GNU Privacy Guard
Developer:	GNU Project
Latest release:	2.0.1 / November 29, 2006
OS:	Cross-platform
Use:	Privacy
License:	GPL
Website:	www.gnupg.org

The GNU Privacy Guard (GnuPG or GPG) is a free software replacement for the PGP suite of cryptographic software, released under the GNU General Public License. It is a part of the Free Software Foundation's GNU software project, and has received major funding from the German Government. GnuPG is completely compliant with the IETF standard for OpenPGP. Current versions of PGP (and Veridis' Filecrypt) are interoperable with GnuPG and other OpenPGP-compliant systems. Although some older versions of PGP are also interoperable, not all features of newer software are supported by the older software. It is necessary for users to understand those incompatibilities and work around them. The GNU Privacy Guard logo, directly from gnupg. ... Software development is the translation of a user need or marketing goal into a software product. ... The GNU logo, drawn by Etienne Suvasa The GNU Project was announced in 1983 by Richard Stallman. ... A software release refers to the creation and availability of a new version of a computer software product. ... November 29 is the 333rd (in leap years the 334th) day of the year in the Gregorian Calendar. ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ... An operating system (OS) is a computer program that manages the hardware and software resources of a computer. ... A software license is a legal agreement which may take the form of a proprietary or gratuitous license as well as a memorandum of contract between a producer and a user of computer software. ... The GNU logo The GNU General Public License (GNU GPL or simply GPL) is a widely used free software license, originally written by Richard Stallman for the GNU project. ... A website (or Web site) is a collection of web pages, typically common to a particular domain name or subdomain on the World Wide Web on the Internet. ... This article is about free software as defined by the sociopolitical free software movement; for information on software distributed without charge, see freeware. ... PGP Encryption (Pretty Good Privacy) is a computer program that provides cryptographic privacy and authentication. ... The German Lorenz cipher machine, used in World War II for encryption of very high-level general staff messages Cryptography (or cryptology; derived from Greek κρυπτός kryptós hidden, and γράφειν gráfein to write) is the study of message secrecy. ... The GNU logo The GNU General Public License (GNU GPL or simply GPL) is a widely used free software license, originally written by Richard Stallman for the GNU project. ... The Free Software Foundation (FSF) is a non-profit corporation founded in October 1985 by Richard Stallman to support the free software movement (free as in freedom), and in particular the GNU project. ... GNU (pronounced ) is a free operating system consisting of a kernel, libraries, system utilities, compilers, and end-user applications. ... The Internet Engineering Task Force (IETF) develops and promotes Internet standards, cooperating closely with the W3C and ISO/IEC standard bodies; and dealing in particular with standards of the TCP/IP and Internet protocol suite. ... An Open Specification for Pretty Good Privacy (openpgp) OpenPGP is defined by the OpenPGP Working Group of the Internet Engineering Task Force (IETF) Proposed Standard RFC 2440. ...

History

GnuPG was initially developed by Werner Koch. Version 1.0.0 was released on September 7, 1999. The German Federal Ministry of Economics and Technology funded the documentation and the port to Microsoft Windows in 2000. Werner Koch (born July 11, 1961) is a German free software author. ... September 7 is the 250th day of the year (251st in leap years). ... 1999 (MCMXCIX) was a common year starting on Friday, and was designated the International Year of Older Persons by the United Nations. ... Microsoft Windows is the name of several families of proprietary operating systems by Microsoft. ...

Because GnuPG is an OpenPGP standard compliant system, the history of OpenPGP is of importance. It was designed to interoperate with PGP, the email encryption protocol developed by Phil Zimmermann. See PGP for more information. PGP Encryption (Pretty Good Privacy) is a computer program that provides cryptographic privacy and authentication. ... Phil Zimmermann is the creator of the popular PGP encryption software. ... PGP Encryption (Pretty Good Privacy) is a computer program that provides cryptographic privacy and authentication. ...

