trunk/doc/winpt.texi

\input texinfo

@setfilename WinPT

This file describes the Windows Privacy Tray program and its main functions

This file is free under the terms of the GNU General Public License v2.

Copyright (C) 2006 Timo Schulz

Version 0.0.0

@settitle WinPT - The Windows Privacy Tray; a free GPG front-end for Windows

@section Requirements for WinPT

First you need to have a working GnuPG 1.4 installtion on the machine you
plan to install WinPT. If you don't have GPG in your machine, please
visit http://www.gnupg.org and download the latest GPG version there.
It comes with a graphical installer so there is no need to do this
step manually.

You need at least Windows 98/2K/XP, but Windows XP or better is
recommend. The program also works on NT/95/ME but there is no support
for these OS versions any longer.

@section A short Introduction
WinPT is a graphical GnuPG front-end which resides in the task bar.
It is divided into several, so-called, managers. There is a manager
for the keyring, for files and for smart cards. The aim of the program
is to secure email communication and to perform file encryption.

@subsection What is GnuPG
GnuPG is a tool for secure communication and data storage.
It can be used to encrypt data and to create digital signatures.
It includes an advanced key management facility and is compliant
with the proposed Internet standard as described in RFC2440.

@subsection The Web of Trust
For a detailled description of these and other GnuPG topics, I
recommend the available literature at http://www.gnupg.org. But
at least a general overview should be given here.

The certification scheme of OpenPGP does not base on a hirachical
approach. Instead it uses a combination of ownertrust and direct
key certification. Here is an example with Alice, Bob, Carol and Dave.

Alice knows Bob and checked the fingerprint of Bob's key when he
met him personally. Thus she knows that the key really belongs to
its owner and he trusts Bob to certify other keys. Then she issued
a signature on Bob's key. Bob knows Carol and also checked her identity.
Then he signed her key. Alice does not know Carol, but he knows Bob
and Bob trusts Carol. And because Alice trusts Bob, at a level she
decided before, he also trusts Carol. It's a transitiv relation.
Dave is isolated and does not know anybody from the mentioned persons,
thus he is not in the WoT.
Another very important point is, that the signer can decide,
after the certification, how much he trusts the key owner to
certify other keys.

It is very important to check the identify of a key owner. Mostly
this is done by comparing the fingerprint, which were submitted
by phone or written down at a personal meeting, with the fingerprint
of the key in the keyring. Please bear in mind that anybody can create
a key with an email address and a specific name. Thus it is not
recommend to sign keys without doing this check before!

The fingerprint of the key is hexadecial (160-bit) sequence divided
into 10 groups of 4 hex digits. You can get the fingerprint of a key
by opening the key property dialog. There you can mark the fingerprint
and copy it to the clipboard.

Example: 1D75 8108 5BC9 D9FB E78B  2078 ED46 81C9 BF3D F9B4

@section Installation of the Program

It is always recommend to use the latest version of the program. You
can download it from http://wald.intevation.org/projects/winpt.
Download the zip file with the binaries inside and unpack them in
a folder. All files need to be in the same folder, so if you change
the folder don't forget to move all files.
You should also download and verify the signature of the packet to 
make sure that the release is really authentic.

To activate the program you just need to start WinPT.exe. You should
now see a little (golden key) icon in the taskbar which indicates that 
the program is running. If you want to quit the program, right click
on the symbol and select "Exit".

Alternative, you may use one of the graphical GPG installers which
are available on the internet. I recommend to use Gpg4Win which
includes a set of very useful privacy tools, beside WinPT and it
is very easy to use with an average size (~4MB). For non-German
speaking users, I recommend the light version because it does not
contain the 2 German PDF manuals.

@subsection Configure the Program
After the installation not much of the default settings need to
be changed. If you prefer a special keyserver, it is propably a good 
idea to open the keyserver dialog and to set one of the existing 
keyservers as the default or create a new entry and mark it as the 
new default. The default keyserver is subkeys.pgp.net, which is
the best choice for most users.

@subsection GPG Options
For expert users, the GPG preference dialog might contain some
interesting options. For example to set the expiration date of
a signature and/or to set the signing level for key signing.
It also allows to set a default 'encrypt-to' key and to set
the comment in ASCII armored files.

