GnuPG: Howto

Sumber: http://www.gnupg.org/documentation/howtos.en.html

Gnu Privacy Guard (GnuPG) Mini Howto (English)
Brenno J.S.A.A.F. de Winter (English) <brenno@dewinter.com>
Michael Fischer v. Mollard (German) <fischer@math.uni-goet­tingen.de>
Arjen Baart <arjen@andromeda.nl>
Version 0.1.4 August 10, 2004

Dokumen ini menjelaskan cara menggunakan GNU Privacy Guard (GnuPG), sebuah Sistem enkripsi Open Source OpenPGP yang kompatibel untuk menjaga agar program ini tetap aktif dan benar-benar bebas dari penggunaan algoritma RSA dan algoritma yang dipatenkan lainnya. Dokumen ini aslinya ditulis oleh Michael Fischer v. Mollar dalam bahasa Jerman. Teks telah diterjemahkan dan disesuaikan pada beberapa poin dan tidak dapat dianggap sebagai terjemahan one-to-one.

Konsep

Public Key Encryption

Metode klasik untuk enkripsi hanya menggunakan satu kunci untuk enkripsi. Pengirim mengenkripsi pesan dengan kunci tersebut. Untuk bisa mendekripsi pesan yang dikirim penerima harus memiliki kunci yang sama. Kunci ini harus bisa dikirimkan kepada penerima dengan berbagai cara, yang orang lain tidak bisa memiliki untuk mendapatkan kunci tersebut. Jika orang lain memiliki kunci tersebut, metode enkripsi ini menjadi tidak berguna.

Penggunaan Kunci Publik dapat memecahkan masalah ini. Kunci publik Adalah konsep dimana dua kunci dilibatkan. Salah satu kunci adalah Public Key yang dapat disebarkan melalui segala jenis media dan dapat diperoleh oleh siapa saja. Kunci lainnya adalah Private Key. Kunci ini rahasia dan Tidak bisa menyebar Kunci ini hanya tersedia bagi pemiliknya. Ketika Sistem yang diimplementasikan dengan baik kunci rahasia tidak bisa diturunkan dari kunci publik. Sekarang pengirim akan mengunci pesan dengan kunci publik milik penerima. Kemudian dekripsi akan dilakukan dengan kunci rahasia penerima.

Yang penting dalam konsep ini adalah bahwa kunci rahasia tetap menjadi rahasia dan tidak boleh diberikan atau tersedia untuk orang lain selain pemilik kunci tersebut. ANDA TIDAK BISA MENGIRIM KUNCI INI DI INTERNET. Di samping itu, akan sangat tidak bijak untuk menggunakan GnuPG melalui telnet (Anda mungkin mempertimbangkan untuk tidak melakukannya menggunakan telnet berdasarkan resiko keamanan yang tinggi).

Tanda Tangan Digital / Digital Signatures

Untuk membuktikan bahwa sebuah pesan benar-benar dikirim oleh pengirim yang asli, maka konsep tanda tangan digital / digital signature diciptakan. Seperti namanya sebuah pesan ditandatangani secara digital oleh pengirim. Dengan menggunakan tanda tangan ini anda dapat memeriksa keaslian sebuah pesan. Menggunakan ini akan mengurangi risiko untuk kuda Trojan (pesan yang mengklaim sebagai patch ke sebuah masalah tertentu tapi sebenarnya mengandung virus atau melakukan sesuatu yang buruk dengan data di komputer anda). Informasi atau data juga bisa diverifikasi sebagai berasal dari sumber yang sah dan dengan demikian dianggap sebagai sesuatu yang benar.

Tanda tangan digital dibuat melalui kombinasi kunci rahasia dan teksnya. Menggunakan kunci publik pengirim pesan jadi bisa diverifikasi. Tidak hanya akan diperiksa apakah pengirim tersebut asli, isi pesan juga akan diperiksa. Jadi anda tahu bahwa pesan itu datang dari pengirim yang benar dan tdiak terjadi perubahan pesan selama proses pengiriman.

