clipboard and perform the appropriate functions from there. If you want to include any file attachments, you can encrypt and sign them from the Windows Explorer before attaching them to your e-mail.

What do you want to do?

  Encrypt and sign with Eudora with PGP/MIME

  Encrypt and sign with Eudora without PGP/MIME

  Encrypt and sign with Exchange

  Encrypt and sign with Outlook

  Encrypt and sign from the Windows Explorer

  Encrypt and sign from the Clipboard


Decrypting and verifying your e-mail

When someone sends you encrypted e-mail, you can unscramble its contents and verify any appended signature to make sure that the data originated with the alleged sender and that its contents have not been altered.

•	If you are using an e-mail application that is supported by the plug-ins, you can decrypt and verify your messages by selecting the appropriate options from your application’s tool bar.

•	In addition, if your e-mail application supports the PGP/MIME standard, you can decrypt and verify messages and file attachments sent using this format by clicking on an icon when reading your mail.

If your e-mail application is not supported by the plug-ins, you can copy the message to the clipboard and perform the appropriate functions from there. If you want to decrypt and verify file attachments, you can do so from the Windows Explorer.

What do you want to do?

  Decrypt and verify with Eudora with PGP/MIME

  Decrypt and verify with Eudora without PGP/MIME

  Decrypt and verify with Exchange

  Decrypt and verify with Outlook


To encrypt and sign with Eudora (with PGP/MIME)

1	Use Eudora to compose your e-mail message just as you normally would.

2	When you have finished composing the text of your e-mail message, specify whether you want to encrypt and sign the text of your message by clicking the lock and quill buttons.

3	If your recipient is using an e-mail application that supports the PGP/MIME standard, click the PGP/MIME button.

4	Send your e-mail message as you normally do. If you have elected to sign the encrypted data, the Passphrase dialog box appears, requesting your passphrase.

5	Enter your passphrase and then click OK.

6	 If you have a copy of the public keys for each recipient, the appropriate keys are used. However, if you specify a recipient for whom there is no corresponding public key, the PGP Key Selection dialog box appears so you can specify the correct key.

7	Drag the public keys for those who are to receive a copy of the encrypted e-mail message into the Recipients list box. You can also double-click on any of the keys to move them from one area of the screen to the other.

8	Click OK to send your mail.

Tip

If your recipient is using an e-mail application that supports PGP/MIME, turn the PGP/MIME feature on from the Preferences dialog box (for instructions, click [image]). If the PGP/MIME feature is set to on, you do not have to click the PGP button to encrypt and sign your message or any file attachments. Instead, these operations are performed automatically when you send your e-mail.

See also

  Encrypt and sign with Eudora without PGP/MIME


To encrypt and sign with Exchange

1	Use Exchange to compose your e-mail message just as you normally would.

2	Specify whether you want to encrypt and sign the text of your message by clicking the lock and quill buttons.

When you click one of these buttons, they remain indented to indicate the operations you want to perform.

3	Send your e-mail message as you normally do. If you have elected to sign the encrypted data, the Passphrase dialog box appears requesting your passphrase before the mail is sent.

4	Enter your passphrase and then click OK. If you have a copy of the public keys for each recipient, the appropriate keys are used. However, if you specify a recipient for whom there is no corresponding public key, the PGP Key Selection dialog box appears so you can specify the correct key.

5	Drag the public keys for those who are to receive a copy of the encrypted e-mail message into the Recipients list box. You can also double-click on any of the keys to move them from one area of the screen to the other.

6	Click OK to send your mail.


To encrypt and sign with Eudora (without PGP/MIME)

If you are using Eudora to send encrypted and signed e-mail to someone whom is not using an e-mail application that supports the PGP/MIME standard; here are the steps you should follow:

1	Use Eudora to compose your e-mail message just as you normally would.

2	When you are through composing the text of your e-mail message, select the Message Plug-ins menu option from the Edit menu and the select PGP Encrypt & Sign.

3	Send your message to the intended recipients. If you have a copy of the public keys for each recipient, the appropriate keys are used. However, if you specify a recipient for whom there is no corresponding public key, the PGP Key Selection dialog box appears so you can specify the correct key.

4	If you have elected to sign the encrypted data, then the passphrase dialog box appears requesting your passphrase before the mail is sent.

See also

  Encrypt and sign with Eudora with PGP/MIME


To decrypt and verify from within Exchange

1	Open your e-mail message as you normally do.

A block of ciphertext appears in the body of your e-mail message.

2	To decrypt and verify the contents of the e-mail message, click the open lock icon in your application’s toolbar.

The PGP Enter Passphrase dialog box appears requesting that you enter your passphrase.

3	Enter your passphrase and then click OK.

The message is decrypted and, an if the message is signed, a message indicates whether it is valid.

4	At this point you can save the message in its decrypted state, or you can save the original encrypted version so that it remains secure.


To decrypt and verify with Eudora (with PGP/MIME)

1	Open your e-mail message as you normally do.

A block ciphertext appears in the body of your e-mail message.

2	Click on the open lock icon in your application's toolbar. You are asked for your passphrase:

3	Enter your passphrase and then click OK.

The message and any attachments are decrypted. If there are any signatures, PGP attempts to verify the signature and displays a message to indicate whether the signature is valid.

4	You can save the message in its decrypted state, or you can save the original encrypted version so it remains secure.

See also

  To decrypt and verify with Eudora (without PGP/MIME)


To decrypt and verify with Eudora (without PGP/MIME)

1	Open your mail message as you normally do.

A block of ciphertext is displayed:

2	To decrypt and verify the contents of the e-mail message, select the Message Plug-ins PGP Decrypt & Verify option from the Edit menu.

The passphrase dialog box is displayed.

3	Enter your passphrase and then click OK.

The message and any attachments are decrypted. If there are any signatures, an attempt is made to verify the signature and a message indicates that the signature is valid.

9	You can save the message in its decrypted state, or you can save the original encrypted version so it is securely stored in your Inbox.

See also

  To Decrypt and Verify with Eudora (with PGP/MIME)


To encrypt and sign with Outlook

1	Use Outlook to compose your e-mail message just as you normally would.

2	After you compose your e-mail message, specify whether you want to encrypt and sign the text of your message by clicking the lock and quill buttons. When you click one of these buttons, they remain indented to indicate the operations you want to perform.

3	Send your e-mail message as you normally do.

If you have elected to sign the encrypted data, the Passphrase dialog box appears requesting your passphrase before the mail is sent.

4	Enter your passphrase and then click OK. If you have a copy of the public keys for each recipient, the appropriate keys are used. However, if you specify a recipient for whom there is no corresponding public key, the PGP Key Selection dialog box appears so you can specify the correct key.

5	Drag the public keys for those who are to receive a copy of the encrypted e-mail message into the “Recipients” list box. You can also double-click on any of the keys to move them from one area of the screen to the other.

6	Click OK to send your mail.


To decrypt and verify with Outlook

1	Open your e-mail message as you normally do.

A block of ciphertext appears in the body of your e-mail message.

2	To decrypt and verify the contents of the e-mail message, click the open lock icon in your application’s toolbar.

The PGP Enter Passphrase dialog box appears requesting that you enter your passphrase.

3	Enter your passphrase and then click OK.

The message is decrypted and, an if the message is signed, a message indicates whether it is valid.

4	At this point you can save the changes to the file so that it is stored in its decrypted state, or you can save the original encrypted version so that it remains secure.


Using PGP for secure file storage

You can use PGP to encrypt and sign files without using an e-mail plug-in so that you can send encrypted or signed files as e-mail attachments. You can also use the techniques described in this chapter to encrypt and sign files that you store on your computer or file server.

You can also use PGP to delete files so that they cannot be retrieved from your computer with disk recovery software.

See also

  Encrypting and signing via the Clipboard

  Encrypting and signing via Windows Explorer

  Decrypting and Verifying via the Clipboard

  Decrypting and Verifying via Windows Explorer

  Deleting files with Secure Wipe


To decrypt and verify from the Windows Explorer

If the e-mail you receive has file attachments or if you are decrypting an encrypted file from your computer or file server, and you are not using a PGP/MIME-compliant e-mail application, you must decrypt them from the Windows Explorer.

1	Open the Windows Explorer from the Start menu.

2	Select the file or files that you want to decrypt and verify.

You can select multiple files, but you must go through the process of decrypting and verifying each file individually.

3	Choose Decrypt/Verify from the PGP submenu of the File menu.

4	The PGP Enter Passphrase dialog box appears asking you to enter your passphrase.

5	Enter your passphrase and then click OK.

If the file has been signed, a message appears indicating whether the signature is valid.

6	Click OK.

The Save Decrypted File As dialog box appears.

7	Specify the location and enter the name of the file where you want to save the decrypted version of the file.

If you do not explicitly enter a name, the original name is used.

8	Click the Save button to save the file.

The decrypted file is saved in the specified location. If there are any signatures, an attempt is made to verify the signature and a message appears indicating whether the signature is valid.


To encrypt and sign via the Clipboard

1	Use the editor supplied with your application or any word-processing program to create the file.

2	When you are ready to send the message or file, select the area of text you want to encrypt, or choose Select All from the Edit menu.

3	Choose Copy from the Edit menu to copy the contents of your message or file to the clipboard.

4	Click the lock and key icon in the System tray and choose Encrypt Clipboard, Sign Clipboard, or Encrypt And Sign Clipboard.

5	Drag the public keys for those who are to receive a copy of the encrypted e-mail message into the Recipients list box.

6	The Validity button indicates the minimum level of confidence that the public keys in the Recipient list are valid. This validity is based on the signatures associated with the key.

7	Click OK.

If you have chosen to sign the message, the PGP Signing Passphrase dialog box appears requesting your personal passphrase for your private key

8	Enter your passphrase and then click OK.

9	Return to your e-mail application and choose the Paste command from the Edit menu. This copies the encrypted message back into your e-mail application.

