trunk/Doc/winpt.texi

\input texinfo

@setfilename WinPT

This file describes the Windows Privacy Tray program and its main functions

This file is free under the terms of the GNU General Public License v2.

Copyright (C) 2006 Timo Schulz

Version 0.1.0

@settitle WinPT - The Windows Privacy Tray; a free GPG front-end for Windows

@section Requirements for WinPT

First you need to have a working GnuPG 1.4 installtion on the machine you
plan to install WinPT. If you don't have GPG in your machine, please
visit http://www.gnupg.org and download the latest GPG version there.
It comes with a graphical installer so there is no need to do this
step manually.

You need at least Windows 98/2K/XP, but Windows XP or better is
recommend. The program also works on NT/95/ME but there is no support
for these OS versions any longer.

@section A short Introduction

WinPT is a graphical GnuPG front-end which resides in the task bar.
It is divided into several, so-called, managers. There is a manager
for the keyring, for files and for smart cards. The aim of the program
is to secure email communication and to perform file encryption.

@subsection What is GnuPG
GnuPG is a tool for secure communication and data storage.
It can be used to encrypt data and to create digital signatures.
It includes an advanced key management facility and is compliant
with the proposed Internet standard as described in RFC2440.

@subsection The Web of Trust
For a detailled description of these and other GnuPG topics, I
recommend the available literature at http://www.gnupg.org. But
at least a general overview should be given here.

The certification scheme of OpenPGP does not base on a hirachical
approach. Instead it uses a combination of ownertrust and direct
key certification. Here is an example with Alice, Bob, Carol and Dave.

Alice knows Bob and checked the fingerprint of Bob's key when he
met him personally. Thus she knows that the key really belongs to
its owner and he trusts Bob to certify other keys. Then she issued
a signature on Bob's key. Bob knows Carol and also checked her identity.
Then he signed her key. Alice does not know Carol, but he knows Bob
and Bob trusts Carol. And because Alice trusts Bob, at a level she
decided before, he also trusts Carol. It's a transitiv relation.
Dave is isolated and does not know anybody from the mentioned persons,
thus he is not in the WoT.
Another very important point is, that the signer can decide,
after the certification, how much he trusts the key owner to
certify other keys.

It is very important to check the identify of a key owner. Mostly
this is done by comparing the fingerprint, which were submitted
by phone or written down at a personal meeting, with the fingerprint
of the key in the keyring. Please bear in mind that anybody can create
a key with an email address and a specific name. Thus it is not
recommend to sign keys without doing this check before!

The fingerprint of the key is hexadecial (160-bit) sequence divided
into 10 groups of 4 hex digits. You can get the fingerprint of a key
by opening the key property dialog. There you can mark the fingerprint
and copy it to the clipboard.

Example: 1D75 8108 5BC9 D9FB E78B  2078 ED46 81C9 BF3D F9B4

It is a good idea to publish your fingerprint wherever possible.
For example via a business card or your website.

@section Installation of the Program

It is always recommend to use the latest version of the program. You
can download it from http://wald.intevation.org/projects/winpt.
Download the zip file with the binaries inside and unpack them in
a folder. All files need to be in the same folder, so if you change
the folder don't forget to move all files.
You should also download and verify the signature of the packet to 
make sure that the release is really authentic.

To activate the program you just need to start WinPT.exe. You should
now see a little (golden key) icon in the taskbar which indicates that 
the program is running. If you want to quit the program, right click
on the symbol and select "Exit".

Alternative, you may use one of the graphical GPG installers which
are available on the internet. I recommend to use Gpg4Win which
includes a set of very useful privacy tools, beside WinPT and it
is very easy to use with an average size (~4MB). For non-German
speaking users, I recommend the light version because it does not
contain the 2 German PDF manuals.

@subsection Getting the Source of the Program
As free software, according to the GNU General Public License,
WinPT also offers the source code for the program. It can be used
for reviews, to compile your own binary and/or to modify and/or
redistribute it or just to learn how it works. The source is available
at the same place you downloaded the binary. If not, you should
contact the author of the site.
The entire program can be build with free software; the default
environment is a cross-compiler hosted on a Linux box. All you
need is the mingw32 packages, a working autoconf environment
and the libs WinPT depends on (currently gpgme and libgpg-error).
It is also possible to build the binary with cygwin/mingw32 on
Windows but this environment is not actively supported and propably
needs adjustment of the source.