Web of trust

Titik lemah algoritma kunci publik adalah penyebaran kunci publik. Pengguna bisa membawa kunci publik dengan ID pengguna yang salah dalam sirkulasi. Jika dengan kunci tersebut pesan utama dibuat, penyusup bisa memecahkan kode dan membaca pesannya. Jika si penyusup meneruskan pesan tersebut pada saat itu masih dengan kunci publik asli dikodekan ke penerima sebenarnya, serangan ini tidak terlihat

Solusi PGP (dan karena itu secara otomatis solusi GnuPG) ada dalam code penandatangan. Kunci publik bisa ditandatangani oleh orang lain. Tanda tangan ini mengakui bahwa kunci yang digunakan oleh UID (User Identifikasi) sebenarnya milik orang yang diklaimnya. Selanjujtnya ini tergantung pada pengguna GnuPG seberapa jauh kepercayaan terhadap tanda tangan tersebut berjalan. Anda dapat mempertimbangkan kunci yang dapat dipercaya saat Anda mempercayai pengirim kunci dan anda tahu pasti bahwa kunci itu benar-benar milik orang itu. Hanya bila Anda dapat mempercayai kunci penandatangan, anda dapat mempercayai tanda tangan. Untuk menjadi benar-benar positif bahwa kuncinya adalah benar yang anda miliki untuk membandingkan funger print melalui saluran yang dapat diandalkan sebelum memberi Kepercayaan mutlak.

Boundaries to security

Jika anda memiliki data yang ingin dirahasiakan, anda harus berfikir lebih dari sekedar menentukan algoritma pengkodean yang akan digunakan. Anda harus memikirkan keamanan sistem anda secara umum. Pada dasarnya kita memikirkan agar PGP aman dan saat saya menulis dokumen ini tidak ada kejadian PGP yang berhasil di crack yang diketahui oleh saya. Tapi bukan berarti itu semua pengkodean akan aman saat itu (misalnya NSA tidak akan memberi tahu saya jika mereka entah bagaimana bisa memecahkan PGP, juga tidak ada orang lain yang akan memberitahukan juga mereka bisa bisa memecahkannya sehingga benar-benar berbahaya). Tetapi bahkan jika PGP sepenuhnya 'tidak dapat dihack', cara lain bisa digunakan untuk menyerang keamanan. Awal Februari 1999 sebuah Trojan telah ditemukan dan dia berusaha mencari kunci rahasia PGP di hard disk dan meng-FTP kan keluar. Jika password yang dipilih kurang baik, kunci rahasia akan sangat mudah di crack.

Kemungkinan teknis lainnya (walaupun lebih sulit) adalah sebuah Trojan yang membroadcast / mengirimkan entri keyboard. Mungkin juga (tapi sangat sulit) adalah untuk mengirimkan isi tampilan layar. Jika ini terjadi, maka tidak perlu meng-crack message yang di enkripsi. Untuk semua risiko ini ada kebutuhan untuk pemikiran yang matang dan baik untuk perencanaan keamanan yang akan digunakan.

Bukan bertujuan untuk menciptakan paranoia di antara orang-orang, tapi untuk menunjukkan bahwa banyak yang perlu dilakukan agar lebih aman. Yang paling penting adalah untuk menyadari bahwa enkripsi hanya satu langkah untuk keamanan dan bukan solusi total. Trojan saat mereka muncul di Melissa Virus pada bulan Maret 1999 membuktikan bahwa banyak perusahaan tidak siap untuk itu.

Installation

Sources for GnuPG

Official download site adalah: GnuPG Homepage <http://www.gnupg.org/download.html>. Pada situs tersebut kita dapat menemukan link untuk situs mirror.

Karena pembatasan hukum, tidak diperkenankan mendownload GnuPG dari server yang berbasis di Amerika Serikat. Amerika Serikat memberlakukan pembatasan ekspor pada ekspor perangkat lunak kriptografi. Inilah sebabnya mengapa PGP selalu tersedia Dalam versi internasional dan nasional (untuk Amerika Serikat). Untuk cersi internasional source code-nya telah diekspor dalam bentuk cetak Format sebagai buku. Di Eropa (Oslo) source code tersebut telah dipindai. Informasi lebih lanjur tentang hal itu dapat ditemukan di Situs Web PGP Internasional <Http://www.pgpi.com>. Versi internasional PGP bebas diimpor ke Amerika Serikat asalkan tidak reexported lagi.