10	Send your e-mail, or store the encrypted file on your hard disk or file server.


To decrypt and verify using the Clipboard

1	In the editor supplied with your application, select the encrypted text and then copy it to the clipboard.

2	In most applications, choose Copy from the Edit menu to copy the text to the Windows clipboard.

3	Click the lock and key icon in the System Tray to open the PGP pop-up menu.

4	Choose Decrypt/Verify Clipboard to initiate the decryption and verification process.

The PGP Enter Passphrase dialog box appears requesting that you enter your passphrase.

5	Enter your passphrase and then click OK.

The message is decrypted. If has been signed, a message appears indicating whether the signature is valid.

6	To view the contents of the deciphered e-mail message, choose Edit Clipboard from the PGP pop-up menu. You can then copy the contents back to your text editor and save it if you like.


To encrypt and sign from the Windows Explorer

1	Open the Windows Explorer from the Start menu.

2	Select the file or files that you want to encrypt.

You can select multiple files, but you must encrypt and sign each of them individually.

3	Choose the desired option from PGP submenu from the File menu or from the pop-up menu, which you access by pressing the right mouse button.

4	The PGP Key Selection Dialog box appears, in which you can select the recipient’s public keys for the file you are encrypting or signing. You have several options:

When sending files as attachments with some e-mail applications, you may need to select the Text Output check box to have the file saved as ASCII text. This is sometimes necessary in order to send a binary file using older e-mail applications.

5	If you want the output of the encrypted file saved in a text format that can be handled by all e-mail applications, select the Text Out check box. Selecting this option increases the size of the file by about 30 percent.

With Passphrase Only, you can use conventional encryption, which means that you rely on a common passphrase rather than public key cryptography. The file is encrypted using a session key, which encrypts using your passphrase.

Wipe Original overwrites the original document that you are encrypting or signing, so that your sensitive information is not readable by anyone who can access your hard disk.

6	If you have signed the files, you are asked to supply your passphrase.

7	If you are adding your signature to the encrypted file and would like the signature to be stored in a separate file, select the Separate Signature File check box.

8	Select the public keys by dragging them to the Recipients list and then click OK.

The Save Encrypted File As dialog box appears.

9	Specify the location and enter the name of the file where you want to save the encrypted version of the file. The .pgp extension is automatically appended to the file name unless you have turned on the ASCII Armor option, in which case, the .asc extension is used.

10	Click Save to save the file to the specified location.

If you look in the directory where you saved the file, a file with the specified name represented by one of two icons appears.

Tips

•	Even on systems with virtual memory, PGP correctly writes over all the contents of the file. It is worth noting that application programs that may have saved the file prior to encrypting it may also have left fragments of the file on your disk in locations that are no longer considered part of the file.

•	Be aware that many programs automatically save files in progress, so there may be backed up copies of the file that you want to delete.

•	You may wish to use a third-party utility to wipe all free space on your disk. PGP does not currently have this feature.


Deleting files with Secure Wipe
Deleting files with Wipe

Wipe overwrites files and their contents and deletes them from your computer. The Wipe feature is a more secure way of permanently removing a file and its contents from the hard drive of your computer. In the Windows operating system, when you delete a file, the data in the file is still there, but the name of the file has been removed from the file directory. Wipe removes all traces of a file’s data, such that no one could use a software tool to recover the file.

For instructions, click [image].


To delete files with Secure Wipe
To delete files with Wipe

1	Open the Windows Explorer from the Start menu.

2	Select the file or files that you want to wipe.

3	Select the PGP menu or PGPtools.

4	To get to the PGP menu, right-click the file, and choose PGP from the options. A submenu containing Encrypt, Sign, Encrypt and sign, and Wipe appears.

5	Choose Wipe.

6	Click the file or choose Open from the Select Files dialog box to Wipe.

7	A Last Chance confirmation dialog box appears asking if you are sure you want to securely wipe the file(s).

8	Click Yes to wipe the file or files.

Tips

•	Even on systems with virtual memory, PGP correctly writes over all the contents of the file. It is worth noting that application programs that may have saved the file prior to encrypting it may also have left fragments of the file on your disk in locations that are no longer considered part of the file.

•	Be aware that many programs automatically save files in progress, so there may be backed up copies of the file that you want to delete.

•	You may wish to use a third-party utility to wipe all free space on your disk. PGP does not currently have this feature.


About additional decryption keys

Additional Decryption Keys are keys that allow security officers to decrypt messages that have been sent to or from people within your organization.  There are two types of keys: incoming additional decryption keys and outgoing additional decryption keys .

While the security officer may not ordinarily use the Additional Decryption keys, there may be circumstances when it is necessary to recover someone’s e-mail; for instance, if someone is injured and out of work for some time or if e-mail records are subpoenaed by a law enforcement agency and the corporation must decrypt mail as evidence for a court case.

  Managing your keys


About corporate signing keys

A Corporate Signing Key is a public key that is designated as the system-wide key that all users can trust to sign other keys. Users can trust that keys signed by the Corporate Key are valid. Users should be cautious of keys not signed by the Corporate Signing Key because they don’t know whether they are valid—that is, belonging to the owner to whom they claim to belong.

See also

  Managing your keys


Glossary

A

Additional Decryption Keys

Authentication

C

Certify

Certifying Authority

Corporate Signing Key

D

Decryption

Diffie-Hellman/DSS keys

Digital Keyrings

Digital Signature

E

Encryption

Exportable signatures

F

Fingerprint

G

Groups

I

Incoming Additional Decryption Key

Introducer

K

Key

Key escrow

Key fingerprint

Key ID

Key pair

Keyring

M

Message digest

Meta-introducer

O

Outgoing Additional Decryption Key

P

Passphrase

Plaintext

Private key

Private keyring

Public key

Public-key cryptography

Public keyring

R

Revoke

RSA keys

S

Sign

Signature

T

Trusted

Trusted introducer

U

User ID

V

Validity

Verification

W

Web of Trust


Additional Decryption Key
Additional Decryption Keys

Keys that the security officer of a corporation can use, under certain circumstances, to decrypt messages sent or received by people within the corporation.


Authentication

The determination of the origin of encrypted information through the verification of someone’s digital signature or someone’s public key by checking its unique fingerprint.


Certify

To sign another person's public key.


Certifying authority

One or more trusted individuals who are assigned the responsibility of certifying the origin of keys and adding them to a common database.


Ciphertext

Text that has been passed through an encryption algorithm.  Ciphertext is a scrambled and unintelligible block of text.


Corporate Signing Key

A public key that is designated by the security officer of a corporation as the system-wide key that all corporate users trust to sign other keys.


Decryption

A method of unscrambling encrypted information so that it becomes legible again. The recipient's private key is used for decryption.


Diffie-Hellman/DSS keys

There are two distinct types of keys supported by this version of PGP. One is a new type of key called Diffie-Hellman/DSS which are based on the latest advancements in cryptographic technologies, and the other is the traditional RSA key used in older versions of PGP.


Digital keyrings

Digital keyrings store your public and private keys, as well as public keys of others.


Digital Signature

A digital code created with a private key. Signatures allow authentication of information by the process of signature verification. When you sign a message or file, the PGP program uses your private key to create a digital code that is unique to both the contents of the message and your private key. Anyone can use your public key to verify your signature.


Encryption

A method of scrambling information to render it unreadable to anyone except the intended recipient, who must decrypt it to read it.


Exportable signatures

Exportable signatures are viewable from a key server or any location to which you might copy a key.


Fingerprint

A uniquely identifying string of numbers and characters used to authenticate public keys.  This is the primary means for checking the authenticity of a key.


Groups

PGP allows you to select recipient groups, in which you can encrypt a message simultaneously to all recipients.


Incoming Additional Decryption Key

The Incoming Additional Decryption Key causes encrypted mail sent to people in an organization to also be encrypted to the corporation’s Incoming Additional Decryption Key.


Introducer

A person or organization who is allowed to vouch for the authenticity of someone’s public key. You designate an introducer by signing their public key.


Key

A digital code used to encrypt and sign and decrypt and verify e-mail messages and files. Keys come in key pairs and are stored on keyrings.


Key escrow

A practice where a user of a public key encryption system surrenders their private key to a third party thus permitting them to monitor encrypted communications.


Key ID

A legible code that uniquely identifies a key pair. Two key pairs may have the same user ID, but they will have different Key IDs.


Key pair

A public key and its complementary private key. In public-key cryptosystems, like the PGP program, each user has at least one key pair.


Keyring

A set of keys. Each user has two types of keyrings: a private keyring and a public keyring.


Message digest

A compact “distillate” of your message or file checksum. It represents your message, such that if the message were altered in any way, a different message digest would be computed from it


Meta-introducer

A trusted introducer of trusted introducers.


Outgoing Additional Decryption Key

The Outgoing Additional Decryption Key causes encrypted mail sent from people in an organization also to be encrypted to the corporation’s Outgoing Additional Decryption Key.


Passphrase

A case-sensitive series of keystrokes that allow exclusive access to your private key which you use to sign and decrypt e-mail messages and file attachments. A passphrase should contain multiple words and may include spaces, numbers, and other characters.  The longer a passphrase is, the more secure it is.


Plaintext

Normal, legible, unencrypted, unsigned text.


Private Key

The secret portion of a key pair-used to sign and decrypt information.  Only you have access to your private key. Your private key is also used to generate a unique digital signature based on the contents of a given e-mail message or file attachment.


Private keyring

A set of one or more private keys, all of which belong to the owner of the private keyring.


Public Key

One of two keys in a key pair—used to encrypt information and verify signatures. A user's public key can be widely disseminated to colleagues or strangers. Knowing a person's public key does not help anyone discover the corresponding private key.


 Public-key cryptography

Cryptography in which a public and private key pair is used, and no security is needed in the channel itself.


Public keyring

A set of public keys. Your public keyring includes your own public key(s).


Revoke

If you no longer trust your personal key pair, you can issue a revocation telling everyone to stop using your public key. The best way to circulate a revoked key is to place it on a public key server.


RSA keys

There are two distinct types of keys supported by this version of PGP. One is the RSA key used in older versions of PGP and the other is a new type of key called Diffie-Hellman/DSS, which provides greater security over the Internet.