@subsection Configure the Program
After the installation not much of the default settings need to
be changed. If you prefer a special keyserver, it is propably a good 
idea to open the keyserver dialog and to set one of the existing 
keyservers as the default or create a new entry and mark it as the 
new default. The default keyserver is subkeys.pgp.net, which is
the best choice for most users.

@subsection GPG Options
For expert users, the GPG preference dialog might contain some
interesting options. For example to set the expiration date of
a signature and/or to set the signing level for key signing.
It also allows to set a default 'encrypt-to' key and to set
the comment in ASCII armored files.

@subsection Preferences
In the WinPT preference dialog, the user can modify and/or disable
the default options. For new users it is suggested to leave the
default values as they are, except when there are problems related
to the hotkeys.

To enable keyring backups, the user can either decide to use the
GPG home directory as the backup folder or any other folder. In
the latter case, a folder needs to be chosen.


@section The First Start

This section is only important for people who never installed
and/or used WinPT before.

When the program is started the first time, it offers two choices.
The one is to generate a key pair and the other is to copy
existing GPG keyrings into the current installation.

We assume the user will select the first entry.

Now a new dialog is shown which requests some information from
the user to allow a meaningful association between the key and
the user. If the user prefer RSA keys, the check box should be marked. 
If the entered data is OK, WinPT then generates a new key pair. As long
as this step takes, a progress dialog is shown to indicate the 
enduring process. When the generation of the keypair is done, WinPT 
offers the chance to backup the existing keyrings. This is definitely
an important decision because if the keyring will get corrupted
or lost, there is no way to recover the encrypted data. That is
why it is also important to store the backup, at least of the
secret keyring, at a @strong{safe} place.

@section Keyserver Access

An easy way to retrieve keys is the keyserver. You can think of
it like a huge database with a lot of keys as its content. It is 
possible to search keys by a pattern, a keyid or even a fingerprint.
WinPT allows to access different kind of keyservers. For example
LDAP, HKP, Finger and HTTP. But the focus will be set on HKP because
this is the common case.

In some situations WinPT asks the user whether to retrieve keys 
automatically. One example is the signature verification when the 
key that issued the signature was not found in the keyring.

The main keyserver dialog allows to fetch one or more keys directly
or to search for a given pattern.

@subsection Retrieve a key by Key ID
The best way to fetch a key from the server is by the key ID.
Just enter the key ID, it is always a good idea to prefix it
with 0x and click the "Receive" button.

An example:

pattern: 0xBF3DF9B4

[Receive]


@subsection Retrieve a key by its email address
If you only know the email address from your partner, you can
enter it instead of the key ID. It is unlikely but possible
that there are more keys with the same address. In this situation,
WinPT will warn you that multiple keys were imported. The difference
to the search function is, that the keys were dirctly fetched and
not displayed as a key result list.


An example:

pattern: name_of_friend@@gmx.net

[Receive]


@subsection Search for a key by pattern
If you want to communicate with a new mail partner and you are
not sure about the key ID, it can be useful to search for his
email address. This address is considered as quite unique.

An example:

pattern: winpt@@windows-privacy-tray.com

[Search]

Now a dialog is opened with a list of all keys which matched
the search string. If the name @strong{and} the email address
is known, the matching key should be selected and "Receive"
should be clicked. Then the key will be downloaded and added
to your keyring. Now you can encrypt data with this key, for
example an email.

@subsection Sending a Key to the Keyserver
After you generated a new key pair, it is a good idea to send your
key to the keyserver to make it available for other users. If you
issue a signature, the key ID is part of the signature and people can 
automatically retrieve your key when they try to verify the signature.

Actually, the action is performed in the Key Manager and not in the
keyserver dialog. Just open the Key Manager, select the key you want
to send right-click on it and chose "Send to Keyserver" in the popup
menu. Then a message box with the result is shown.