Jika Anda sudah memiliki versi GnuPG atau PGP yang terinstal, Anda harus melakukannya Periksa tanda tangan file (lihat `"Signatures"').

Konfigurasi

Anda bisa mendapatkan GnuPG sebagai paket debian, paket RPM (Redhat Package Manager) atau dalam bentguk source code. GnuPG masuk dalam distribusi Fedora / Redhat Linux terbaru. Untuk memeriksa apakah Anda memiliki GnuPG diinstal pada sistem anda, gunakan:

rpm -q gnupg

atau

apt-get list gnupg
apt list gnupg

Paket tersebut dipasang sebagai file biner dengan tool yang dibutuhkan pada platform Linux. Bila anda membutuhkan GnuPG untuk platform lainnya, anda perlu mengkompilasi sendiri. Akan sangat dihargai, jika anda membuat metode instalasi alternatif untuk berbagai platform dan menyediakannya untuk masyarakat umum.

Karena pengembangan sebagian besar dilakukan di Linux (x86), porting ke sistem yang berbeda seharusnya tidak masalah. Daftar sistem operasi yang dikenal yang mendukung GnuPG ada di homepage GnuPG. Prosedur seperti yang dijelaskan di bawah ini pad dasarnya platform independen Prosedur ini bisa digunakan untuk menginstal GnuPG dari source code.

Buka file tar dengan perintah berikut, untuk source yang di kompres menggunakan gzip dapat menggunakan,

tar xvzf gnupg-?.?.?.tar.gz

dan untuk source yang dikompres menggunakan bzip2, dapat menggunakan,

tar xvjf gnupg-?.?.?.tar.bz2

Setelah di unpack, masuk ke directory yang berisi source code, dan ketik,

./configure

Biasanya tidak akan ada yang istimewa yang terjadi. Dengan perintah,

./configure --help

 you can view the available configuration settings for compilation. If
 problems occur that have to do with internationalization (gettext),
 you can include a version that is delivered with the source code by
 using the option --with-included-gettext or switch it of by using the
 --disable-NLS option.

Compile

 After this we want to compile the stuff by typing:

      make

 This should work without any problems. If any problems occur take the
 following steps (in the same order as described here): First try to
 solve this yourself (of course also by using the available documenta­
 tion).  Then make sure that your problem is not a known bug (check the
 BUGS file on http://www.gnupg.org).  Then ask someone you know. If
 these steps do not solve your problem post a question to the GnuPG-
 mailing list (see ``Informationsources). If the problem is path
 related, you should try make clean, then run configure again and retry
 to compile. If that doesn't work it is time to panic.

Installation

Ketik

make install

 to actually copy the program and the man-pages into the installation
 directory.  If you didn't change the installation directory when you
 did ./configure the usr/local/share/gnupg/ will be the installation
 directory. You can find this directory in the file options.skel. When
 you change this options.skel. If you copy this to ~/.gnupg/options the
 appropriate adjustments will be used as standard. Copying should occur
 automatically when creating ~/.gnupg/. All possible options are well
 documented and explaining them here would not be useful.

 You can run GnuPG as suid root. So the program runs with all the
 rights the superuser has. By doing this you exclude the possibility
 that certain parts of the program are stored externally and then could
 be read by anyone. It is not feasible for me to judge on the value of
 this risk. But running the program as suid root one should be alert to
 the danger of Trojan horses. Since a Trojan horse running as superuser
 can damage an entire system. If for this reason (or any other reason)
 you choose not run GnuPG as root you can switch off the warning by
 setting no-secmem-warning in ~/.gnupg/options.

Using keys

Creating a key

With

gpg --gen-key

 a new key-pair is created (key pair: secret and public key).  The
 first question is which algorithm can be used. You can read more about
 algorithms in PGP DH vs. RSA FAQ <http://www.samsimpson.com/cryptogra­
 phy/pgp/pgpfaq.html> or in ``Applied Cryptography.  You can easily
 (and maybe you should - since it is used so widely) use DSA/ ElGamal.
 This is not patented.