Sign

To apply a signature.


Trusted

A public key is said to be trusted by you if it has been certified by you or by someone you have designated as an introducer.


Trusted introducer

Someone who you trust to provide you with keys that are valid. When a trusted introducer signs another person’s key, you trust that their keys are valid, and you do not need to verify their keys before using them.


User ID

A text phrase that identifies a key pair. For example, one common format for a user ID is the owner's name and e-mail address. The user ID helps users (both the owner and colleagues) identify the owner of the key pair.


Verification

The act of comparing a signature created with a private key to its public key. Verification proves that the information was actually sent by the signer, and that the message has not been subsequently altered by anyone else.


Validity

Indicates the level of confidence that the key actually belongs to the alleged owner.


Web of Trust

A distributed trust model used by PGP to validate the ownership of a public key where the level of trust is cumulative, based on the individual’s knowledge of the 'introducers.'


About PGP

With PGP™ Version 5.5, you can protect the privacy of your e-mail messages and files by encrypting them so that only the intended recipients can read them. You can also digitally sign messages and files, which ensures their authenticity. A signed message verifies that the information within it has not been tampered with in any way.

PGP is based on a widely accepted encryption technology known as public key cryptography in which two complementary keys—a key pair—are used to maintain secure communications. To send someone a private e-mail message, you use a copy of that person’s public key to encrypt the information, which only they can decipher by using their private key. Conversely, when someone wants to send you encrypted mail, they use a copy of your public key to encrypt the data, which only you can decipher by using a copy of your private key.

You also use your private key to sign the e-mail you send to others. The recipients can then use their copy of your public key to determine if you really sent the e-mail and whether it has been altered while in transit. When someone sends you e-mail with their digital signature, you use a copy of their public key to check the digital signature and to make sure that no one has tampered with the contents.

What do you want to do?

  Read more about using PGP

  See what new features are available in PGP Version 5.5

  Start PGP

  Create a PGP key pair

  Exchange keys with others

  Validate your keys

  Use PGP for secure file storage

  Use PGP with Supported E-mail Applications


What's new in PGP Version 5.5

PGP Version 5.5 includes these new features:

•	You can create recipient groups, in which you select a group of people’s keys and encrypt mail to all of them simultaneously.

•	New key-server-integration capabilities that you can use to automatically store, search, and to synchronize keys. Key servers ensure that PGP is used according to corporate policy when you are using PGP for Business Security.

•	New Key Search Window that allows you to locate keys on remote servers with the same user interface that you use to search your keyring.The PGP Version 1.0 Policy Management Agent for SMTP that enforces your organization’s encryption policy. The PGP SMTP Policy Agent works in conjunction with a standard SMTP mail server to ensure that incoming and outgoing e-mail adheres to the policies enforced by a given site.

•	New PGPtools that you can use to encrypt, sign, decrypt, verify, or wipe files from the Windows Explorer.

•	A PGP Wipe feature that overwrites files such that they cannot be recovered with software tools

•	A configurable View menu that provides information about keys on your keyring.

•	New key-signing capabilities that allow you to choose whether the owner of the key that you are signing is a trusted introducer or meta-introducer. You can also choose whether your signature is exportable, which means it is viewable from a key server, or non-exportable, which means that you can view the signature but no one else can.

See also

  Using PGP

  About PGP


Using PGP

You can use PGP to encrypt and sign e-mail and files that you can either mail or store securely on your computer or file server.  Use the PGP e-mail plug-ins to encrypt and sign e-mail messages as well as decrypt and verify your messages while composing and reading your mail.

If you are using an e-mail application that is not supported by the plug-ins, you can easily transfer the text of your e-mail messages to the clipboard and perform the necessary functions from there. If you need to encrypt or decrypt file attachments, you can do so directly from the Windows Explorer by choosing the appropriate menu option. You can also use PGP to encrypt and sign files to the hard disk of your computer or on a file server for secure storage.

See also

  About PGP

  About key pairs

  To create a PGP key pair

  Using PGP for secure file storage

  Using PGP with Supported E-mail Applications


About Keys
About PGP keys

PGP supports the use of two types of keys—the RSA key used in older versions of PGP and a new type of key called Diffie-Hellman/DSS, which provides greater security over the Internet.

Note

If you plan to exchange e-mail with someone who has a newer version of PGP, you can take advantage of the new Diffie-Hellman/DSS keys. However, if you are corresponding with someone who is using a previous version of PGP, you will need to use an RSA key to communicate with him or her.

See also

  About keyrings

  About key pairs

  RSA key

  Diffie-Hellman/DSS key


About keyrings

The keys you create as well as those you collect from others are stored on digital keyrings, which are essentially files stored on your hard drive or on a floppy disk. Normally your private keys are stored in a file named “secring.skr” and your public keys are stored in another file named “pubring.pkr”. These files are usually located in the same program directory as the other PGP program files.

See also

  About keys

  About key pairs

  RSA key

  Diffie-Hellman/DSS key


About key pairs

A key pair consists of two complementary keys—a private key to which only you have access, and a public key, which you can copy and make freely available to everyone with whom you exchange e-mail. Both your private and your public keys are stored in keyring files, which are accessible from the PGPkeys window in which you perform all your key management functions.

To send someone a private e-mail message, you use a copy of that person’s public key to encrypt the information, which only they can decipher by using their private key. Conversely, when someone wants to send you encrypted mail, they use a copy of your public key to encrypt the data, which only you can decipher by using a copy of your private key.

What do you want to do?

  Read about keys

  Read about keyrings

  Create a PGP key pair

  Manage your keys


To create a key pair

1	Click the Start button and choose PGPkeys from the PGP submenu of the Programs menu.

2	Choose New Key from the Keys menu.

3	The Key Generation Wizard asks you to enter your user name and e-mail address.

You do not have to enter your real name or even your e-mail address. However, using your real name makes it easier for others to identify you as the owner of your public key. Choose a key type, either Diffie-Hellman/DSS or RSA .

4	Specify a size for your new keys.

Choose when the key pair should expire. You can enter specific number of days or accept the default, Never.

5	Type a passphrase.

  What is an adequate passphrase?

Note

If you are creating a key with the same user name or e-mail address as a previous key, you are given the opportunity to sign the new key with your older key. This endows the new key with same level of validity and trust as your older key when someone adds it to their keyring.

6	If applicable, sign your new key with the older key and enter the passphrase for the old key, then click Next.

7	Choose whether to send your public key to the default key server.

8	Click Finish.

A pair of keys representing your newly created keys appears in the PGPkeys window. Note that the RSA keys are blue and the Diffie-Hellman/DSS keys are yellow.

See also

  Why is my key generation taking so long?

  Establishing preferences

  Key size

  Replacing your old key


Managing keys

The keys you create as well as those you obtain from others are stored in digital keyrings, which are essentially files stored on your hard drive or a floppy disk. Your private keys are normally stored in the file named secring.skr and your public keys in the file pubring.pkr. Both are usually located in the same program directory as the other PGP program files.

Note

If you have more than one set of keys, or you are not comfortable storing your keys in the usual place, you can choose a different file name or location. (For more information, click

You may want to examine or change the attributes associated with PGP keys, for instance a key’s type (either RSA or DSS/Diffie-Hellman ), fingerprint , or validity . You may also want to change a passphrase for your private key. You perform all of these key management functions from the PGPkeys window.

  How?

•	For more information about keys, click

•	For more information about keyrings, click

What do you want to do?

  Change your passphrase

  Check a key’s fingerprint

  Delete a key or signature

  Disable or enable a key

  Examine a key's properties

  Exchange keys with others

  Revoke a key

  Protect your keys

  Sign someone's public key%

  Specify a default key pair

  Verify the authenticity of a key

  Add a new user name or address to a key


To specify a default key pair

Each time you create a set of keys, the keys are designated as your default keys and are automatically selected when you perform certain PGP functions. For instance, your default key pair is used when you sign a message or someone’s public key. If you have more than one set of keys, you can designate one pair as your default set.

To specify your default key pair:

1	Select and highlight the set of keys you want designated as your default set.

2	Choose Set As Default from the Keys menu.

Notice the selected keys are now displayed in bold type, indicating they are your default keys.

See also

  Managing your keys


To add a new user name or address

You can have more than one user name or e-mail address for the same set of keys.

1	Select the key pair for which you want to add another user name or address.

2	Choose New Key from the Keys pull-down menu. The PGP New User Name dialog box appears. Enter the new name and address.

3	Click OK. The PGP Enter Passphrase dialog box appears.

4	Enter your passphrase, then click OK.

The new name replaces the previous name, and if you expand the view you see that the old name has moved down a level.

If you want to set the new user name and address as the primary identifier for your key, select the name and address and choose Set As Default Key from the Keys menu.

See also

  Managing your keys


Exchanging keys with others

After you create a key pair, you can begin exchanging encrypted e-mail with other PGP users. To do so, you will need a copy of their public key and they will need a copy of yours. Since your public key is just a block of text, it is easy to trade keys with someone.

You have three alternatives for distributing your public key:

•	Make your public key available through a public key server

•	Include your public key in an email message

•	Export your public key or copy it to a text file

See also

  Verifying the authenticity of a key

  Protecting your keys

  Make your key available through a public key server

  Including your public key in an e-mail message

  Save your public key to a text file


To get someone's public key from a key server

1	Open the PGPkeys window by clicking on the lock and key icon in the System tray.

2	Choose Find New Key from the Keyserver submenu of the Keys menu.

3	The Find Key dialog box appears.

4	Enter the e-mail address or user name to locate the users public key.

If a public key for the specified user is found, you are asked whether you want to add it to your public keyring

See also

  Distributing your public key

  Making your public key available through a server

  Key server preferences


Making your public key available through a server

Probably the best long-term and hassle-free method for making your public key available is to place it on a public key server where anyone can access it. By storing your public key on a key server, people can send you e-mail without having to explicitly request a copy of your key.