@subsection Add, Delete or Edit a Keyserver Entry
The keyserver dialog allow to change the existing keyserver entries,
to delete them or to add new entries. Just right click on a selected
item and a popup menu will be shown with ("Edit", "Remove" and "New").

@section Using the Clipboard

A major aim from the first day was, that the program does not
depend on a special mailer client. For this reason it uses the
clipboard to encrypt and/or sign data.
For the examples, let's assume that you want to write a new
mail or that you received a mail protected by GnuPG.

@subsection Encrypt Data in the Clipboard
Just copy the text from the mailer window into the clipboard.
This is usually done by CTRL+C, make sure you really selected
all portions of the text. Then right-click on the tray icon
and select Clipboard->Encryption. Now a dialog is shown to
select the recipients. This means you need to select all
keys which should be able to decrypt the mail. Confirm with "OK".
GnuPG now encrypts the data with the selected recipients. At the
end a message box with the result is shown. Now the clipboard should 
contain the encrypted data. Just paste it into the mailer window.
The output should contain a header and a footer
"BEGIN PGP MESSAGE" and "END PGP MESSAGE.

@subsection Decrypt/Verify Data from the Clipboard

@subsection Sign the Clipboard

@section The Key Manager

This part of the program is propably most important for many users.
It contains function to manage your keyring and to perform actions
which are required and/or useful in the OpenPGP environment.

@subsection Tips

@itemize @bullet

@item
If you want to import quickly a key from a into the keyring, just
drag and drop the file into the Key Manager window. Then the import
procedure will be automatically started.

@item
Key which were fetched from keyservers often contain a lot of,
maybe obsolete, self signatures, if you want to get rid of them
you can use the Key Edit->Clean feature. Just start the edit
dialog and select the clean command. That's it.

@item
The keyserver dialog does not allow to import a key directly
via an URL, as an alternative you may use the "Import HTTP..."
feature in the Key Manager. With it you can directly fetch keys
from the web (Example: http://www.users.my-isp.de/~joe/gpg-keys.asc).

@item
To customize the parameters of the generated key, you can use
the expert key generation. It allows you to set the public key
algorithm and/or the size of the key directly.

@item
Most of the list view based dialogs allow to use the right
mouse button, to show popup menus with available commands.

@end itemize

@subsection Create a Revocation Certificate

It is very important to do this step early as possible. With this
certificate, you can revoke your entire key. The reason for this
can be for example, that your key is no longer used or even compromised.
After you generated the revoc cert, you should move it to a secure place
because anybody who gets access to it, can render your key unuseable.

Just right-click on your key and select "Revoke Cert". If you do this
step directly after key generation, there is no need to change the 
default values. Just select a file name and enter the passphrase.
The program issues a warning which should be read carefully.

@subsection Adding a new Secondary Key

For most users the existing keys in the key pair are enough
and no extra key is needed. But there are some exceptions.

@itemize @bullet

@item
The primary key has no secondary key and the primary key is not
able to encrypt data. In this case it can be a good idea to
add a secondary encryption key.

@item
A lot of people use secondary encryption keys with an expiration
date. Usually the key is valid for 1-2 years. After the key is expired,
a new key is needed in order to encrypt data.

@end itemize

What kind of public key algorithm should be selected is a matter
of taste. RSA and ElGamal are both capable for encryption. For most
users it's a good idea to let the program chose the key size (in bits).
The default settings should be secure enough for most purposes.

@subsection Adding a new User ID
If you got a new email account, it's propably a good idea to
add these new account to your key also. For example:

A new account was registed at gmail.com (john.doo@@gmail.com).
Then you should create a new user ID with the following fields:

name: John Doo

email: john.doo@@gmail.com

comment: (optional)

Now email programs are able to associate this address with your
key when somebody wants to send you a protected mail to this account.

@subsection Adding a new Photographic ID
With this function you can add a photo to your public. It will be
displayed in the key property dialog.

You just need to select a JPEG file which contains the photo and
enter your passphrase and confirm with OK. Please read the note
in the dialog carefully to make sure the photo has a proper size
(file, height and weight).

@subsection Adding a new Designated Revoker
If you want to allow another key to revoke your own key, this
might be useful if you lost your secret or a simliar situation,
you can use this function to add a designated revoker to your key.