Version 2.0 was released November 13, 2006. The old stable 1.x branch, whose last version 1.4.6 was released on December 6, 2006,^[1] will be continued in parallel with the new GnuPG 2 series, because there were significant changes in the architecture of the program which will not fit every purpose.^[2] November 13 is the 317th day of the year (318th in leap years) in the Gregorian Calendar, with 48 days remaining. ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ... December 6 is the 340th day (341st on leap years) of the year in the Gregorian calendar. ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ...

Usage

GnuPG is stable, production-quality software. It is frequently included in free operating systems, such as FreeBSD, OpenBSD, and NetBSD and nearly all distributions of GNU/Linux. An operating system (OS) is a computer program that manages the hardware and software resources of a computer. ... FreeBSD is a Unix-like free operating system descended from AT&T UNIX via the Berkeley Software Distribution (BSD) branch through the 386BSD and 4. ... OpenBSD is a freely available Unix-like computer operating system descended from Berkeley Software Distribution (BSD), a Unix derivative developed at the University of California, Berkeley. ... NetBSD is a freely redistributable, open source version of the Unix-like BSD computer operating system. ... Linux, or GNU/Linux, refers to any Unix-like computer operating system which uses the Linux kernel. ...

Although the basic GnuPG program has a command line interface, there exist various front-ends that provide it with a graphical user interface; for example, it has been integrated into KMail and Evolution, the graphical e-mail clients found in the most popular Linux desktops KDE and GNOME. For GNOME, there is a graphical GnuPG front-end called Seahorse. A plugin known as Enigmail allows GnuPG to be integrated with Mozilla and Thunderbird, which work on Microsoft Windows as well as Linux and other operating systems. Web-based software such as Horde also makes use of it. Note that, because the plugin mechanism is not part of GnuPG itself and not specified by the Open PGP standard, and because neither the GnuPG nor Open PGP developers were involved in their development, it is possible that GnuPG's security benefits could be compromised or even lost as a result of using such auxiliaries. It has been suggested that this article or section be merged with Command prompt. ... A graphical user interface (or GUI, often pronounced gooey), is a particular case of user interface for interacting with a computer which employs graphical images and widgets in addition to text to represent the information and actions available to the user. ... KMail is the email client of the KDE Desktop Environment. ... Evolution or Novell Evolution (formerly Ximian Evolution, prior to Novells 2003 acquisition of Ximian) is the official personal information manager and workgroup information management tool for GNOME. It combines e-mail, calendar, address book, and task list management functions. ... An email client An e-mail client, also called a Mail User Agent (MUA), is a computer program that is used to read and send e-mail. ... Linux, or GNU/Linux, refers to any Unix-like computer operating system which uses the Linux kernel. ... KDE (K Desktop Environment) (IPA: ) is a free desktop environment and development platform built with Trolltechs Qt toolkit. ... The GNOME project is an international effort to create an easy-to-use computing platform built entirely from free software. ... Seahorse is a GNOME front-end application for managing PGP and SSH keys. ... A plugin (or plug-in) is a computer program that interacts with a main (or host) application (a web browser or an email program, for example) to provide a certain, usually very specific, function on-demand. ... Signed and encrypted email with Mozilla Thunderbird and Enigmail (screenshot) Enigmail provides public key e-mail encryption. ... Mozilla is a computer term which has had many different uses, though all of them have been related to the now-defunct Netscape Communications Corporation and its related application software. ... Mozilla Thunderbird is a free, cross-platform e-mail and news client developed by the Mozilla Foundation. ... Microsoft Windows is the name of several families of proprietary operating systems by Microsoft. ... Horde is a PHP-based Web application framework It offers applications such as the Horde IMP email client, a groupware (calendar, notes, tasks, file manager), a wiki and a time and task tracking software. ...