 The next question is key length. This is something that is very user
 dependent.  You need to choose between security and calculating time.
 If a key is longer the risk for cracking the message when intercepted
 decreases.  But with a larger key calculation time also increases.  If
 computing time is an issue you still should consider that you want to
 use the key for sometime.  We all know that arithmetic performance
 increases very quickly, since new processors are getting quicker and
 quicker.  So keep this in mind. The minimal key length GnuPG demands
 is 768 bits.  However some people say you should have at a key-size of
 2048 bits (which is also really a maximum with GnuPG at this moment).
 For DSA 1024 is a standard size. When security is a top priority and
 performance is less an issue you ought to pick the largest key-size
 available.

 The system now asks to enter names, comment and e-mail address. Based
 upon the entries here the code is calculated. You can change these
 settings later. See ``Administering keypairs.

 Finally you have to enter a password (actually passphrase would be
 more appropriate, since blanks are allowed). This password is used to
 be able to use the functionality which belongs to your secret key. A
 good passphrase contains the following elements:

 ·  it is long,

 ·  it has special (non alphanumeric) characters,

 ·  it is something special (not a name),

 ·  it is very hard to guess (so NOT names, birth dates, phone numbers,
    number of a credit card/checking account, names and number of
    children, ...)

    By sometimes using CaPItaLs aNd SOMEtimes NoT you can build in
    further security.  When you make your password make sure that you
    WILL NOT FORGET it.  Since if you do messages are not legible and
    the use of your secret key has gone.  It might be wise to generate
    some kind of a certificate containing this information (of course
    be careful that nobody gets to your passphrase). See ``Revoke.

 After everything was entered the systems starts generating the keys.
 This will take some time.  During that time it needs to collect a lot
 of random data.  By working in a different screen you can help the
 system collecting changing random data. As you understand by now, the
 key will be always different.  If you generate a key now and 5 minutes
 later with exactly the same data, you'll get two different keys. Now
 you must understand why you shouldn't forget your password.

Exporting keys

The command for exporting a key for a user is:

gpg --export [UID]

 If no UID has been submitted all present keys will be exported. By
 default the output is set to stdout. But with the -o option this is
 sent to a file. It may be advisable using the option -a to write the
 key to a 7-bit ASCII file instead of a binary file.

 By exporting public keys you can broaden your horizon. Others can
 start contacting you securely. This can be done by publishing it on
 your homepage, by finger, through a key server like
 http://www.pca.dfn.de/dfnpca/pgpkserv/ or any other method you can
 think of.

Importing keys

 When you received someone's public key (or several public keys) you
 have to add them to your key database in order to be able to use them.
 To import into the database the command looks like this:

gpg --import [Filename]

 if the filename is omitted the data will be read from stdin.

Revoke a key

 For several reasons you may want to revoke an existing key. For
 instance: the secret key has been stolen or became available to the
 wrong people, the UID has been changed, the key is not large enough
 anymore, etc.  In all these cases the command to revoke the key is:

gpg --gen-revoke

 This creates a revocation certificate.  _�T_�o _�b_�e _�a_�b_�l_�e _�t_�o _�d_�o _�t_�h_�i_�s_�, _�y_�o_�u
 _�n_�e_�e_�d _�a _�s_�e_�c_�r_�e_�t _�k_�e_�y, else anyone could revoke your certificate. This has
 one disadvantage.  If I do not know the passphrase the key has become
 useless.  But I cannot revoke the key! To overcome this problem it is
 wise to create a revoke license when you create a key pair. And if you
 do so, keep it safe!  This can be on disk, paper, etc.  Make sure that
 this certificate will not fall into wrong hands!!!!  If you don't
 someone else can issue the revoke certificate for your key and make it
 useless.