All you need to do is to select the key you want to add as a desig
revoker. But please bear in mind that this procedure cannot be undone
and that this person really has the power to make your public key
unuseable. You really should trust the selected key, in case it is
not a key owned by yourself.

@subsection Export a Public Key
There are several reason why to export a public key and there
are also several ways to do it. If you want to send the key
directly to a mail recipient, you can select the key, right-click,
and select "Send Key to Mail Recipient". As an alternative, you
can also export it to the clipboard or to a file. To export a
key to the clipboard, you can select "Copy key to Clipboard"
in the popup menu of the selected key. To export it to a file,
you need to select the menu "Key" and then "Export...". The
program will automatically suggest a name for the output.

@subsection Import a Public Key
Similar to the key import, the import of a key can be done in
several ways. First, let's assume you got a mail with an OpenPGP
key included as inline text. Then you can use the current window
feature and "Decrypt/Verify" to import the key. Alternative you
also may use the clipboard. To achieve this, you first need to
select the entire key (CTRL+A) and then copy it to the clipboard
(CTRL+C), then use the Key Manager (Edit->Paste) to import it.
If the key is stored as an attachment, or you want to import
a key from a file in general, just drag the file and drop it
into the Key Manager window or use "Key" -> "Import...".

@subsection Sign a Public Key
If you verified that a key really belongs to its owner, you
should sign the key to integrate it into your Web of Trust
and also to mark the key as valid in your keyring. Do not sign
a key you just got via email with the request to sign it. Anybody
can create a key with your (or better ANY) name, these information 
are no hint to whom the key really belongs. You can check a key 
by meeting or calling the key owner and verify the key fingerprint 
of the key with the one published by the key owner. Additional checks
should be to watch at his driver license or the identity card to make
sure that name of the key matches the name of the key owner. After
this procedure is done, you can open the Key Manager, select the
right key and either use the context menu "Sign Key" or use the
toolbar button.

The next dialog will summarize the key information and some
additional options. For example if the signature should be
local or exportable. Local means the signature will be stripped
if you export the key and no one else except you can use it to
calculate the validity. If you mark the signature exportable,
any other user can see and use it. Now you can select the key
you want to use to sign and enter the passphrase. Confirm with "OK"
and the key will be signed. Now the validity of the new key is
"Full". It is propably a good idea to set the ownertrust of the
key. For a detailled description, see the chapter "Key Ownertrust".

@subsection Key Ownertrust
First we should explain what the ownertrust of a key is. The ownertrust
is a measurement how much you trust somebody to certify and check keys
of other people. For example, if you know that Bob is really the owner
of the key, you should sign it. But he is also known to sign other keys
without checking the idenity of the other key owner. Values for the
ownertrust are 1) Don't Know 2) Don't Trust 3) Marginal 4) Full
and thus you should propably use an ownertrust value like "Marginal".
But this is a personal decision and stored in a separate file and
never exported with the public keys. For further information, please
take a look into the GNU Privacy Handbook.
Just a last work on Key Pairs, they are automatically marked as
"Ultimate" because the key belongs to you and you trust it implicit.