See also

  Key Server Preferences


To send your public key to a key server

1	Open the PGPkeys window by clicking on the lock and key icon in the System tray.

2	Select the icon that represents the public key you want to post on the key server.

3	Choose Send Selected Keys from the Keyserver submenu of the Keys menu. As an alternative, you can click the right mouse button and select this option from the pop-up menu.

See also

  Key Server Preferences

  Replacing your old key


Replacing your old key

If you ever need to change your e-mail address or you acquire new signatures, all you have to do to replace your old key is send a new copy to the server and the information is automatically updated. If your key is ever compromised, you can revoke your key, which tells the world to no longer trust that version of your key.  For more information on revoking keys, click [image].


Retrieving public keys from a key server

If the person to whom you want to send encrypted mail is an experienced PGP user, chances are that they have placed a copy of their public key on a key server. In PGP Version 5.5, you can search the key server that is specified in PGP Preferences. This makes it very convenient for you to get a copy of their most up-to-date key whenever you want to send them mail and also relieves you from having to store a lot of keys on your public keyring.

When using PGP Version 5.5 for Business Security, you may be directed to use a corporate key server on which all keys frequently used by your organization are kept.

With PGP Version 5.5, you can search for keys on a key server using these methods:

•	User ID

•	Key ID

•	Key type

•	Creation date

•	Expiration date

•	Revoked keys

•	Keys of a size that you specify

There are a number of public key servers, such as the one maintained by PGP, Inc., where you can locate the keys of most PGP users. If the recipient has not pointed you to the Web address where their public key is stored, you may be able to access their key server and search for the user’s name or email address. With PGP Version 5.5, you can quickly locate a specific user’s key when you are sending email or managing your keys from the PGPkeys window.

See also

  To get someone’s public key from a key server


About importing and exporting keys

Here are some ways to distribute keys:

•	Send and receive the public keys of others by cutting and pasting the raw text from a public or corporate key server

•	Exchange keys by importing and exporting them as separate text files.

For instance, someone could hand you a disk containing his or her public key, or you might want to make your public key available over an FTP server.

See also

  To import a key from a file

  To export your key to a file


Adding public keys from e-mail messages

To get a copy of someone’s public key, have him or her include it when they send you encrypted e-mail. If you have e-mail applications that is supported by the PGP plug-in, then adding the sender’s public key to your public key ring can be accomplished by simply clicking a button.

If you are using an e-mail application that is not supported by PGP plug-ins, you can copy the block of text that represents the public key and paste it into the PGPkeys window and thus add the key to your public keyring.

See also

  Exchanging keys with others

  Exporting your key to a file

  Managing your keys


Including your public key in an e-mail message

1	Open the PGPkeys window by clicking on the lock and key icon in the system tray.

2	Select your key pair and then choose Copy from the Edit menu.

3	Open the editor you use to compose your e-mail messages, place the cursor in the desired area, and then choose Paste from the Edit menu. In some e-mail applications, you can simply drag your key from the PGPkeys window into the text of your e-mail message to transfer the key information.

When you send someone your public key, be sure to sign the e-mail. That way, the recipient can verify your signature and be sure that no one has tampered with the information along the way.

See also

  About importing and exporting keys

  Exporting your key to a file

  Exchanging keys with others


To import a key from a file

1	Select the key you want to import from a file.

2	Choose Import from the Keys menu.

3	The Select File Containing Key dialog box appears.

4	Select the file that contains the key you want to import and then click Open.

The imported key appears in the PGPkeys window, where you can use it to encrypt data and verify someone’s digital signature.

See also

  About importing and exporting keys

  Exporting your key to a file

  Including your public key in an e-mail message

  Saving your public key to a file

  Exchanging keys with others


To export a key from a file

1	Select the key you want to export to a file.

2	Choose Export from the Keys menu.

3	The Export Key to File dialog box appears.

4	Enter the name of the file to which you want the key to be exported and then click Save.

The exported key is saved to the named file in the specified directory location.

See also

  About importing and exporting keys

  Including your public key in an e-mail message

  Exchanging keys with others

  To Import a key from a file


To save your public key to a file

There are several ways to copy your public key to a file:

•	Select the icon representing your key pair from the PGPkeys window, then choose Export from the “Keys” menu and enter the name of the file where you want the key to be saved.

•	Drag the icon representing your key pair from the PGPkeys window and drop it into the desired location in the Windows Explorer window.

•	Select the icon representing your key pair in the PGPkeys window, choose Copy from the Edit menu and then choose Paste to insert the key information into a text document.

See also

  Exchanging keys with others

  Exporting your key to a file

  Managing your keys

  Making a backup copy of your keys


Making a backup copy of your keys

When you specify that you want to save a backup copy of your keys, the Select Backup Destination dialog box appears where you specify the location to store a backup of your private keyring file.

PGP automatically creates copies of your public and private keys as you create them.  The backup keys are called pubring.pkr.bak, and secring.skr.bak.  Consider storing these keys in a different directory or on a floppy disk.

See also

  Managing your keys

  Saving your public key to a file


Verifying the authenticity of a key

When you exchange keys with someone, it is sometimes hard to tell if the key really belongs to that person. PGP provides a number of safeguards by allowing you to check a key’s authenticity, to vouch for its integrity. The PGP program will also warn you when you attempt to use a key that is not completely trusted.

You can determine if a key belongs to someone by checking its digital fingerprint, a unique series of numbers generated when the key is created. By comparing the fingerprint on your copy of someone’s public key against the fingerprint on their original key, you can be relatively sure that you do in fact have a valid copy of their key.

The most definitive way to check a key’s fingerprint is to call them and have them read their fingerprint over the phone.

See also

  Signing someone’s key

  Managing your keys

  Checking a key’s fingerprint

  Examining a key’s properties

  Protecting your keys


The PGPkeys window

All key management functions are performed from the PGPkeys Window.

1	To open the PGPkeys window, click the lock and key icon in the System tray and choose Launch PGPkeys.

The PGPKeys window displays your keys you and any public keys you have added to your public keyring. A double set of keys represents the private and public key pairs you have created for yourself. Single keys represent the public keys you have obtained from others. RSA type keys are blue and DSS/Diffie-Hellman keys are yellow.

2	Double click on any key icon to view the user ID and e-mail addresses. Double click on a figure icon to view the signatures of any users who have certified the key (as represented by the quill icon). You can also select several keys and choose the Expand Selection option from the Edit pull-down menu.

The captions at the top of the window correspond to the following attributes associated with each key.

Click on an item name to display a description.

Keys

Validity

Trust

Creation

Size


Keys

Displays an icon representation of the key, plus the name and e-mail address of the owner.


Validity

Validity indicates the level of confidence that the key actually belongs to the alleged owner.  The validity is based on who has signed the key and how well you trust the signer(s) to vouch for the authenticity of a key. Green dots or gray bars indicate validity. Implicit trust is indicated by green diamonds or striped bars.  Partial trust is indicated by gray dots or partially-filled bars.

If you are using PGP Version 5.5 for Business Security, your Security Officer will sign users’ keys with the Corporate Signing Key. Keys signed with the Corporate Signing Key can be assumed to be completely valid.

See also

  See signing someone’s public key


Trust

This bar indicates the level of trust you have granted to the owner of a key to serve as an introducer for the public keys of others. Use the Properties dialog box to assign a level of trust (select Complete, Marginal, or Untrustworthy) to someone’s public key.

You can change trust through the Key Properties Menu. Trust options are None, Marginal, and Complete.

See also

  Examining a key's properties


Creation

Shows the date a key was originally created. You can sometimes make assumptions about the validity of a key based on how long it has been in circulation. If a key has been in use for a while, it is less likely that someone will try to replace it since there are many other copies in circulation. However, creation dates should never be used as the sole indicator of validity.


Size

Indicates the number of bits used to construct the key. Generally, the larger the key, the less chance it will be compromised. However, larger keys require more time to encrypt and decrypt data than smaller keys. When you create a DSS/Diffie-Hellman key, there is one number for the DSS portion and another number for the Diffie-Hellman portion. The DSS portion is used for signing and the Diffie-Hellman portion is used for encryption.


Examining a key's properties

In addition to the general attributes shown in the PGPkeys window, you can also examine and change other key properties. To access the properties for a particular key, select and highlight the key, then select Key Properties from the Keys menu.

The Key Properties dialog box displays the following elements.

Click on an item name to display a description.

Key ID

Created

Key Type

Expires

Trust Model

Fingerprint

Enabled

Change Passphrase


Key ID

A unique identifying number associated with each key. This number distinguishes between two keys with the same user name and e-mail address.


Created

Date the key was created.


Key Type

The key type—either RSA or Diffie-Hellman/DSS.


Expires

The date the key expires. You specify this date when a key is created. The value is usually set to never. However, if you only want a key used for a limited period of time, the key can be set to expire on a specific date.


Trust Model

Indicates the validity of the key, based on its certification and the level of trust you have in the owner to vouch for the authenticity of someone else’s public key. Set the trust level by sliding the bar to the appropriate level (complete, marginal, or untrustworthy).


Enabled

Indicates whether or not the key is currently enabled. When a key is disabled, it is dimmed out in the PGPkeys window and is not be available for performing any PGP functions. However, the key remains on your keyring where it can later be enabled if necessary. To enable or disable a key, use this box, or select Enable or Disable from the Keys pull-down menu.


Change Passphrase

Allows you to change the passphrase for a private key. It is generally a good idea to change your passphrase every six months.


Validating your keys

Once you have a copy of someone’s public key, you can add it to your public keyring. You should then check to make sure that the key has not been tampered with and that it really belongs to the purported owner. You do this by comparing the unique fingerprint on your copy of someone’s public key to the fingerprint on his or her original key. When you are sure that you have a valid public key, you sign it to indicate that you feel the key is safe to use. In addition, you can grant the owner of the key a level of trust indicating how much confidence you have in them to vouch for the authenticity of someone else’s public key.