Key administration

 With the GnuPG system comes a file that acts as some kind of database.
 In this file all data regarding keys with the information that comes
 with the keys is stored (everything until the Ownertrust values: for
 more information on that read ``Key signing).  With

gpg --list-keys

 all present keys will be displayed. To see the signatures as well
 type:

       gpg --list-sigs

 (see ``Key signing for further information).  To see the finger­
 prints type:

      gpg --fingerprint

 You want to see "Fingerprints" to ensure that somebody is really the
 person they claim (like in a telephone call). This command will result
 in a list of relatively small numbers.

 To list the secret keys you type:

      gpg --list-secret-keys

 Note that listing fingerprints and signatures from private keys has no
 use what soever.

 In order to delete a public key you type:

      gpg --delete-key UID

 For deleting a secrete key you type:

       gpg --delete-secret-key

 There is one more important command that is relevant for working with
 keys.

      gpg --edit-key UID

 Using this you can edit (among other things) the expiration date, add
 a fingerprint and sing your key. Although it is too logic to mention.
 For this you need your passphrase. When entering this you will see a
 command line.

Key signing

 As mentioned before in the introduction there is one major Achilles'
 heel in the system. This is the authenticity of public keys.  If you
 have a wrong public key you can say bye bye to the value of your
 encryption.  To overcome such risks there is a possibility of signing
 keys.  In that case you place your signature over the key, so that you
 are absolutely positive that this key is valid.  This leads to the
 situation where the signature acknowledges that the user ID mentioned
 in the key is actually the owner of that key. With that reassurance
 you can start encrypting.

 Using the  gpg --edit-key UID command for the key that needs to be
 signed you can sign it with the sign command.

 _�Y_�o_�u _�s_�h_�o_�u_�l_�d _�o_�n_�l_�y _�s_�i_�g_�n _�a _�k_�e_�y _�a_�s _�b_�e_�i_�n_�g _�a_�u_�t_�h_�e_�n_�t_�i_�c _�w_�h_�e_�n _�y_�o_�u _�a_�r_�e _�A_�B_�S_�O_�L_�U_�T_�E_�L_�Y
 _�S_�U_�R_�E _�t_�h_�a_�t _�t_�h_�e _�k_�e_�y _�i_�s _�r_�e_�a_�l_�l_�y _�a_�u_�t_�h_�e_�n_�t_�i_�c_�!_�!_�!.  So if you are positive you
 got the key yourself (like on a key signing party) or you got the key
 through other means and checked it (for instance by phone) using the
 fingerprint-mechanism. You should never sign a key based on any
 assumption.

 Based on the available signatures and "ownertrusts" GnuPG determines
 the validity of keys. Ownertrust is a value that the owner of a key
 uses to determine the level of trust for a certain key. The values are

 ·  1 = Don't know

 ·  2 = I do NOT trust

 ·  3 = I trust marginally

 ·  4 = I trust fully

    If the user does not trust a signature it can say so and thus
    disregard the signature. Trust information is not stored in the
    same file as the keys, but in a separate file.

Encrypt and decrypt

Setelah menginstal semuanya dan mengkonfigurasi segala sesuatunya seperti yang kita kehendaki, kita bisa mulai mengenkripsi dan mendekripsi.

Saat mengenkripsi atau mendekripsi tersebut dimungkinkan untuk memiliki lebih dari satu kunci pribadi yang digunakan Jika ini terjadi anda harus memilih tombol aktif. Hal ini bisa dilakukan dengan menggunakan opsi -u UID atau dengan menggunakan pilihan --local-user UID. Hal ini menyebabkan kunci default digunakan untuk diganti dengan kunci yang diinginkan

Jika ingin mengganti penerima, hal tersebut bisa dilakukan dengan pilihan -r atau dengan opsi --recipient.

Encrypt

Perintah untuk mengenkripsi adalah,

gpg -e Recipient [Data]

atau

gpg --encrypt Recipient [Data]

 To avoid the risk that somebody else claims to be you, it is very use­
 ful to sign everything you encrypt, see ``signatures.

Decrypt

The command for decrypting is:

gpg [-d] [Data]

or

gpg [--decrypt] [Data]

 Also here stdout is preset, but with the -o option you can redirect
 the output to a file.

