KMail and PgP

[Charles Howse]

Hi,

Recently, my email address was hijacked, and used to send a virus to an 
address with a .ru domain.
This has sparked my interest in signing my email.

Having used PgP on Windows, my understanding of the way this all works is...

I install the necessary software to digitally sign my email, and upload the 
public key to a keyserver.  
I then sign my email, and anyone wanting to verify my identity looks up the 
public key, assures themselves that it is really me, and then downloads the 
key to their keyring.
Persons who are sure that this key belongs to me can sign the key, as well.
Then, persons can then be reasonably sure that email containing my digital 
signature actually came from me.
Am I close enough in my understanding?

I found http://kmail.kde.org/kmail-pgpmime-howto.html
Is this the definitive HOWTO for signing email in KMail, or is there a better 
reference out there for KMail in FC1?

I'm not opposed to compliing the software as the above page indicates, but I 
have a "Personal Desktop" installation of FC1, and wonder if I have the 
compiler installed?

-- 
Charles Howse
Jackson, TN
Fedora Core 1 Uptime: 1 day,  7:57

[Markku Kolkka]

Charles Howse kirjoitti viestissään (lähetysaika lauantai 31. 
tammikuuta 2004 00:22):
>  I found http://kmail.kde.org/kmail-pgpmime-howto.html
>  Is this the definitive HOWTO for signing email in KMail, 
No, you don't need any of that stuff for signing email. Just 
install gnupg, generate your keys and select your GPG key in 
KMail setup for your Identity. Then you can sign your message by 
clicking the "sign message" icon in the mail composer.

-- 
	Markku Kolkka
	markku.kolkka(a)iki.fi

[Charles Howse]

On Friday 30 January 2004 05:03 pm, Markku Kolkka wrote:
>  Charles Howse kirjoitti viestissään (lähetysaika lauantai 31.
>
>  tammikuuta 2004 00:22):
>  > I found http://kmail.kde.org/kmail-pgpmime-howto.html
>  > Is this the definitive HOWTO for signing email in KMail,
>
>  No, you don't need any of that stuff for signing email. Just
>  install gnupg, generate your keys and select your GPG key in
>  KMail setup for your Identity. Then you can sign your message by
>  clicking the "sign message" icon in the mail composer. 
Hi Markku, thanks for the reply.
It seems that gnupg is installed by default in FC1, so that's done.

I took a quick look at man gpg, and it seems like all I need to do there is:
gpg --gen-key
and
gpg --send-key [mykey] --keyserver [mykeyserver]
Am I correct?  Do I have to do this from the command line?

Another issue:
I already have a public key on the keyservers that I had forgotten about.
I found it by searching on www.keyserver.net/en.
What would you suggest I do?  Should I just retrieve that key and use it, or 
should I revoke it, create a new one, and upload it?

-- 
Charles Howse
Jackson, TN
Fedora Core 1 Uptime: 1 day,  9:05

[A. Sopicki]

Hi, Charles!

>  I took a quick look at man gpg, and it seems like all I need to do
> there
>  is: gpg --gen-key
>  and
>  gpg --send-key [mykey] --keyserver [mykeyserver]
>  Am I correct?  Do I have to do this from the command line? 
You don't have to do
this on the command line. There is a program called kgpg 
for that. You can find it at http://devel-home.kde.org/~kgpg/. There's an 
RPM-package  for Redhat 9 which works for me on FC1 as well. More frontends 
can be found at http://www.gnupg.org/(en)/related_software/frontends.html 

>  Another issue:
>  I already have a public key on the keyservers that I had forgotten about.
>  I found it by searching on www.keyserver.net/en.
>  What would you suggest I do?  Should I just retrieve that key and use it,
>  or should I revoke it, create a new one, and upload it? 
Depends on how you trust
the guys running the keyserver. Another issue would 
be the expiration time of your key. 

Greetz,

Alex
-- 
The box said install Windows 2000 or better so I installed Linux :p

[Markku Kolkka]

Charles Howse kirjoitti viestissään (lähetysaika lauantai 31. 
tammikuuta 2004 01:53):
>  I already have a public key on the keyservers that I had
>  forgotten about. I found it by searching on
>  www.keyserver.net/en.
>  What would you suggest I do?  Should I just retrieve that key
>  and use it, or should I revoke it, create a new one, and
>  upload it? 
If you don't have the matching secret key saved somewhere, that 
public key is useless. 

-- 
	Markku Kolkka
	markku.kolkka(a)iki.fi

[Charles Howse]

On Saturday 31 January 2004 04:22 am, Markku Kolkka wrote:
>  Charles Howse kirjoitti viestissään (lähetysaika lauantai 31.
>
>  tammikuuta 2004 01:53):
>  > I already have a public key on the keyservers that I had
>  > forgotten about. I found it by searching on
>  > www.keyserver.net/en.
>  > What would you suggest I do?  Should I just retrieve that key
>  > and use it, or should I revoke it, create a new one, and
>  > upload it?
>
>  If you don't have the matching secret key saved somewhere, that
>  public key is useless. 
Ok, I understand.  I do not have the matching secret key.  
Where does that leave me?  Is there a way to revoke the existing public key or 
overwrite it?
I do remember the passphrase.

-- 
Charles Howse
Jackson, TN
Fedora Core 1 Uptime: 2 days,  5:43

[Charles Howse]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Saturday 31 January 2004 04:22 am, Markku Kolkka wrote:
>  Charles Howse kirjoitti viestissään (lähetysaika lauantai 31.
>
>  tammikuuta 2004 01:53):
>  > I already have a public key on the keyservers that I had
>  > forgotten about. I found it by searching on
>  > www.keyserver.net/en.
>  > What would you suggest I do?  Should I just retrieve that key
>  > and use it, or should I revoke it, create a new one, and
>  > upload it?
>
>  If you don't have the matching secret key saved somewhere, that
>  public key is useless. 
Ok, I've installed kgpg, and cryptplug.
I've generated my key, configured Kmail, and uploaded my public key (which 
simply added another public key with a different fingerprint under the 
listings for my name, easy!).
I guess I'm good to go!  Thanks for the help.

- -- 
Charles Howse
Jackson, TN
Fedora Core 1 Uptime: 2 days,  7:05
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQFAHB4a/S+VsB9RMKgRAjN2AJ4rnbHm/zgeTxQggj7/JSPfCVrv5ACgi+Mt
> 2Qy28op3EHJE0kPPME14cL4=
> =d+dz
> -----END PGP SIGNATURE-----

[Dennis Gilmore]

Once upon a time Saturday 31 January 2004 8:22 am, Charles Howse wrote:

>  I found http://kmail.kde.org/kmail-pgpmime-howto.html
>  Is this the definitive HOWTO for signing email in KMail, or is there a
>  better reference out there for KMail in FC1?
>
>  I'm not opposed to compliing the software as the above page indicates, but
>  I have a "Personal Desktop" installation of FC1, and wonder if I have the
>  compiler installed? 
the packages you need are in the fedora.us repository. you dont need to 
compile anything.  you just need to set it up.  and yes to sign you dont need 
the plugins  but if you want to verify anyones signatures you do need it.  i 
personally use the plugin for both signing and checking signatures

Dennis