Protecting your keys

After you have generated a key pair, create a spare pair and put them in a safe place in case something happens to the originals. Your private keys and your public keys are stored in separate keyring files, which you can copy just like any other files to another location on your hard drive or to a floppy disk. By default, the private keyring (secring.skr) and the public keyring (pubring.pkr) are stored with the other program files in the PGP file directory, but you can save your backups wherever you like. PGP creates backup copies of your public and private keys when you generate these keys. These copies are called pubring.pkr.bak and secring.skr.bak.

Besides making backup copies of your keys, be especially careful about where you store your private key. As another security precaution, consider assigning a different name to your private keyring file and then storing it somewhere other than in the default PGP file directory where it will not be so easy to locate.


Signing someone's key

Once you are absolutely convinced that you have a legitimate copy of someone’s public key, you can then sign his or her key. By signing someone’s public key with your private key , you are signifying to the world that you are sure the key belongs to the alleged user. For instance, when you create a new key, it is automatically certified with your own digital signature, since it is a reasonably safe assumption that the person creating the key is in fact the true owner. The reason for signing your own key is to prevent anyone from modifying it, which would immediately invalidate your signature. PGP 5.5 offers the option of having your key signed by the security officer, so that you know that they are valid.


To sign someone's public key

When you create a pair of keys, they are automatically signed using your public key. Similarly, once you are sure that a key belongs to the proper individual, you can sign that person’s public key, indicating that you are sure it is a valid key.

To sign someone’s public key:

1	Select the key you want to sign.

2	Choose Sign from the Keys menu.

The PGP Sign Keys dialog box appears.

3	You are asked whether to allow signature to be exported. Others may rely on your signature. Click this check box if you want your signature to be exported.

4	If you would like to send the key with your signature to a key server, check the Send Signature to Keyserver check box.

A check box is displayed that says “Allow signature to be exported. Others may rely on your signature.” Select this box if you want your signature to be exported.

A More Choices button is displayed. When you click this button, the following signature types are displayed:

Nonexportable validity assertion

Use this signature when you believe the key is valid but you do not want others relying on your signature. This signature type cannot be sent with the associated key to a key server or exported in any way

Exportable validity assertion

Use exportable signatures in situations where your signature is sent with the key to the key server and is allwed to travel with the key wherever it is exported. This is the signature that was used in all previous versions of PGP.

Trusted Introducer validity assertion

Use this signature in situations where you certify that this key is valid, and that the owner of the key should be completely trusted to vouch for others’ keys by those who have designated you as a Meta-introducer.

Meta-Introducer validity assertion

Certifies that this key and any keys signed by this key with a trusted introducer validity assertion are fully trusted introducers to you.

5	Click OK to indicate your certainty that the key does indeed belong to the alleged owner.

6	The PGP Signing Passphrase dialog box appears. You are asked to enter the passphrase for your default key pair.

When you sign someone’s public key, a fountain pen or pencil icon with a blue exportable arrow associated with your user name is shown for that key.


Establishing PGP preferences

While PGP is configured to accommodate the needs of most users, you have the option of adjusting some of the settings to suit your particular computing environment. You specify these settings through the PGP Preferences dialog box that you access by clicking the right mouse button on the key and lock icon and then selecting the Preferences menu option. You can also access the Preferences dialog box by selecting the Preferences option from the Edit pull-down menu.

See also

  General preferences

  Key Files preferences

  E-mail preferences

  Key Server preferences

  Advanced preferences


General preferences

You specify general encryption settings from the General pane in the Preferences Window.

Click on an item name to display a description.

Always encrypt to default key

Cache decryption passphrase for [] seconds

Cache signing passphrase for [] seconds

Faster Key Generation

Display Wipe Confirmation dialog


Always encrypt to default key

When this check box is selected, all the e-mail messages or file attachments you encrypt with a recipient’s public key are also encrypted to you using your default public key. It is useful to leave this setting turned on so that you have the option of decrypting the contents of any e-mail or files you have previously encrypted.


Cache decryption passphrase for [] seconds
Cache decryption passphrase

This setting specifies the amount of time (in hours: minutes: seconds) that your encryption passphrase is stored in your computer’s memory. If you regularly compose or read several e-mail messages in succession, you may want to increase the amount of time your passphrase is cached so you don’t have to enter it over and over again to get through all of your mail.


Cache signing passphrase for [] seconds
Cache signing passphrase

This setting specifies the amount of time (in hours: minutes: seconds) that your signature passphrase is stored in your computer’s memory. If you regularly compose or read several e-mail messages in succession, you may want to increase the amount of time your passphrase is cached so you don’t have to enter your passphrase over and over again to get through all of your mail.


Faster Key Generation

When this check box is selected, less time is required to generate a new Diffie-Hellman/DSS key pair. This process is accelerated by using a previously calculated set of prime numbers rather than going through the time-consuming process of creating them from scratch each time a new key is generated. The key size must be between 1024 and 4096 bits.


Display Wipe Confirmation dialog

When this setting is selected, a dialog box appears before you wipe a file to give you the last chance to change your mind before PGP securely overwrites the contents of the file and deletes it from your computer.

Tips

•	Even on systems with virtual memory, PGP correctly writes over all the contents of the file. It is worth noting that application programs that may have saved the file prior to encrypting it may also have left fragments of the file on your disk in locations that are no longer considered part of the file.

•	Be aware that many programs automatically save files in progress, so there may be backed up copies of the file that you want to delete.

•	You may wish to use a third-party utility to wipe all free space on your disk. PGP does not currently have this feature.


Key files preferences

Use the Files tab in the Preferences to specify the location of the keyrings used to store your private and public keys.

Click on an item name to display a description.

Public Key Ring File

Private Key Ring File

Random Seed file


Public Keyring File

Shows the current location and name of the file where the PGP program expects to find your public keyring file. If you plan to store your public keys in a file with a different name or in some other location, you specify this information here. You can use the Browse button to search through your files rather than having to type the path.


Private Keyring File

Shows the current location and name of the file where the PGP program expects to find your private keyring file. If you plan to store your private keys in a file with a different name or in some other location, you specify this information here. Some users like to keep their private keyring on a floppy disk, which they insert like a key whenever they need to sign or decrypt mail.


Random Seed file

Shows the location of the randseed.bin file. This file stores random data used during encryption and key generation.


E-mail preferences

You can specify preferences that affect the way PGP functions are implemented for those e-mail applications that are supported by the PGP plug-ins.

Note

The PGP/MIME option is not applicable for all e-mail applications.

Click on an item name to display a description.

Use PGP/MIME When Sending E-mail

Word-Wrap Clear-Signed Messages at Column [ ]

Encrypt New Messages by Default

Sign New Messages by Default

Automatically Decrypt/Verify When Opening Messages


Automatically Decrypt/Verify When Opening Messages

Attempts to decrypt messages as you open them.  If you do not have your passphrase cached, PGP prompts you for your passphrase.


Use PGP/MIME when sending e-mail

When this check box is selected, you do not have to go to the trouble of explicitly turning on the PGP/MIME feature every time you send e-mail. For instance, if you are using Eudora, and you turn this setting on, all of your e-mail messages and file attachments are automatically encrypted and signed to the intended recipient. This setting has no effect on other encryptions you perform from the clipboard or with the Windows Explorer. Do not use this option if you plan to send e-mail to recipients who use e-mail applications that are not supported by the PGP/MIME standard.


Word-Wrap Clear-Signed Messages at Column [ ]

This setting specifies the column number where a hard carriage return is used to wrap the text in your digital signature to the next line. This feature is necessary because not all applications handle word wrapping in the same way, which could cause the lines in your digitally signed messages to be broken up in a way that cannot be easily read.  The default setting is 70, which prevents problems with most applications.


Encrypt New Messages by Default

Encrypts all your e-mail application. The lock icon remains indented to indicate that the encryption function is turned on.


Sign New Messages by Default

Signs all your e-mail application. The quill icon remains indented to indicate that the signing function is turned on.


Key Server preferences

Click the Key Server tab to advance to the pane in which you specify settings for the key server you are using.

Click on an item name to display a description.

Server

Port

Automatically Synchronize Keys Upon


Server

Specifies the Internet domain, such as company.com, for the public key server that is used by PGP to send and retrieve public keys. This domain is used when sending keys to a server to look up the appropriate sever based on the domain of the key.


Port

The port address for the public key server. This must be entered in full URL form, such as

http:..pgpkeys.mit.edu.11371. The LDAP protocol is also supported.


Automatically Synchronize Keys Upon

You use this dialog box to synchronize your private keyring with your key server using the following options:

Encrypting to Unknown User	Causes PGP to automatically look up unknown recipients on the server when you encrypt a message to an unknown user, so that it can find that user’s key if it is not on your keyring.
Adding Names to Key	Causes the keys being added to be updated from the server prior to the addition, and sent to the server upon completion. The update from the server prior to the operation makes sure that, for instance, the key has not been revoked since the last time it was updated.
Key Signing	Causes the keys being signed to be updated from the server prior to the signature, and sent to the server upon completion. The update from the server prior to the operation makes sure that, for instance, the key has not been revoked since the last time it was updated.
Revocation	Causes the keys being revoked to be updated from the server prior to the revocation, and sent to the server upon completion. The update from the server prior to the operation makes sure that, for instance, the key has not been revoked since the last time it was updated.
Use the following settings to choose the server with which you will automatically synchronize keys:

New	Choose a new key server. You enter the key server’s domain and choose either an HTTP or LDAP address..
Remove	Remove a key server that is listed as one of the key servers that you use
Set default	Choose which key server is your default key server. Contact your security officer to find out if there is a default key server for you to choose. This allows you to specify the server of last resort that is used if no server can be found for the domain of the key.


Advanced preferences

Click the Advanced tab to make the following choices:

Encryption algorithm

You can select encryption algorithm for your PGP keys CAST (default), IDEA, and Triple-DES. If you want to use IDEA or Triple-DES, you must make this selection before you generate your keys.

Use the check boxes only if you have just decided that a particular algorithm is insecure. If you become aware that Triple-DES has been broken, you can simply deselect that box and your messages are encrypted using an unbroken algorithm.