Signing and checking signatures=

To sign data with your own key, use the command:

gpg -s (or --sign) [Data]

 By doing this also compression takes place. This means that the result
 is not legible. If you want a legible result you can use:

      gpg --clearsign [Data]

 this will make sure that the results are clearly legible. Furthermore
 it does the same (signing data).

 With

      gpg -b (or --detach-sign) [Data]

 you can write the signature in a separate file. It is highly recom­
 mended to use this option especially when signing binary files (like
 archives for instance).  Also the --armor option can be extremely use­
 ful here.

 Quite often you find that data is encrypted and signed as well. The
 full instruction looks like:

      gpg [-u Sender] [-r Recipient] [--armor] --sign --encrypt [Data]

 The functionality of the options -u (--local-user) and -r
 (--recipient) are as described before.

 When encrypted data has been signed as well, the signature is checked
 when the data is decrypted. You can check the signature of signed data
 by using the command:

      gpg [--verify] [Data]

 This will only work (of course) when you own the public key of the
 sender.

Front ends

Untuk membuat hidup lebih mudah dalam menggunakan GnuPG, Anda memiliki banyak pilihan program yang menggunakan atau mendukung enkripsi GnuPG. Ada beberapa Front End Grafis yang membantu administrasi kunci anda di klik tombol mouse dan banyak MUA (Mail User Agent) memungkinkan anda mengenkripsi dan tanda tangani pesan email anda secara mulus. Daftar yang hampir lengkap dari Front End yang tersedia dari halaman GnuPG Frontends. Kami akan menyoroti beberapa dari aplikasi tersebut di bagian ini.

Graphical interfaces

GPA

GPA, GNU Privacy Assistant adalah antarmuka pengguna grafis untuk GNU Privacy Guard (GnuPG). Ini adalah front end grafis standar, disediakan oleh proyek GnuPG. Dengan GPA, Anda dapat melihat keyring anda, impor dan ekspor kunci, menghasilkan kunci, mengedit properti utama dan mengenkripsi, menandatangani atau mendekripsi dokumen. Memasang GPS mudah. Download file tar, ekstrak dan lakukan,

./configure; make; make install.

Jalankan program dengan

gpa

Seahorse

 Seahorse is a GNOME front-end for GnuPG.  It can be used for sign,
 encrypt, verify and decrypt text and files.  The text can be taken
 from the clipboard, or written directly in the little editor it has.
 Seahorse is also a key manager, which can be used to edit almost all
 the properties of the keys stored in your key rings.  You can install
 Seahorse from a Debian package (RPMs are not available at this time)
 or from the source tarball.  Installing from source is like any other
 package. Download, untar, configure and make install.  The
 installation puts seahorse in /usr/local and puts a menu item in the
 Gnome 'Applications' menu.

Geheimnis

 KGPG is a front end for GnuPG which is based upon KDE.  KGPG supports
 key signing, importing and exporting. It can also work with other KDE
 tools interactively like konquerer.

Email programs

 Most popular Email programs (or MUAs) support GnuPG. Among these are
 at least the following:

 ·  Mozilla

 ·  Evolution

 ·  Pine

 ·  Kmail

 ·  Eudora

 ·  Mutt

 ·  exmh

 There are probably more; it is hardly possible to try them all.

 Using GnuPG support in your mail program lets you decrypt Email
 messages sent to you that are encrypted with your public key, sign
 your messages so the receiving party can make sure you are the author
 and encrypt your Email with the public keys of your recipients.

===Mozilla and Enigmail===

 Mozilla does not have GnuPG support in itself. To use GnuPG encryption
 with Mozilla, you must install a plug-in, such as EnigMail.  Enigmail
 is a "plugin" for Mozilla/Netscape Mail which allows users to access
 the authentication and encryption features provided by the popular GPG
 and PGP software.  Enigmail can encrypt/sign mail when sending, and
 also decrypt/authenticate received mail. It can also import/export
 public keys.

 Enigmail can easily be installed by Mozilla extension management. The
 only thing you should do is to click on the proper link related with
 your Mozilla version on the Download page.  Unfortunately, RPMs for
 enigmail are not available.