GnuPG can also be compiled for other platforms like Mac OS X and Windows. For Mac OS X, there is a free port called MacGPG which has been adapted to use the OS X user interface and its native class definitions. Cross compilation is not a trivial exercise, at least in part because security provisions vary with operating system and adapting to them is often tricky, but high quality compilers should routinely produce executables which will interoperate correctly with other GnuPG implementations. Mac OS X (official IPA pronunciation: ) is a line of proprietary, graphical operating systems developed, marketed, and sold by Apple Computer, the latest of which is pre-loaded on all currently shipping Macintosh computers. ... Microsoft Windows is the name of several families of proprietary operating systems by Microsoft. ...

Recently, G10 Code and Intevation have released Gpg4win, a package of software that includes GnuPG for Windows, WinPT, Gnu Privacy Assistant, and GnuPG plug-ins for Windows Explorer and Outlook. These tools are wrapped in a standard windows installer, making it merely trivial for GnuPG to be installed and used on almost any recent Windows system. Windows Explorer running on Windows XP Windows Explorer is an application that is part of modern versions of the Microsoft Windows operating system that provides a graphical user interface for accessing the file systems. ... Screenshot of Outlook 2003 Microsoft Outlook is a personal information manager from Microsoft, and is part of the Microsoft Office. ...

The form of a file encrypted using MacGPG

Image File history File links PGP_form. ... Image File history File links PGP_form. ...

Process

GnuPG encrypts messages using asymmetric keypairs individually generated by GnuPG users. The resulting public keys can be exchanged with other users in a variety of ways, such as Internet key servers. They must always be exchanged carefully to prevent identity spoofing by corrupting public key ↔ 'owner' identity correspondences. It is also possible to add a cryptographic digital signature to a message, so the message integrity and sender can be verified, if a particular correspondence relied upon has not been corrupted. In computer security, a key server is a computer -- typically running special software -- which provides keys to users or other programs. ...

GnuPG does not use patented or otherwise restricted software or algorithms, including the IDEA encryption algorithm which has been present in PGP almost from the beginning. Instead, it uses a variety of other, non-patented algorithms such as CAST5, Triple DES, AES, Blowfish and Twofish. It is still possible to use IDEA in GnuPG by downloading a plugin for it, however this may require getting a license for some uses in some countries in which IDEA is patented. In cryptography, the International Data Encryption Algorithm (IDEA) is a block cipher designed by Xuejia Lai (來學嘉) and James L. Massey of ETH Zurich and was first described in 1991. ... The following article is about the block cipher. ... In cryptography, Triple DES (also 3DES) is a block cipher formed from the Data Encryption Standard (DES) cipher. ... In cryptography, the Advanced Encryption Standard (AES), also known as Rijndael, is a block cipher adopted as an encryption standard by the U.S. government. ... General Designer(s) Bruce Schneier First published 1993 Derived from - Cipher(s) based on this design Twofish Algorithm detail Block size(s) 64 bits Key size(s) 32-448 bits in steps of 8 bits; default 128 bits Structure Feistel network Number of rounds 16 Best cryptanalysis Four rounds of... In cryptography, Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. ...

GnuPG is a hybrid encryption software program in that it uses a combination of conventional symmetric-key cryptography for speed, and public-key cryptography for ease of secure key exchange, typically by using the recipient's public key to encrypt a session key which is only used once. This mode of operation is part of the Open PGP standard and has been part of PGP from its first version. Symmetric-key algorithms are a class of algorithms for cryptography that use trivially related cryptographic keys for both decryption and encryption. ... Public key cryptography is a form of cryptography which generally allows users to communicate securely without having prior access to a shared secret key. ...

Problems

The OpenPGP standard specifies several methods of digitally signing messages. Due to an error in a change to GnuPG intended to make one of those methods more efficient, a security vulnerability was introduced.^[3] It affects only one method of digitally signing messages, only for some releases of GnuPG (1.0.2 through 1.2.3), and there were less than 1000 such keys listed on the key servers.^[4] Most people did not use this method, and were in any case discouraged from doing so, so the damage caused (if any, and none has been publicly reported) would appear to have been minimal. Support for this method has been removed from GnuPG versions released after this discovery (1.2.4 and later). Two further vulnerabilities were discovered in early 2006; the first being that scripted uses of GnuPG for signature verification may result in false positives,^[5] the second that non-MIME messages were vulnerable to the injection of data which while not covered by the digital signature, would be reported as being part of the signed message.^[6] In both cases updated versions of GnuPG were made available at the time of the announcement. Digital signature is a term with confusing reference. ...