Display Marginal Validity Level

Select this check box to display marginally validity keys or simply show validity as on or off. Green circles indicate that a key is valid; gray indicates that the key has not been validated, signed by either by a trusted introducer or by you, or implicitly trusted because it is a key you generated yourself.

Treat Marginally Valid Keys as Untrusted

Select this check box to choose whether to treat all marginally valid keys as untrusted. A warning box appears if you use marginally trusted keys and this box is selected

Warn when Encrypting to Keys with an ADK

Warns you if the key you are encrypting to is also encrypted to an Additional Decryption Key (ADK).


Key size

The key size corresponds to the number of bits used to construct your digital key. The larger the key, the less chance someone will ever be able to crack it but the longer it will take to perform the decryption and encryption process. You will need to strike a balance between the convenience of performing PGP functions quickly with a smaller key and the increased level of security provided by a larger key. Unless the information you are exchanging is extremely sensitive and of enough interest to someone who would be willing to mount an expensive and time consuming cryptographic attack in order to read it, you are probably safe using a key composed of 2048 bits (a maximum of 1024 bits are used for the DSS portion of the Diffie-Hellman/DSS key).


Hide Typing check box

Check this box if you do not want your passphrase to display on the screen when entered.


What is an adequate passphrase?

An adequate passphrase consists of more than eight characters and uses a variety of characters, including upper-and lower-case letters, numbers, and spaces.


Why did the Random Data dialog box appear?

If there is not enough random information upon which to build the key, the PGP Random Data dialog box appears. As instructed in the dialog box, move your mouse around and enter a series of random keystrokes until the progress bar is completely filled in. Your mouse movements and keystrokes generate random information that is needed to create a unique key pair.


Why is my key generation taking so long?

After the key generation process begins, it may take a while to generate the keys. In fact, if you specify a size other than the default values for a Diffie-Hellman/DSS key, the fast key generation feature is not used and it may take hours to generate your key. Eventually the Key Generation Wizard indicates that the key generation process has completed.


Contacting Technical Support

Business hours are from 8 AM to 5 PM (PST), excluding National holidays. Address changes can be mailed or e-mailed to Customer Service using the following information.

E-mail:	 	pgpsupport@PGP.com

Web:	http://www.pgp.com/service/service.cgi

Mail:	PGP Inc, 2121 South El Camino Real, San Mateo, CA 94403

If you are the end user of a PGP product that you did not purchase directly from PGP and you need technical assistance, please contact the provider of the software or hardware that included PGP software. If you are part of an enterprise network, please contact your network administrator or Information Services tech support group.

Technical Support Preparation

To ensure quick resolution, please have the following information ready before calling Support.

•	PGP product and version

•	Computer type and CPU type

•	Network operating system and version

•	Content of status or error message displayed on screen

•	E-mail application and version


Checking a key's fingerprint

It is often difficult be certain that a key belongs to a particular person unless that person physically hands their key to you on a floppy disk. Since this is not always possible, each key is associated with a unique fingerprint that can be used to verify that a key belongs to a specific person.

The optimum way to check a fingerprint is to have the owner read their fingerprint over the phone and then compare it to the fingerprint on your copy of their public key.

You can also check the authenticity of someone’s key by comparing the fingerprint on your copy to the one listed on a public key server, since it is assumed the owner periodically checks to make sure the fingerprint remains valid.

To see how to check a key’s fingerprint, click [image].


To check a key's fingerprint

1	Select the key for the fingerprint you want to check.

2	Choose Key Properties from the Keys menu.

3	Note the fingerprint and compare it to the original.


Granting trust for key validations

In addition to certifying that a key belongs to a specific person, you can also assign a level of trust to the user of the keys, indicating how well you trust them to act as an introducer to others whose key you may get in the future. This means that if you get a key from someone that has been signed by an individual that you certified his or her key would be considered valid even though you have not done the check yourself.   To see how to grant trust for a key, click [image].


To grant trust for a key

1	Select the key for which you want to change the trust level.

2	Choose Key Properties from the Keys menu.

The Properties dialog box appears.

3	Use the trust level sliding bar to choose the appropriate level of trust for the key: Untrusted, Marginal, or Complete.

4	Click OK to accept the new setting.


Disabling and enabling keys

You can temporarily disable a key so that it does not show up in your recipients' list. The ability to disable keys is useful when you want to retain a public key for future use, but don’t want it included in your recipient list every time you send mail.

To disable a key:

1	Select and highlight the key you want to disable.

2	Choose Disable from the Keys menu.

The key is dimmed and is temporarily unavailable for use.

To enable a key:

1	Select and highlight the key you want to enable.

2	Choose Enable from the Keys menu.

The key is becomes visible and can be used as before.

See also

  Revoking keys

  Deleting a key or signature


Deleting a key or signature

If you no longer want to store a particular key on your keyring or you want to remove your signature from someone’s public key, you can delete the key or the signature.

To delete an item from the PGPkeys window:

1	Select the key, signature, or user ID you want to delete.

2	Choose Delete from the Edit menu.


Changing your passphrase

1	Select and highlight the key pair for which you want to change the passphrase.

2	Select Key Properties from the Keys menu. The Properties dialog box appears.

3	Click Change Passphrase. The Change Passphrase dialog box displays.

4	Enter your old passphrase in the top portion of the dialog box. Press Tab to advance to the next field.

5	Enter your new passphrase in the center dialog field and Press Tab.

6	Confirm your entry by reentering your new passphrase.

7	Click OK.

See also

  What is an adequate passphrase?


Revoking keys

If you can no longer trust your personal key pair, you can issue a revocation that tells everyone to stop using your public key. The best way to circulate a revoked key is to place it on a public key server.

To revoke your keys:

1	Select and highlight the key pair you want to revoke.

2	Choose Revoke from the Keys menu.

3	Enter your passphrase and click OK.

A revoked key displays crossed out with a red line to indicate it is no longer valid.

If you lost or forgot your passphrase, you cannot use your key and you cannot invalidate your old key when you create a new one. To safeguard against this possibility, you can create a revocation key to be used in case you ever lose or forget your passphrase. To do so, make a copy of your key pair, revoking one copy, then putting the revoked key in a safe place. Be very careful where you store the revoked version of your key. If someone finds the revoked key, they can revoke your key and replace it with one of their own.

See also

  Disabling and enabling keys


Opening the PGPkeys window

By choosing the Launch PGPkeys option from the PGP pop-up menu, you open the PGPkeys window which shows the private and public key pairs you have created for yourself as well as any public keys you have added to your public keyring. (If you have not already created a new key pair, the PGP Key Wizard leads you through the steps necessary to create a key pair.  For more information, click [image].%

From the PGPkeys window you can create new key pairs and manage all of your other keys. For instance, this is where you examine the attributes associated with a particular key, specify how confident you are that the key actually belongs to the alleged owner, and indicate how well you trust that person to vouch for the authenticity of other users’ keys.

See also

  The PGPkeys Window

  Managing your keys


Starting PGP

There are two ways to start PGP:

•	Open the PGPkeys window by clicking on the lock and key icon in the system tray

•	Click the Start button and choose PGPkeys from the PGP submenu of the Programs menu.


Selecting recipients

When you send e-mail to someone whose e-mail application is supported by the PGP plug-ins, the recipient’s e-mail address determines which keys to use when encrypting the contents. However, if you enter a user name or e-mail address that does not correspond to any of the keys on your public keyring or if you are encrypting from the clipboard or the Windows Explorer, you must manually select the recipient’s public key from the PGP Key Selection Dialog box.

To select a recipient’s public key:

Drag the icon representing their key into the Recipient’s list box and then click OK.


To create a group

1	Choose New Group from the Group menu.

2	Type the name of the Group. If you want, you can type a group description.

3	Add users to your group by dragging users from their names from the PGPkeys window to the Group pane.


To delete group members

1	Select the group member to be deleted.

2	Press the Delete key on your keyboard.

PGP asks you to confirm your choice.


To search for a key

1	Open the PGPkeys window.

2	Choose Search from the Keys menu.

The PGPkeys Search window appears.

3	Choose the location you wish to search from the Search for Keys On menu.

4	Specify your search criteria:

The default is User ID, but you can click the drop-down menu to select Key ID, Key Type, Creation Date, Expiration Date, Key Status, or Key Size. For example, you might search for all keys with the User ID of Fred.

5	Specify the condition for which you are searching.

6	Enter the value you want to search for.

Click More Choices to add additional criteria to your search; for example, Key IDs with the name Fred created on or before October 6, 1997.

7	To begin the search, click Search.

A progress bar shows that the search is being conducted.

The results of the search appear in the window.

Notes

•	To cancel a search in progress, click Stop Search

•	Click Clear Search to empty the search window and clear your search criteria.


The PGPlog window

The PGPlog window appears when you verify a signed message.  It displays the following information:

•	The name of the file or application that is verifying the message

•	An icon that indicates whether the signature was verified.  A red slash through the icon indicates that the signature was not verified.

•	The name of the signing key, if the key is on your keyring

•	The date of the signature

Under some circumstances, additional information is displayed:

•	Signing key not found

•	Bad Signature

•	Revoked Key

•	Expired Key

•	Disabled Key

•	Invalid Key


This file is organized to display first the contents of the help  button on a particular dialog, then each individual help topic.

The Wizard help is at the end of the file.

The Personal Privacy release contains hidden text, which is formatted in blue.

The Business Security release should contain none of this hidden text.


General preferences

You specify general encryption settings from the General pane in the Preferences Window.

Always encrypt to default key

When this check box is selected, all the e-mail messages or file attachments you encrypt with a recipient’s public key are also encrypted to you using your default public key. It is useful to leave this setting turned on so that you have the option of decrypting the contents of any e-mail or files you have previously encrypted.

Cache decryption passphrase

This setting specifies the amount of time (in hours: minutes: seconds) that your encryption passphrase is stored in your computer’s memory. If you regularly compose or read several e-mail messages in succession, you may want to increase the amount of time your passphrase is cached so you don’t have to enter it over and over again to get through all of your mail.