@bye
1	\input texinfo
2
3	@setfilename WinPT
4
5	This file describes the Windows Privacy Tray program and its main functions
6
7	This file is free under the terms of the GNU General Public License v2.
8
9	Copyright (C) 2006 Timo Schulz
10
11	Version 0.1.0
12
13	@settitle WinPT - The Windows Privacy Tray; a free GPG front-end for Windows
14
15	@section Requirements for WinPT
16
17	First you need to have a working GnuPG 1.4 installtion on the machine you
18	plan to install WinPT. If you don't have GPG in your machine, please
19	visit http://www.gnupg.org and download the latest GPG version there.
20	It comes with a graphical installer so there is no need to do this
21	step manually.
22
23	You need at least Windows 98/2K/XP, but Windows XP or better is
24	recommend. The program also works on NT/95/ME but there is no support
25	for these OS versions any longer.
26
27	@section A short Introduction
28
29	WinPT is a graphical GnuPG front-end which resides in the task bar.
30	It is divided into several, so-called, managers. There is a manager
31	for the keyring, for files and for smart cards. The aim of the program
32	is to secure email communication and to perform file encryption.
33
34	@subsection What is GnuPG
35	GnuPG is a tool for secure communication and data storage.
36	It can be used to encrypt data and to create digital signatures.
37	It includes an advanced key management facility and is compliant
38	with the proposed Internet standard as described in RFC2440.
39
40	@subsection The Web of Trust
41	For a detailled description of these and other GnuPG topics, I
42	recommend the available literature at http://www.gnupg.org. But
43	at least a general overview should be given here.
44
45	The certification scheme of OpenPGP does not base on a hirachical
46	approach. Instead it uses a combination of ownertrust and direct
47	key certification. Here is an example with Alice, Bob, Carol and Dave.
48
49	Alice knows Bob and checked the fingerprint of Bob's key when he
50	met him personally. Thus she knows that the key really belongs to
51	its owner and he trusts Bob to certify other keys. Then she issued
52	a signature on Bob's key. Bob knows Carol and also checked her identity.
53	Then he signed her key. Alice does not know Carol, but he knows Bob
54	and Bob trusts Carol. And because Alice trusts Bob, at a level she
55	decided before, he also trusts Carol. It's a transitiv relation.
56	Dave is isolated and does not know anybody from the mentioned persons,
57	thus he is not in the WoT.
58	Another very important point is, that the signer can decide,
59	after the certification, how much he trusts the key owner to
60	certify other keys.
61
62	It is very important to check the identify of a key owner. Mostly
63	this is done by comparing the fingerprint, which were submitted
64	by phone or written down at a personal meeting, with the fingerprint
65	of the key in the keyring. Please bear in mind that anybody can create
66	a key with an email address and a specific name. Thus it is not
67	recommend to sign keys without doing this check before!
68
69	The fingerprint of the key is hexadecial (160-bit) sequence divided
70	into 10 groups of 4 hex digits. You can get the fingerprint of a key
71	by opening the key property dialog. There you can mark the fingerprint
72	and copy it to the clipboard.
73
74	Example: 1D75 8108 5BC9 D9FB E78B 2078 ED46 81C9 BF3D F9B4
75
76	It is a good idea to publish your fingerprint wherever possible.
77	For example via a business card or your website.
78
79	@section Installation of the Program
80
81	It is always recommend to use the latest version of the program. You
82	can download it from http://wald.intevation.org/projects/winpt.
83	Download the zip file with the binaries inside and unpack them in
84	a folder. All files need to be in the same folder, so if you change
85	the folder don't forget to move all files.
86	You should also download and verify the signature of the packet to
87	make sure that the release is really authentic.
88
89	To activate the program you just need to start WinPT.exe. You should
90	now see a little (golden key) icon in the taskbar which indicates that
91	the program is running. If you want to quit the program, right click
92	on the symbol and select "Exit".
93
94	Alternative, you may use one of the graphical GPG installers which
95	are available on the internet. I recommend to use Gpg4Win which
96	includes a set of very useful privacy tools, beside WinPT and it
97	is very easy to use with an average size (~4MB). For non-German
98	speaking users, I recommend the light version because it does not
99	contain the 2 German PDF manuals.
100
101	@subsection Getting the Source of the Program
102	As free software, according to the GNU General Public License,
103	WinPT also offers the source code for the program. It can be used
104	for reviews, to compile your own binary and/or to modify and/or
105	redistribute it or just to learn how it works. The source is available
106	at the same place you downloaded the binary. If not, you should
107	contact the author of the site.
108	The entire program can be build with free software; the default