GnuPG is a command-line based system, that is not written as an API which can be incorporated into other software. GPGME is an API wrapper around GnuPG which parses the output of GnuPG, and various graphical front-ends based on GPGME have been created. This currently requires an out-of-process call to the GnuPG executable for many GPGME API calls. Because GPGME makes use of a special GnuPG interface designed for machine use, a stable and maintainable API between the components is given. Possible security problems in an application do not propagate to the actual crypto code due to the process barrier. A application programming interface (API) is the interface that a computer system, library or application provides in order to allow requests for services to be made of it by other computer programs, and/or to allow data to be exchanged between them. ... This article or section is in need of attention from an expert on the subject. ...

Other software wraps the command line in a Perl script (e.g. gpg-dialog) that is menu based and more user friendly. Perl is a dynamic programming language created by Larry Wall and first released in 1987. ...

See also

Free software Portal

Cryptography Portal

• E-mail privacy
• Pretty Good Privacy
• Key signing party
• Asymmetric key algorithm
• Cryptosystem
• Enigmail – A Mozilla Thunderbird and Seamonkey extension which allows signing and encryption of e-mails.

Image File history File links Portal. ... Image File history File links Portal. ... The protection of electronic mail from unauthorized access and inspection is known as e-mail privacy. ... PGP Encryption (Pretty Good Privacy) is a computer program that provides cryptographic privacy and authentication. ... Participants of a large key signing party line up in preparation to verify each others identities prior to signing. ... In cryptography, an asymmetric key algorithm uses a pair of cryptographic keys to encrypt and decrypt. ... A cryptosystem (or cryptographic system) is the package of all procedures, protocols, cryptographic algorithms and instructions used for encoding and decoding messages using cryptography. ... Signed and encrypted email with Mozilla Thunderbird and Enigmail (screenshot) Enigmail provides public key e-mail encryption. ... Mozilla Thunderbird is a free, cross-platform e-mail and news client developed by the Mozilla Foundation. ... It has been suggested that this article or section be merged with Mozilla Application Suite. ... Mozilla Firefox showing several extensions and a custom theme See also: List of Firefox extensions Extensions are installable enhancements to the Mozilla Firefox or Mozilla web browsers, and add features to the application or allow existing features to be modified. ...

References

December 6 is the 340th day (341st on leap years) of the year in the Gregorian calendar. ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ... November 13 is the 317th day of the year (318th in leap years) in the Gregorian Calendar, with 48 days remaining. ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ... November 27 is the 331st day (332nd on leap years) of the year in the Gregorian Calendar. ... 2003 (MMIII) was a common year starting on Wednesday of the Gregorian calendar. ... February 15 is the 46th day of the year in the Gregorian Calendar. ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ... March 9 is the 68th day of the year in the Gregorian Calendar (69th in Leap years). ... The introduction to this article provides insufficient context for those unfamiliar with the subject matter. ...

External links

Software

• GNU Privacy Guard website
• MacGPG homepage
• GnuPG for Windows homepage
• GnuPG for Pocket PC
• FSF page on GPGME – software library designed to integrate GnuPG with other applications
• Freshmeat project page
• KGpg - For Linux

Illustration of an application which may use libvorbisfile. ...

Tutorials

• GnuPG Keysigning Party HOWTO
• GnuPG's ElGamal signing keys compromised
• A thorough graphical tutorial on GPG with Apple's Mac OS X Mail.app
• Graphical tutorial for Windows, Linux and others – email-oriented tutorial, using Enigmail, and Mozilla or Mozilla Thunderbird e-mail clients.
• GPG and Mutt
• Short two page tutorial on en/decrypting files using public keys