Cache signing passphrase

This setting specifies the amount of time (in hours: minutes: seconds) that your signature passphrase is stored in your computer’s memory. If you regularly compose or read several e-mail messages in succession, you may want to increase the amount of time your passphrase is cached so you don’t have to enter your passphrase over and over again to get through all of your mail.

Comment block

Comments entered in the Comment Block field are included in all encrypted files.

Faster Key Generation

When this check box is selected, less time is required to generate a new Diffie-Hellman/DSS key pair. Using a previously calculated set of prime numbers—rather than going through the time-consuming process of creating them from scratch each time a new key is generated—accelerates this process. The key size must be between 1024 and 4096 bits.

Display Wipe Confirmation dialog

When this setting is selected, a dialog box appears before you wipe a file to give you the last chance to change your mind before PGP securely overwrites the contents of the file and deletes it from your computer.

Tips

•	Even on systems with virtual memory, PGP correctly writes over all the contents of the file. It is worth noting that application programs that may have saved the file prior to encrypting the file, may have left fragments of the file on your disk in locations which are no longer considered part of the file.

•	Also, be aware that many programs automatically save files in progress, so there may be backed up copies of the file that you want to delete.

•	You may wish to use a third-party utility to wipe all free space on your disk to solve this problem. PGP does not currently have this feature.


Specifies that all e-mail messages or file attachments you encrypt with a recipient’s public key are also encrypted to you using your default public key.


Specifies the amount of time (in hours: minutes: seconds) that your decryption passphrase is stored in your computer's memory.  The default setting is 2 minutes.


Specifies the amount of time (in hours: minutes: seconds) that your signing passphrase is stored in your computer's memory.  The default setting is 2 minutes.


Comments entered in the field are included in all encrypted files.


Decreases the amount of time it takes to generate a new set of Diffie-Hellman keys/DSS.


Displays a confirmation dialog box before wiping a file.


Key files preferences

Use the Files tab in the Preferences to specify the location of the keyrings used to store your private and public keys.

Public Keyring File

Shows the current location and name of the file where the PGP program expects to find your public keyring file. If you plan to store your public keys in a file with a different name or in some other location, you specify this information here. You can use the Browse button to search through your files rather than having to type the path.

Private Keyring File

Shows the current location and name of the file where the PGP program expects to find your private keyring file. If you plan to store your private keys in a file with a different name or in some other location, you specify this information here. Some users like to keep their private keyring on a floppy disk, which they insert like a key whenever they need to sign or decrypt mail.

Random Seed file

Shows the location of the randseed.bin file. This file stores random data used during encryption and key generation.


Displays the location of your active private keyring file.


Click to specify a key file as your active private keyring.


Displays the location of your active public keyring file.


Click to specify a key file as your active public keyring.


Shows the location of the active Random Seed File.


Click to specify a Random Seed file to use when generating keys and encrypting information.


E-mail preferences

You can specify preferences that affect the way PGP functions are implemented for those e-mail applications that are supported by the PGP plug-ins.

Note

The PGP/MIME option is not applicable for all e-mail applications.

Use PGP/MIME when sending e-mail

When this check box is selected, you do not have to go to the trouble of explicitly turning on the PGP/MIME feature every time you send e-mail. For instance, if you are using Eudora, and you turn this setting on, all of your e-mail messages and file attachments are automatically encrypted and signed to the intended recipient. This setting has no effect on other encryptions you perform from the clipboard or with the Windows Explorer. Do not use this option if you plan to send e-mail to recipients who use e-mail applications that are not supported by the PGP/MIME standard.

Word-Wrap Clear-Signed Messages at Column [ ]

This setting specifies the column number where a hard carriage return is used to wrap the text in your digital signature to the next line. This feature is necessary because not all applications handle word wrapping in the same way, which could cause the lines in your digitally signed messages to be broken up in a way that cannot be easily read.  The default setting is 70, which prevents problems with most applications.

Encrypt New Messages by Default

Encrypts all your e-mail application. The lock icon remains indented to indicate that the encryption function is turned on.

Sign New Messages by Default

Signs all your e-mail application. The quill icon remains indented to indicate that the signing function is turned on.

Automatically Decrypt When Opening Messages

Attempts to decrypt messages as you open them.  If you do not have your passphrase cached, PGP prompts you for your passphrase.


When this option is selected, Eudora will format encrypted or signed messages with PGP/MIME. You may turn off PGP/MIME formatting by pressing the PGP/MIME button on any message window.


Enables word-wrapping of clear-signed messages.


Specifies the column after which the text of a signed e-mail message will be word-wrapped.  The default column number is 70.


When this option is selected, your e-mail application will encrypt outgoing mail by default.


When this option is selected, your e-mail application will sign outgoing mail by default.


Attempts to decrypt messages as you open them.  If you do not have your passphrase cached, PGP prompts you for your passphrase.


Key Server preferences

Server

Specifies the Internet domain, such as company.com, for the public key server that is used by PGP to send and retrieve public keys. This domain is used when sending keys to a server to look up the appropriate sever based on the domain of the key.

Port

The port address for the public key server. This must be entered in full URL form, such as

http:..pgpkeys.mit.edu.11371. The LDAP protocol is also supported.

Automatically Synchronize Keys Upon

You use this dialog box to synchronize your private keyring with your key server using the following options:

Encrypting to Unknown User

Causes PGP to automatically look up unknown recipients on the server when you encrypt a message to an unknown user, so that it can find that user’s key if it is not on your keyring.

Adding Names to Key

Causes the keys being added to be updated from the server prior to the addition, and sent to the server upon completion. The update from the server prior to the operation makes sure that, for instance, the key has not been revoked since the last time it was updated.

Key Signing

Causes the keys being signed to be updated from the server prior to the signature, and sent to the server upon completion. The update from the server prior to the operation makes sure that, for instance, the key has not been revoked since the last time it was updated.

Revocation

Causes the keys being revoked to be updated from the server prior to the revocation, and sent to the server upon completion. The update from the server prior to the operation makes sure that, for instance, the key has not been revoked since the last time it was updated.

Use the following settings to choose the server with which you will automatically synchronize keys:

New

Choose a new key server. You enter the key server’s domain and choose either an HTTP or LDAP address..

Remove

Remove a key server that is listed as one of the key servers that you use

Set default

Choose which key server is your default key server. Contact your security officer to find out if there is a default key server for you to choose. This allows you to specify the server of last resort that is used if no server can be found for the domain of the key.


Click to remove a key server from the server list.


Click to add a server to the server list.


Displays available key servers. To display a server in the PGPkeys Search window, click the Listed check box.


To select a default server, click a server in the server list and then click Set Default.


Synchronizes your key with the server when you add new e-mail addresses to the key.


Synchronizes your key with the server when you revoke your key.


Updates a public key on the key server with the copy you have signed.


When encrypting to unknown keys, attempts to locate matching keys on the key server.


Type the domain of the key server.


Type the name of the key server.


Specifies the protocol used to access the key server as LDAP.


Specifies the protocol used to access the key server as HTTP.


Advanced preferences

Click the Advanced tab to make the following choices:

Encryption algorithm

You can select encryption algorithm for your PGP keys CAST (default), IDEA, and Triple-DES. If you want to use IDEA or Triple-DES, you must make this selection before you generate your keys.

Use the check boxes only if you have just decided that a particular algorithm is insecure. If you become aware that Triple-DES has been broken, you can simply deselect that box and your messages are encrypted using an unbroken algorithm.

Display Marginal Validity Level

Select this check box to display marginally validity keys or simply show validity as on or off. Green circles indicate that a key is valid; gray indicates that the key has not been validated, signed by either by a trusted introducer or by you, or implicitly trusted because it is a key you generated yourself.

Treat Marginally Valid Keys as Untrusted

Select this check box to choose whether to treat all marginally valid keys as untrusted. A warning box appears if you use marginally trusted keys and this box is selected. The Advanced Preferences tab allows you to select your encryption algorithm and trust model.  For information on a specific option, click the question mark in the title bar and then click the option, or right-click on the option.

Warn When Encrypting Keys to keys with an ADK

Warns you if the key you are encrypting to is also encrypted to an Additional Decryption Key (ADK).


Indicates that you are willing to receive e-mail encrypted with the Triple-DES algorithm.


Indicates that you are willing to receive e-mail encrypted with the CAST algorithm.


Indicates that you are willing to receive e-mail encrypted with the IDEA algorithm.


Specifies your default encryption algorithm.


Warns you if the key you are encrypting to is also encrypted to an Additional Decryption Key (ADK).


Warns you if you attempt to use a public key that is not considered completely valid.


Toggles the validity indicator in the PGPkeys window from on/off (green dot) to sliding (gray bar).


Type your current passphrase.


Type your new passphrase.


Type your new passphrase again.


Saves the output of encrypted text to text format. Note that this option will add to the size of the file.


Wipes the original file after it is encrypted.  Exercise caution when this option is selected to prevent unintentional data loss.


Uses encryption based on a commonly known passphrase instead of public key encryption.


Lists the keys for all recipients. To add to this list, drag a key or group from the list above and drop it on this list.  To delete items from this list, select the item and drag it from the list.


This list displays your available keys and groups. To encrypt to a key or to a group, select the key or group and drag it to the Recipients list.


Click to delete this key and be prompted for the next key in the queue.


Click to delete all selected keys.


Click to skip deletion of this key and be prompted for the next key in the queue.


Cancels deletion of keys and closes this dialog box.


Specifies the amount of time (in hours: minutes: seconds) that your signing passphrase is stored in your computer's memory.


Specifies the amount of time (in hours: minutes: seconds) that your decryption passphrase is stored in your computer's memory.


Displays the name and fingerprint of the key that you have selected to sign.


Click this button to allow your signature to be exported along with its associated public key.


Click to see information on signature types.


Less is more.  --Mies van der Rohe


The PGP Sign Key window

This window displays the key that you have selected to sign and its fingerprint.