@subsection Preferences
In the WinPT preference dialog, the user can modify and/or disable
the default options. For new users it is suggested to leave the
default values as they are, except when there are problems related
to the hotkeys.

To enable keyring backups, the user can either decide to use the
GPG home directory as the backup folder or any other folder. In
the latter case, a folder needs to be chosen.


@section The First Start
This section is only important for people who never installed
and/or used WinPT before.

When the program is started the first time, it offers two choices.
The one is to generate a key pair and the other is to copy
existing GPG keyrings into the current installation.

We assume the user will select the first entry.

Now a new dialog is shown which requests some information from
the user to allow a meaningful association between the key and
the user. If the user prefer RSA keys, the check box should be marked. 
If the entered data is OK, WinPT then generates a new key pair. As long
as this step takes, a progress dialog is shown to indicate the 
enduring process. When the generation of the keypair is done, WinPT 
offers the chance to backup the existing keyrings. This is definitely
an important decision because if the keyring will get corrupted
or lost, there is no way to recover the encrypted data. That is
why it is also important to store the backup, at least of the
secret keyring, at a @strong{safe} place.

@section Keyserver Access
An easy way to retrieve keys is the keyserver. You can think of
it like a huge database with a lot of keys as its content. It is 
possible to search keys by a pattern, a keyid or even a fingerprint.
WinPT allows to access different kind of keyservers. For example
LDAP, HKP, Finger and HTTP. But the focus will be set on HKP because
this is the common case.

In some situations WinPT asks the user whether to retrieve keys 
automatically. One example is the signature verification when the 
key that issued the signature was not found in the keyring.

The main keyserver dialog allows to fetch one or more keys directly
or to search for a given pattern.

@subsection Retrieve a key by Key ID
The best way to fetch a key from the server is by the key ID.
Just enter the key ID, it is always a good idea to prefix it
with 0x and click the "Receive" button.

An example:

pattern: 0xBF3DF9B4

[Receive]


@subsection Retrieve a key by its email address
If you only know the email address from your partner, you can
enter it instead of the key ID. It is unlikely but possible
that there are more keys with the same address. In this situation,
WinPT will warn you that multiple keys were imported. The difference
to the search function is, that the keys were dirctly fetched and
not displayed as a key result list.


An example:

pattern: name_of_friend@@gmx.net

[Receive]


@subsection Search for a key by pattern
If you want to communicate with a new mail partner and you are
not sure about the key ID, it can be useful to search for his
email address. This address is considered as quite unique.

An example:

pattern: winpt@@windows-privacy-tray.com

[Search]

Now a dialog is opened with a list of all keys which matched
the search string. If the name @strong{and} the email address
is known, the matching key should be selected and "Receive"
should be clicked. Then the key will be downloaded and added
to your keyring. Now you can encrypt data with this key, for
example an email.

@subsection Sending a Key to the Keyserver
After you generated a new key pair, it is a good idea to send your
key to the keyserver to make it available for other users. If you
issue a signature, the key ID is part of the signature and people can 
automatically retrieve your key when they try to verify the signature.

Actually, the action is performed in the Key Manager and not in the
keyserver dialog. Just open the Key Manager, select the key you want
to send right-click on it and chose "Send to Keyserver" in the popup
menu. Then a message box with the result is shown.

@subsection Add, Delete or Edit a Keyserver Entry
The keyserver dialog allow to change the existing keyserver entries,
to delete them or to add new entries. Just right click on a selected
item and a popup menu will be shown with ("Edit", "Remove" and "New").

@section Using the Clipboard
A major aim from the first day was, that the program does not
depend on a special mailer client. For this reason it uses the
clipboard to encrypt and/or sign data.
For the examples, let's assume that you want to write a new
mail or that you received a mail protected by GnuPG.