109	environment is a cross-compiler hosted on a Linux box. All you
110	need is the mingw32 packages, a working autoconf environment
111	and the libs WinPT depends on (currently gpgme and libgpg-error).
112	It is also possible to build the binary with cygwin/mingw32 on
113	Windows but this environment is not actively supported and propably
114	needs adjustment of the source.
115
116	@subsection Configure the Program
117	After the installation not much of the default settings need to
118	be changed. If you prefer a special keyserver, it is propably a good
119	idea to open the keyserver dialog and to set one of the existing
120	keyservers as the default or create a new entry and mark it as the
121	new default. The default keyserver is subkeys.pgp.net, which is
122	the best choice for most users.
123
124	@subsection GPG Options
125	For expert users, the GPG preference dialog might contain some
126	interesting options. For example to set the expiration date of
127	a signature and/or to set the signing level for key signing.
128	It also allows to set a default 'encrypt-to' key and to set
129	the comment in ASCII armored files.
130
131	@subsection Preferences
132	In the WinPT preference dialog, the user can modify and/or disable
133	the default options. For new users it is suggested to leave the
134	default values as they are, except when there are problems related
135	to the hotkeys.
136
137	To enable keyring backups, the user can either decide to use the
138	GPG home directory as the backup folder or any other folder. In
139	the latter case, a folder needs to be chosen.
140
141
142	@section The First Start
143
144	This section is only important for people who never installed
145	and/or used WinPT before.
146
147	When the program is started the first time, it offers two choices.
148	The one is to generate a key pair and the other is to copy
149	existing GPG keyrings into the current installation.
150
151	We assume the user will select the first entry.
152
153	Now a new dialog is shown which requests some information from
154	the user to allow a meaningful association between the key and
155	the user. If the user prefer RSA keys, the check box should be marked.
156	If the entered data is OK, WinPT then generates a new key pair. As long
157	as this step takes, a progress dialog is shown to indicate the
158	enduring process. When the generation of the keypair is done, WinPT
159	offers the chance to backup the existing keyrings. This is definitely
160	an important decision because if the keyring will get corrupted
161	or lost, there is no way to recover the encrypted data. That is
162	why it is also important to store the backup, at least of the
163	secret keyring, at a @strong{safe} place.
164
165	@section Keyserver Access
166
167	An easy way to retrieve keys is the keyserver. You can think of
168	it like a huge database with a lot of keys as its content. It is
169	possible to search keys by a pattern, a keyid or even a fingerprint.
170	WinPT allows to access different kind of keyservers. For example
171	LDAP, HKP, Finger and HTTP. But the focus will be set on HKP because
172	this is the common case.
173
174	In some situations WinPT asks the user whether to retrieve keys
175	automatically. One example is the signature verification when the
176	key that issued the signature was not found in the keyring.
177
178	The main keyserver dialog allows to fetch one or more keys directly
179	or to search for a given pattern.
180
181	@subsection Retrieve a key by Key ID
182	The best way to fetch a key from the server is by the key ID.
183	Just enter the key ID, it is always a good idea to prefix it
184	with 0x and click the "Receive" button.
185
186	An example:
187
188	pattern: 0xBF3DF9B4
189
190	[Receive]
191
192
193	@subsection Retrieve a key by its email address
194	If you only know the email address from your partner, you can
195	enter it instead of the key ID. It is unlikely but possible
196	that there are more keys with the same address. In this situation,
197	WinPT will warn you that multiple keys were imported. The difference
198	to the search function is, that the keys were dirctly fetched and
199	not displayed as a key result list.
200
201
202	An example:
203
204	pattern: name_of_friend@@gmx.net
205
206	[Receive]
207
208
209	@subsection Search for a key by pattern
210	If you want to communicate with a new mail partner and you are
211	not sure about the key ID, it can be useful to search for his
212	email address. This address is considered as quite unique.
213
214	An example:
215
216	pattern: winpt@@windows-privacy-tray.com
217
218	[Search]
219
220	Now a dialog is opened with a list of all keys which matched
221	the search string. If the name @strong{and} the email address
222	is known, the matching key should be selected and "Receive"
223	should be clicked. Then the key will be downloaded and added
224	to your keyring. Now you can encrypt data with this key, for
225	example an email.
226
227	@subsection Sending a Key to the Keyserver
228	After you generated a new key pair, it is a good idea to send your