For information on a specific option, click the question mark in the title bar and then click the option, or right-click on the option.


Lists all keys available for import.


Selects all keys in the Import list.


Deselects all keys in the Import list.


Click to import keys to your local keyring.


Indicates the cyptographic integrity of your passphrase.


Displays the minimum passphrase integrity as required by your security officer.


Lists all columns not currently displayed in the PGPkeys window.


Lists all columns that are currently displayed in the PGPkeys window.


Adds the selected column to the PGPkeys window.


Removes the selected column from the PGPkeys window.


Moves the selected column one position to the left in the PGPkeys window.


Moves the selected column one position to the right in the PGPkeys window.


Select Columns window

Available Fields

Lists all columns not currently displayed in the PGPkeys window.

Show these columns

Lists all columns that are currently displayed in the PGPkeys window.

Add button

Adds the selected column to the PGPkeys window.

Remove button

Removes the selected column from the PGPkeys window.

Move Up button

Moves the selected column one position to the left in the PGPkeys window.

Move Down button

Moves the selected column one position to the right in the PGPkeys window.


Search Dialog

The Search dialog provides options that assist you in locating a particular key or keys.

Search for keys on

Click an item in the list to specify where to search.

Search Criteria

You can use any or all of the following criteria (or their inverse) to search for keys:

•	User ID

•	Key ID

•	Key Type

•	Creation Date

•	Expiration Date

•	Revoked Keys

•	Disabled Keys

•	Key Size

•	Keys Signed by a particular key

More Choices

To add to the list of criteria. click More Choices.

Fewer Choices

To remove items from your list of criteria, click Fewer Choices.

Search

Click to search using the current criteria.

Clear Search

Clears the current criteria.


The key’s ID number.


The key type—either RSA or Diffie-Hellman/DSS.


The date the key was created.


The date the key expires.


The key's fingerprint, which is its unique identifying number.


The key’s size in bits.  If the key is an RSA type key, one number appears.  If the key is a Diffie-Hellman/DSS key, two numbers appear.  The first number is the size of the Diffie-Hellman portion of the key; the second number is the size of the DSS portion of the key.


The encryption algorithm that the key uses—either CAST, IDEA, or Triple-DES.


Enables the key.


Move the slider bar to assign a level of trust to the key.


A graphical representation of the key’s validity.


This field displays the key’s validity—Invalid, Marginal, or Complete.


Displays your level of trust in the key—Untrusted, Marginal, or Complete.


Indicates that you are the owner of the key pair and thus trust the keys implicitly.


Key Properties dialog box

Key ID

The key’s unique ID number.

Created

The date the key was created.

Key Type

The key type—either RSA or Diffie-Hellman/DSS.

Expires

The date the key expires.

Key Size

The key’s size in bits.  If the key is an RSA type key, one number appears.  If the key is a Diffie-Hellman/DSS key, two numbers appear: the first number is the size of the Diffie-Hellman portion of the key; the second number is the size of the DSS portion of the key.

Cipher

The encryption algorithm that the key uses—either CAST, IDEA, or Triple-DES. Enables the key.

Validity

This field displays the key’s validity—Invalid, Marginal, or Complete.

Validity Bar

Displays a graphical representation of the key’s validity.

Trust

Displays your level of trust in the key—Untrusted, Marginal, or Complete

Trust Slider

Move the slider bar to assign a level of trust to the key.

Implicit Trust check box

Indicates that you are the owner of the key pair and thus trust the key implicitly.

Fingerprint

The key's fingerprint, which is its unique identifying number.

Enabled check box

Indicates whether the key is enabled.

Change Passphrase (for private key pairs)

Changes the key’s passphrase.


The Key Selection (Recipients) dialog box

Available keys are displayed in the list at the top of the window.  Current recipients are displayed in the list at the bottom of the window.

To add to your list of recipients, select the users or groups from the list of available keys and drag them to the Recipients list.

Text Output

Saves the output of encrypted text to text format. Note that this option will add to the size of the file.

Wipe Original

Wipes the original file after it is encrypted.  Exercise caution when this option is selected to prevent unintentional data loss.

Conventional Encryption

Uses encryption based on a commonly known passphrase instead of public key encryption.


Change Passphrase dialog box

Hide Typing check box

Hides the characters you type in the passphrase field.

Type Your Old Passphrase

Type the passphrase you currently use in the field.

Type Your New Passphrase

Type your new passphrase in the field

Confirm Your New Passphrase

Retype your new passphrase in the field.

Passphrase Quality

Indicates the cryptographic integrity of the passphrase you entered.

Enforced Minimum Passphrase Quality

Displays the minimum passphrase integrity as required by your security officer.


Type the description of the new group in the field.


Type the name of the new group in the field.


Selects the Meta-Introducer signature type.


Selects the Non-Exportable signature type.


Selects the Trusted Introducer signature type.


Selects the Exportable signature type.


Click to change your passphrase.


Type your passphrase again.


Type your passphrase.


Hides the characters you type in the passphrase field.


Type the name of the person you want to add to the key.


Type the e-mail address of the person whose name you want to add to the key.


Indicates the quality of your passphrase.


Hides the characters you type in the passphrase field.


Click a key to select it as your signing key.


Revoke Signature dialog box

Click OK to revoke your signature on this key.

Click Cancel to close the dialog box without revoking the signature.

Once you revoke a signature, to revalidate the key, you must delete the revoked signature and resign the key.


Type a passphrase to use to encrypt the data.  All recipients will need this passphrase to decrypt the data.  Find a secure way to communicate the passphrase to your recipients.


About PGP and Public Key Cryptography

With PGP™, you can protect the privacy of your e-mail messages and files by encrypting them so that only the intended recipients can read them. You can also digitally sign messages and files, which ensures their authenticity. A signed message verifies that the information within it has not been tampered with in any way.

PGP is based on a widely accepted encryption technology known as public key cryptography in which two complementary keys—a key pair—are used to maintain secure communications. To send someone a private e-mail message, you use a copy of that person’s public key to encrypt the information, which only they can decipher by using their private key. Conversely, when someone wants to send you encrypted mail, they use a copy of your public key to encrypt the data, which only you can decipher by using a copy of your private key.

You also use your private key to sign the e-mail you send to others. The recipients can then use their copy of your public key to determine if you really sent the e-mail and whether it has been altered while in transit. When someone sends you e-mail with their digital signature, you use a copy of their public key to check the digital signature and to make sure that no one has tampered with the contents.


One of the following situations occurred:

•	Your passphrase does not meet suggested 8-character length

•	Your attempt to confirm your passphrase was inaccurate

•	Your passphrase does not meet the security requirements outlined by your security officer


The key you are creating will be used to automatically sign and trust the Corporate Signing Key.  The Corporate Signing Key is used to sign your coworkers’ keys and because you signed and trusted the Corporate Signing Key, any key signed by the Corporate Key will also appear valid to you.


Congratulations!  You have created a PGP key pair!

For more information on PGP, see the PGP Help topics.


Indicate when you want your keys to expire.

To set an expiration date for your keys, select Key Pair Expires On, then click in the month, day or year field.  Use the up and down arrows on the right side of the field to increment or decrement the date.


The Key Generation Wizard indicates that it is busy generating your key pair. It may take a while to generate the keys. In fact, if you specify a size other than the default values for a Diffie-Hellman/DSS key, the fast key generation feature is not used and it may take hours to generate your key.

Eventually the Key Generation Wizard indicates that the key generation process has completed.


The key your are generating will also be encrypted to the Additional Decryption Key.  This means that everything that is encrypted to the key you are generating will also be encrypted to the Additional Decryption Key, allowing the holder(s) of that key to decrypt anything encrypted with your key.


Enter your name on the first line and your e-mail address on the second line.

It is not necessary to use your real name or an e-mail address; for example, you may enter your initials or a nickname.  However, using your real name makes it easier for others to identify you as the owner of your public key, and entering an e-mail address enables you to utilize PGP’s e-mail features.


Enter the string of characters or words you want to use to gain exclusive access to your private keys.

To confirm your entry, press the Tab key to advance to the next line, then enter the same passphrase again.

To prevent the text you enter from displaying as you type, select Hide Typing.


Probably the best long-term method for making your public key available is to place it on a public key server where anyone can access it. By storing your public key on a key server, people can send you e-mail without having to explicitly request a copy of your key.

To send your new public key to the default key server now, click the check box.

Ensure that you are connected to a network and can connect to a key server.


If there is not enough random information upon which to build the key, the PGP Random Data dialog box appears. As instructed on the screen, move your mouse around within the Key Generation window and enter a series of random keystrokes until the progress bar in the dialog box is completely filled in.


The Key Generation Wizard is attempting to send your new public key to a server.  If your public key is stored on a key server, it is available to other PGP users, who can then can send you encrypted email and verify your digital signature.

To send your key, ensure that you are connected to a network and can connect to a key server.


If you have created a new key pair using the same user name and e-mail address as another key pair, you can sign the new key with your old key to transfer trust through the signatures on your old key.


The key size corresponds to the number of bits used to construct your digital key. The larger the key, the less chance someone will ever be able to crack it but the longer it will take to perform the decryption and encryption process. You will need to strike a balance between the convenience of performing PGP functions quickly with a smaller key and the increased level of security provided by a larger key. Unless the information you are exchanging is extremely sensitive and of enough interest to someone who would be willing to mount an expensive and time consuming cryptographic attack in order to read it, you are probably safe using a key composed of 2048 bits (a maximum of 1024 bits are used for the DSS portion of the Diffie-Hellman/DSS key).


Select a key type, either Diffie-Hellman/DSS or RSA. PGP supports the use of two types of keys—the traditional RSA key used in older versions of PGP and a new type of key called Diffie-Hellman/DSS, which provides greater security over the Internet.

Note

If you plan to exchange e-mail with someone who has a newer version of PGP, you can take advantage of the new Diffie-Hellman/DSS keys. However, if you are corresponding with someone who is using a previous version of PGP, you will need to use RSA keys to communicate with him or her.