Evolution

 Evolution is a well-known MUA for Linux and has fairly good GnuPG
 support. It can get e-mails encrypted and decrypt them. It also has
 built in key signing and key authorising options. It supports S/MIME
 but inline pgp support (which is not standard but used by some MUAs)
 is not implemented.  To configure the GnuPG settings you should check
 the mail account preferences.

Kmail

 Kmail, the standard Email program for KDE has integrated support for
 GnuPG and PGP encryption.  To set things up so you can sign and
 decrypt messages, you have to enter your GnuPG user ID in the
 'Identity' section of the Kmail configuration.  When you send a new
 message, the message will not be signed or encrypted by default. You
 have to check the 'Sign message' and 'Encrypt message' buttons in the
 tool bar.

Sources of information

GnuPG

 ·  The GnuPG Homepage <http://www.gnupg.org>

 ·  The GnuPG Mailing list, including archives and descriptions on the
    GnuPG Homepage.

 ·  The information enclosed in the GnuPG project (updated until
    version 0.9.2), however not yet very extensively done. And not to
    forget:

      gpg --help

 . This is very valuable information.

PGP

 PGP is the older and (still) widely spread and used cryptography
 program.  Through the years a lot of documents have been made.  This
 can be considered as very useful information.  A lot of that
 information is so general that you can apply that to GnuPG as well.
 Check out the following URLs for these documents:

• The International PGP Homepage <http://www.pgpi.com>
• The PGP DH vs. RSA FAQ <http://www.scramdisk.clara.net/pgpfaq.html> has information on the differences of these two algorithms. These are the two algorithms used by GnuPG.

Keyservers

• Keyserver.net <http://www.keyserver.net>
• <http://wwwkeys.eu.pgp.net>

Books

• B. Schneier, "Applied Cryptography, Second Edition", Wiley, 1996 Deutsche Ausgabe unter dem Titel "Angewandte Kryptographie", Addison-Wesley, 1996

About this document

 Copyright © 1999 Brenno J.S.A.A.F. de Winter (English version)
 Copyright © 1999 Michael Fischer v. Mollard (original German version)
 Copyright © 2002 Arjen Baart (Dutch version) Copyright © 2004 Baris
 Cicek (Turkish version)

 This document is free documentation you can redistribute it and/or
 modify it under the terms of the GNU Library General Public License as
 published by the Free Software Foundation; either version 2 of the
 License, or (at your option) any later version.

 This library is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 Library General Public License for more details.
 You should have received a copy of the GNU Library General Public
 License along with this library; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
 USA.

Versions

Original German versions: Version 0.1 was the first version in German

 V�Ve�er�rs�si�io�on�n 0�0.�.1�1.�.0�0 (�(E�En�ng�gl�li�is�sh�h)�) A�Ap�pr�ri�il�l 3�30�0t�th�h 1�19�99�99�9,�, D�Du�ut�tc�ch�h Q�Qu�ue�ee�en�n'�'s�s D�Da�ay�y.�.

 ·  This version is the translation of the German version in English
    with some adjustments.

 V�Ve�er�rs�si�io�on�n 0�0.�.1�1.�.1�1 (�(G�Ge�er�rm�ma�an�n)�)

 ·  New section "Boundaries to security"

 ·  Improved explanation of signatures

 ·  Changes after comments from Werner Koch (thanks!)

 V�Ve�er�rs�si�io�on�n 0�0.�.1�1.�.2�2 (�(E�En�ng�gl�li�is�sh�h)�) A�Ap�pr�ri�il�l 3�3,�, 2�20�00�02�2

 ·  Corrected a few typos.

 ·  New section about front ends.

 V�Ve�er�rs�si�io�on�n 0�0.�.1�1.�.3�3 (�(D�Du�ut�tc�ch�h)�) M�Ma�ay�y 1�17�7,�, 2�20�00�02�2

 ·  This version is a translation of the English version into Dutch.

 V�Ve�er�rs�si�io�on�n 0�0.�.1�1.�.4�4 (�(T