229	key to the keyserver to make it available for other users. If you
230	issue a signature, the key ID is part of the signature and people can
231	automatically retrieve your key when they try to verify the signature.
232
233	Actually, the action is performed in the Key Manager and not in the
234	keyserver dialog. Just open the Key Manager, select the key you want
235	to send right-click on it and chose "Send to Keyserver" in the popup
236	menu. Then a message box with the result is shown.
237
238	@subsection Add, Delete or Edit a Keyserver Entry
239	The keyserver dialog allow to change the existing keyserver entries,
240	to delete them or to add new entries. Just right click on a selected
241	item and a popup menu will be shown with ("Edit", "Remove" and "New").
242
243	@section Using the Clipboard
244
245	A major aim from the first day was, that the program does not
246	depend on a special mailer client. For this reason it uses the
247	clipboard to encrypt and/or sign data.
248	For the examples, let's assume that you want to write a new
249	mail or that you received a mail protected by GnuPG.
250
251	@subsection Encrypt Data in the Clipboard
252	Just copy the text from the mailer window into the clipboard.
253	This is usually done by CTRL+C, make sure you really selected
254	all portions of the text. Then right-click on the tray icon
255	and select Clipboard->Encryption. Now a dialog is shown to
256	select the recipients. This means you need to select all
257	keys which should be able to decrypt the mail. Confirm with "OK".
258	GnuPG now encrypts the data with the selected recipients. At the
259	end a message box with the result is shown. Now the clipboard should
260	contain the encrypted data. Just paste it into the mailer window.
261	The output should contain a header and a footer
262	"BEGIN PGP MESSAGE" and "END PGP MESSAGE.
263
264	@subsection Decrypt/Verify Data from the Clipboard
265
266	@subsection Sign the Clipboard
267
268	@section The Key Manager
269
270	This part of the program is propably most important for many users.
271	It contains function to manage your keyring and to perform actions
272	which are required and/or useful in the OpenPGP environment.
273
274	@subsection Tips
275
276	@itemize @bullet
277
278	@item
279	If you want to import quickly a key from a into the keyring, just
280	drag and drop the file into the Key Manager window. Then the import
281	procedure will be automatically started.
282
283	@item
284	Key which were fetched from keyservers often contain a lot of,
285	maybe obsolete, self signatures, if you want to get rid of them
286	you can use the Key Edit->Clean feature. Just start the edit
287	dialog and select the clean command. That's it.
288
289	@item
290	The keyserver dialog does not allow to import a key directly
291	via an URL, as an alternative you may use the "Import HTTP..."
292	feature in the Key Manager. With it you can directly fetch keys
293	from the web (Example: http://www.users.my-isp.de/~joe/gpg-keys.asc).
294
295	@item
296	To customize the parameters of the generated key, you can use
297	the expert key generation. It allows you to set the public key
298	algorithm and/or the size of the key directly.
299
300	@item
301	Most of the list view based dialogs allow to use the right
302	mouse button, to show popup menus with available commands.
303
304	@end itemize
305
306	@subsection Create a Revocation Certificate
307
308	It is very important to do this step early as possible. With this
309	certificate, you can revoke your entire key. The reason for this
310	can be for example, that your key is no longer used or even compromised.
311	After you generated the revoc cert, you should move it to a secure place
312	because anybody who gets access to it, can render your key unuseable.
313
314	Just right-click on your key and select "Revoke Cert". If you do this
315	step directly after key generation, there is no need to change the
316	default values. Just select a file name and enter the passphrase.
317	The program issues a warning which should be read carefully.
318
319	@subsection Adding a new Secondary Key
320
321	For most users the existing keys in the key pair are enough
322	and no extra key is needed. But there are some exceptions.
323
324	@itemize @bullet
325
326	@item
327	The primary key has no secondary key and the primary key is not
328	able to encrypt data. In this case it can be a good idea to
329	add a secondary encryption key.
330
331	@item
332	A lot of people use secondary encryption keys with an expiration
333	date. Usually the key is valid for 1-2 years. After the key is expired,
334	a new key is needed in order to encrypt data.
335
336	@end itemize
337
338	What kind of public key algorithm should be selected is a matter
339	of taste. RSA and ElGamal are both capable for encryption. For most
340	users it's a good idea to let the program chose the key size (in bits).
341	The default settings should be secure enough for most purposes.
342
343	@subsection Adding a new User ID
344	If you got a new email account, it's propably a good idea to
345	add these new account to your key also. For example:
346