@subsection Encrypt Data in the Clipboard
Just copy the text from the mailer window into the clipboard.
This is usually done by CTRL+C, make sure you really selected
all portions of the text. Then right-click on the tray icon
and select Clipboard->Encryption. Now a dialog is shown to
select the recipients. This means you need to select all
keys which should be able to decrypt the mail. Confirm with "OK".
GnuPG now encrypts the data with the selected recipients. At the
end a message box with the result is shown. Now the clipboard should 
contain the encrypted data. Just paste it into the mailer window.
The output should contain a header and a footer
"BEGIN PGP MESSAGE" and "END PGP MESSAGE.

@subsection Decrypt/Verify Data from the Clipboard

@subsection Sign the Clipboard

@section The Key Manager
This part of the program is propably most important for many users.
It contains function to manage your keyring and to perform actions
which are required and/or useful in the OpenPGP environment.

@subsection Tips

@itemize @bullet

@item
If you want to import quickly a key from a into the keyring, just
drag and drop the file into the Key Manager window. Then the import
procedure will be automatically started.

@item
Key which were fetched from keyservers often contain a lot of,
maybe obsolete, self signatures, if you want to get rid of them
you can use the Key Edit->Clean feature. Just start the edit
dialog and select the clean command. That's it.

@item
The keyserver dialog does not allow to import a key directly
via an URL, as an alternative you may use the "Import HTTP..."
feature in the Key Manager. With it you can directly fetch keys
from the web (Example: http://www.users.my-isp.de/~joe/gpg-keys.asc).

@item
To customize the parameters of the generated key, you can use
the expert key generation. It allows you to set the public key
algorithm and/or the size of the key directly.

@end itemize

@subsection Adding a new secondary key

For most users the existing keys in the key pair are enough
and no extra key is needed. But there are some exceptions.

@itemize @bullet

@item
The primary key has no secondary key and the primary key is not
able to encrypt data. In this case it can be a good idea to
add a secondary encryption key.

@item
A lot of people use secondary encryption keys with an expiration
date. Usually the key is valid for 1-2 years. After the key is expired,
a new key is needed in order to encrypt data.

@end itemize

What kind of public key algorithm should be selected is a matter
of taste. RSA and ElGamal are both capable for encryption. For most
users it's a good idea to let the program chose the key size (in bits).
The default settings should be secure enough for most purposes.

@subsection Adding a new user ID
If you got a new email account, it's propably a good idea to
add these new account to your key also. For example:

A new account was registed at gmail.com (john.doo@@gmail.com).
Then you should create a new user ID with the following fields:

name: John Doo

email: john.doo@@gmail.com

comment: (optional)

Now email programs are able to associate this address with your
key when somebody wants to send you a protected mail to this account.

@subsection Adding a photographic ID
With this function you can add a photo to your public. It will be
displayed in the key property dialog.

You just need to select a JPEG file which contains the photo and
enter your passphrase and confirm with OK. Please read the note
in the dialog carefully to make sure the photo has a proper size
(file, height and weight).

@subsection Adding a new designated revoker
If you want to allow another key to revoke your own key, this
might be useful if you lost your secret or a simliar situation,
you can use this function to add a designated revoker to your key.

All you need to do is to select the key you want to add as a desig
revoker. But please bear in mind that this procedure cannot be undone
and that this person really has the power to make your public key
unuseable. You really should trust the selected key, in case it is
not a key owned by yourself.