347	A new account was registed at gmail.com (john.doo@@gmail.com).
348	Then you should create a new user ID with the following fields:
349
350	name: John Doo
351
352	email: john.doo@@gmail.com
353
354	comment: (optional)
355
356	Now email programs are able to associate this address with your
357	key when somebody wants to send you a protected mail to this account.
358
359	@subsection Adding a new Photographic ID
360	With this function you can add a photo to your public. It will be
361	displayed in the key property dialog.
362
363	You just need to select a JPEG file which contains the photo and
364	enter your passphrase and confirm with OK. Please read the note
365	in the dialog carefully to make sure the photo has a proper size
366	(file, height and weight).
367
368	@subsection Adding a new Designated Revoker
369	If you want to allow another key to revoke your own key, this
370	might be useful if you lost your secret or a simliar situation,
371	you can use this function to add a designated revoker to your key.
372
373	All you need to do is to select the key you want to add as a desig
374	revoker. But please bear in mind that this procedure cannot be undone
375	and that this person really has the power to make your public key
376	unuseable. You really should trust the selected key, in case it is
377	not a key owned by yourself.
378
379	@subsection Export a Public Key
380	There are several reason why to export a public key and there
381	are also several ways to do it. If you want to send the key
382	directly to a mail recipient, you can select the key, right-click,
383	and select "Send Key to Mail Recipient". As an alternative, you
384	can also export it to the clipboard or to a file. To export a
385	key to the clipboard, you can select "Copy key to Clipboard"
386	in the popup menu of the selected key. To export it to a file,
387	you need to select the menu "Key" and then "Export...". The
388	program will automatically suggest a name for the output.
389
390	@subsection Import a Public Key
391	Similar to the key import, the import of a key can be done in
392	several ways. First, let's assume you got a mail with an OpenPGP
393	key included as inline text. Then you can use the current window
394	feature and "Decrypt/Verify" to import the key. Alternative you
395	also may use the clipboard. To achieve this, you first need to
396	select the entire key (CTRL+A) and then copy it to the clipboard
397	(CTRL+C), then use the Key Manager (Edit->Paste) to import it.
398	If the key is stored as an attachment, or you want to import
399	a key from a file in general, just drag the file and drop it
400	into the Key Manager window or use "Key" -> "Import...".
401
402	@subsection Sign a Public Key
403	If you verified that a key really belongs to its owner, you
404	should sign the key to integrate it into your Web of Trust
405	and also to mark the key as valid in your keyring. Do not sign
406	a key you just got via email with the request to sign it. Anybody
407	can create a key with your (or better ANY) name, these information
408	are no hint to whom the key really belongs. You can check a key
409	by meeting or calling the key owner and verify the key fingerprint
410	of the key with the one published by the key owner. Additional checks
411	should be to watch at his driver license or the identity card to make
412	sure that name of the key matches the name of the key owner. After
413	this procedure is done, you can open the Key Manager, select the
414	right key and either use the context menu "Sign Key" or use the
415	toolbar button.
416
417	The next dialog will summarize the key information and some
418	additional options. For example if the signature should be
419	local or exportable. Local means the signature will be stripped
420	if you export the key and no one else except you can use it to
421	calculate the validity. If you mark the signature exportable,
422	any other user can see and use it. Now you can select the key
423	you want to use to sign and enter the passphrase. Confirm with "OK"
424	and the key will be signed. Now the validity of the new key is
425	"Full". It is propably a good idea to set the ownertrust of the
426	key. For a detailled description, see the chapter "Key Ownertrust".
427
428	@subsection Key Ownertrust
429	First we should explain what the ownertrust of a key is. The ownertrust
430	is a measurement how much you trust somebody to certify and check keys
431	of other people. For example, if you know that Bob is really the owner
432	of the key, you should sign it. But he is also known to sign other keys
433	without checking the idenity of the other key owner. Values for the
434	ownertrust are 1) Don't Know 2) Don't Trust 3) Marginal 4) Full
435	and thus you should propably use an ownertrust value like "Marginal".
436	But this is a personal decision and stored in a separate file and
437	never exported with the public keys. For further information, please
438	take a look into the GNU Privacy Handbook.
439	Just a last work on Key Pairs, they are automatically marked as
440	"Ultimate" because the key belongs to you and you trust it implicit.
441
442	@bye