@bye
1	twoaday	222	\input texinfo
2
3			@setfilename WinPT
4
5			This file describes the Windows Privacy Tray program and its main functions
6
7			This file is free under the terms of the GNU General Public License v2.
8
9			Copyright (C) 2006 Timo Schulz
10
11			Version 0.0.0
12
13			@settitle WinPT - The Windows Privacy Tray; a free GPG front-end for Windows
14
15			@section Requirements for WinPT
16
17			First you need to have a working GnuPG 1.4 installtion on the machine you
18			plan to install WinPT. If you don't have GPG in your machine, please
19			visit http://www.gnupg.org and download the latest GPG version there.
20			It comes with a graphical installer so there is no need to do this
21			step manually.
22
23			You need at least Windows 98/2K/XP, but Windows XP or better is
24			recommend. The program also works on NT/95/ME but there is no support
25			for these OS versions any longer.
26
27	twoaday	224	@section A short Introduction
28			WinPT is a graphical GnuPG front-end which resides in the task bar.
29			It is divided into several, so-called, managers. There is a manager
30			for the keyring, for files and for smart cards. The aim of the program
31			is to secure email communication and to perform file encryption.
32	twoaday	222
33	twoaday	224	@subsection What is GnuPG
34			GnuPG is a tool for secure communication and data storage.
35			It can be used to encrypt data and to create digital signatures.
36			It includes an advanced key management facility and is compliant
37			with the proposed Internet standard as described in RFC2440.
38
39			@subsection The Web of Trust
40			For a detailled description of these and other GnuPG topics, I
41			recommend the available literature at http://www.gnupg.org. But
42			at least a general overview should be given here.
43
44			The certification scheme of OpenPGP does not base on a hirachical
45			approach. Instead it uses a combination of ownertrust and direct
46			key certification. Here is an example with Alice, Bob, Carol and Dave.
47
48			Alice knows Bob and checked the fingerprint of Bob's key when he
49			met him personally. Thus she knows that the key really belongs to
50			its owner and he trusts Bob to certify other keys. Then she issued
51			a signature on Bob's key. Bob knows Carol and also checked her identity.
52			Then he signed her key. Alice does not know Carol, but he knows Bob
53			and Bob trusts Carol. And because Alice trusts Bob, at a level she
54			decided before, he also trusts Carol. It's a transitiv relation.
55			Dave is isolated and does not know anybody from the mentioned persons,
56			thus he is not in the WoT.
57			Another very important point is, that the signer can decide,
58			after the certification, how much he trusts the key owner to
59			certify other keys.
60
61			It is very important to check the identify of a key owner. Mostly
62			this is done by comparing the fingerprint, which were submitted
63			by phone or written down at a personal meeting, with the fingerprint
64			of the key in the keyring. Please bear in mind that anybody can create
65			a key with an email address and a specific name. Thus it is not
66			recommend to sign keys without doing this check before!
67
68			The fingerprint of the key is hexadecial (160-bit) sequence divided
69			into 10 groups of 4 hex digits. You can get the fingerprint of a key
70			by opening the key property dialog. There you can mark the fingerprint
71			and copy it to the clipboard.
72
73			Example: 1D75 8108 5BC9 D9FB E78B 2078 ED46 81C9 BF3D F9B4
74
75	twoaday	222	@section Installation of the Program
76
77			It is always recommend to use the latest version of the program. You
78			can download it from http://wald.intevation.org/projects/winpt.
79			Download the zip file with the binaries inside and unpack them in
80			a folder. All files need to be in the same folder, so if you change
81			the folder don't forget to move all files.
82	twoaday	224	You should also download and verify the signature of the packet to
83			make sure that the release is really authentic.
84	twoaday	222
85			To activate the program you just need to start WinPT.exe. You should
86			now see a little (golden key) icon in the taskbar which indicates that
87			the program is running. If you want to quit the program, right click
88			on the symbol and select "Exit".
89
90			Alternative, you may use one of the graphical GPG installers which
91			are available on the internet. I recommend to use Gpg4Win which
92			includes a set of very useful privacy tools, beside WinPT and it
93			is very easy to use with an average size (~4MB). For non-German
94			speaking users, I recommend the light version because it does not
95			contain the 2 German PDF manuals.
96
97			@subsection Configure the Program
98			After the installation not much of the default settings need to
99			be changed. If you prefer a special keyserver, it is propably a good
100			idea to open the keyserver dialog and to set one of the existing
101			keyservers as the default or create a new entry and mark it as the
102			new default. The default keyserver is subkeys.pgp.net, which is
103			the best choice for most users.
104
105			@subsection GPG Options
106			For expert users, the GPG preference dialog might contain some
107			interesting options. For example to set the expiration date of
108			a signature and/or to set the signing level for key signing.
109			It also allows to set a default 'encrypt-to' key and to set
110			the comment in ASCII armored files.
111
112			@subsection Preferences
113			In the WinPT preference dialog, the user can modify and/or disable
114			the default options. For new users it is suggested to leave the
115			default values as they are, except when there are problems related
116			to the hotkeys.
117
118			To enable keyring backups, the user can either decide to use the
119			GPG home directory as the backup folder or any other folder. In
120	twoaday	224	the latter case, a folder needs to be chosen.
121	twoaday	222
122
123			@section The First Start
124			This section is only important for people who never installed
125			and/or used WinPT before.
126
127			When the program is started the first time, it offers two choices.
128			The one is to generate a key pair and the other is to copy
129			existing GPG keyrings into the current installation.
130
131			We assume the user will select the first entry.
132
133			Now a new dialog is shown which requests some information from
134			the user to allow a meaningful association between the key and
135			the user. If the user prefer RSA keys, the check box should be marked.
136			If the entered data is OK, WinPT then generates a new key pair. As long
137			as this step takes, a progress dialog is shown to indicate the
138			enduring process. When the generation of the keypair is done, WinPT
139			offers the chance to backup the existing keyrings. This is definitely
140			an important decision because if the keyring will get corrupted
141			or lost, there is no way to recover the encrypted data. That is
142			why it is also important to store the backup, at least of the
143			secret keyring, at a @strong{safe} place.
144
145			@section Keyserver Access
146			An easy way to retrieve keys is the keyserver. You can think of
147			it like a huge database with a lot of keys as its content. It is
148			possible to search keys by a pattern, a keyid or even a fingerprint.
149			WinPT allows to access different kind of keyservers. For example
150			LDAP, HKP, Finger and HTTP. But the focus will be set on HKP because
151			this is the common case.
152
153			In some situations WinPT asks the user whether to retrieve keys
154			automatically. One example is the signature verification when the
155			key that issued the signature was not found in the keyring.
156
157			The main keyserver dialog allows to fetch one or more keys directly
158			or to search for a given pattern.
159
160			@subsection Retrieve a key by Key ID
161	twoaday	224	The best way to fetch a key from the server is by the key ID.
162			Just enter the key ID, it is always a good idea to prefix it
163			with 0x and click the "Receive" button.
164	twoaday	222
165	twoaday	224	An example:
166
167			pattern: 0xBF3DF9B4
168
169			[Receive]
170
171
172	twoaday	222	@subsection Retrieve a key by its email address
173	twoaday	224	If you only know the email address from your partner, you can
174			enter it instead of the key ID. It is unlikely but possible
175			that there are more keys with the same address. In this situation,
176			WinPT will warn you that multiple keys were imported. The difference
177			to the search function is, that the keys were dirctly fetched and
178			not displayed as a key result list.
179	twoaday	222
180	twoaday	224
181			An example:
182
183			pattern: name_of_friend@@gmx.net
184
185			[Receive]
186
187
188	twoaday	222	@subsection Search for a key by pattern
189			If you want to communicate with a new mail partner and you are
190			not sure about the key ID, it can be useful to search for his
191			email address. This address is considered as quite unique.
192
193			An example:
194
195	twoaday	224	pattern: winpt@@windows-privacy-tray.com
196	twoaday	222
197			[Search]
198
199			Now a dialog is opened with a list of all keys which matched
200			the search string. If the name @strong{and} the email address
201			is known, the matching key should be selected and "Receive"
202			should be clicked. Then the key will be downloaded and added
203			to your keyring. Now you can encrypt data with this key, for
204			example an email.
205
206	twoaday	224	@subsection Sending a Key to the Keyserver
207			After you generated a new key pair, it is a good idea to send your
208			key to the keyserver to make it available for other users. If you
209			issue a signature, the key ID is part of the signature and people can
210			automatically retrieve your key when they try to verify the signature.
211	twoaday	222
212	twoaday	224	Actually, the action is performed in the Key Manager and not in the
213			keyserver dialog. Just open the Key Manager, select the key you want
214			to send right-click on it and chose "Send to Keyserver" in the popup
215			menu. Then a message box with the result is shown.
216
217			@subsection Add, Delete or Edit a Keyserver Entry
218			The keyserver dialog allow to change the existing keyserver entries,
219			to delete them or to add new entries. Just right click on a selected
220			item and a popup menu will be shown with ("Edit", "Remove" and "New").
221
222			@section Using the Clipboard
223			A major aim from the first day was, that the program does not
224			depend on a special mailer client. For this reason it uses the
225			clipboard to encrypt and/or sign data.
226			For the examples, let's assume that you want to write a new
227			mail or that you received a mail protected by GnuPG.
228
229			@subsection Encrypt Data in the Clipboard
230			Just copy the text from the mailer window into the clipboard.
231			This is usually done by CTRL+C, make sure you really selected
232			all portions of the text. Then right-click on the tray icon
233			and select Clipboard->Encryption. Now a dialog is shown to
234			select the recipients. This means you need to select all
235			keys which should be able to decrypt the mail. Confirm with "OK".
236			GnuPG now encrypts the data with the selected recipients. At the
237			end a message box with the result is shown. Now the clipboard should
238			contain the encrypted data. Just paste it into the mailer window.
239			The output should contain a header and a footer
240			"BEGIN PGP MESSAGE" and "END PGP MESSAGE.
241
242			@subsection Decrypt/Verify Data from the Clipboard
243
244			@subsection Sign the Clipboard
245
246			@section The Key Manager
247			This part of the program is propably most important for many users.
248			It contains function to manage your keyring and to perform actions
249			which are required and/or useful in the OpenPGP environment.
250
251			@subsection Tips
252
253			@itemize @bullet
254
255			@item
256			If you want to import quickly a key from a into the keyring, just
257			drag and drop the file into the Key Manager window. Then the import
258			procedure will be automatically started.
259
260			@item
261			Key which were fetched from keyservers often contain a lot of,
262			maybe obsolete, self signatures, if you want to get rid of them
263			you can use the Key Edit->Clean feature. Just start the edit
264			dialog and select the clean command. That's it.
265
266			@item
267			The keyserver dialog does not allow to import a key directly
268			via an URL, as an alternative you may use the "Import HTTP..."
269			feature in the Key Manager. With it you can directly fetch keys
270			from the web (Example: http://www.users.my-isp.de/~joe/gpg-keys.asc).
271
272			@item
273			To customize the parameters of the generated key, you can use
274			the expert key generation. It allows you to set the public key
275			algorithm and/or the size of the key directly.
276
277			@end itemize
278
279	twoaday	222	@subsection Adding a new secondary key
280
281			For most users the existing keys in the key pair are enough
282			and no extra key is needed. But there are some exceptions.
283
284			@itemize @bullet
285
286			@item
287			The primary key has no secondary key and the primary key is not
288			able to encrypt data. In this case it can be a good idea to
289			add a secondary encryption key.
290
291			@item
292			A lot of people use secondary encryption keys with an expiration
293			date. Usually the key is valid for 1-2 years. After the key is expired,
294			a new key is needed in order to encrypt data.
295
296			@end itemize
297
298			What kind of public key algorithm should be selected is a matter
299			of taste. RSA and ElGamal are both capable for encryption. For most
300			users it's a good idea to let the program chose the key size (in bits).
301			The default settings should be secure enough for most purposes.
302
303			@subsection Adding a new user ID
304			If you got a new email account, it's propably a good idea to
305			add these new account to your key also. For example:
306
307			A new account was registed at gmail.com (john.doo@@gmail.com).
308			Then you should create a new user ID with the following fields:
309
310			name: John Doo
311
312			email: john.doo@@gmail.com
313
314			comment: (optional)
315
316			Now email programs are able to associate this address with your
317			key when somebody wants to send you a protected mail to this account.
318
319			@subsection Adding a photographic ID
320			With this function you can add a photo to your public. It will be
321			displayed in the key property dialog.
322
323			You just need to select a JPEG file which contains the photo and
324			enter your passphrase and confirm with OK. Please read the note
325			in the dialog carefully to make sure the photo has a proper size
326			(file, height and weight).
327
328			@subsection Adding a new designated revoker
329			If you want to allow another key to revoke your own key, this
330			might be useful if you lost your secret or a simliar situation,
331			you can use this function to add a designated revoker to your key.
332
333			All you need to do is to select the key you want to add as a desig
334			revoker. But please bear in mind that this procedure cannot be undone
335			and that this person really has the power to make your public key
336			unuseable. You really should trust the selected key, in case it is
337			not a key owned by yourself.
338
339			@bye