PGP Command Line - 6.5 Instruction Manual

PGP Command Line Guide

Version 6.5

Copyright © 1999 Network Associates Technology,Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Network Associates Technology, Inc., or its suppliers or affiliate c ompanies.

PGP*, V ersion 6.5.1 6-99. Printed i n the United States of America.

TRADEMARK ATTRIBUTIONS

* ActiveHelp, Bomb Shelter, Building a World of Trust, CipherLink, Clean-Up, Cloaking, Compass 7, CNX, CyberCop, CyberMedia, Data Security Letter, Discover, Distributed Sniffer System, Dr Solomon’s, Enterprise Secure Cast, First Aid , ForceField, Gauntlet, GMT, Hunter, ISDN Tel/ Scope, LM 1, LANGuru, Leading Help Desk Technology, Magic Solutions, MagicSpy, MagicTree, Magic University, MagicWin, MagicWord, McAfee Associates, McAfee, MoneyMagic, M ore Power To You, Multimedia Cloaking, NetCrypto, NetRoom, NetScan, Net Shield, NetShield, NetStalker, Net Tools, NetOctopus, NetStalker, Network Associates, Netw ork General, Network Uptime!, NetXRay, Nuts & Bolts, PC Medic, PCNotary, PGP, PGP (PrettyGood Privacy), PocketScope, PowerTelnet, Pretty Good Privacy, PrimeSupport, RecoverKey, RecoverKey -International, ReportMagic, RingFence, Router PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, Site Meter, Sniffer, SniffMaster, SniffNet, Stalker, Statistical Information Re trieval (SIR), Sup portMagic, T-POD, TeleSniffer, TIS, TM ach, TMeg , Trusted Mach, Trusted Mail, Total Network Visibility, Total Virus Defense, Uninstaller, Virex, Virex-PC , Virus Fo rum, ViruScan, VirusScan, VShield, WebScan, WebShield, WebSniffer, WebStalker WebWall, and ZAC 2000 are registered trademarks of

Network A ssociates and/or its affiliates in the US and/or other countries. A ll other registered and unregistered trademarks inthis document are the sole property of their respective owners.

Portions of this software may use public key a lgorithms described in U.S. Patent numbers 4,200,770, 4,218,582,4,405,829, and 4,424,414, licensed exclusively by PublicKey Partners; the IDEA(tm) cryptographic cipher described in U.S. patent number 5,214,703, licensed from Ascom Tech AG; and the Northern Telecom Ltd., CAST Encryption Algorithm, licensed from Northern Telecom, Ltd. IDEA is a trademark of Ascom Tech AG. Network Associates Inc. may have patents and/or pending patent applications covering su bject matter in this software or its documentation; the furnishing of this software or documentation does not give you any license to these patents. The compression c ode in PGP is by Mark Adler and Jean-Loup Gailly, u sed with permission from the free Info-ZIP implementation. LDAP software provided courtesy University of Michigan at Ann Arbor, Copyright © 1992-1996 Regents of the University of Michigan. All rights reserved. This product includes software developed by the Ap a che Group for use in t he Apache HTTP server project (http://www.apache.org/). Copyright © 1995-1999 The Apache Group. All rights reserved. See text f iles included with the software or the PGP web site for further information.

LIMITED WARRANTY Limited Warranty. Network A ssociates warrants that for sixty (60) days from the date of

original purchasethe media (forexamp le diskettes) on which the Software is contained will be free from defects in materials and workmanship.

Customer Remedies. Network Associates' a nd its su ppliers'entire liabilityand your exclu sive remedy shall be, at Network Associates'option, either (i) return of the purchase price paid for the license, if any, or (ii)replacement of the defectivemedia in which the Software is contained with a copy on nondefective media. You must return the defective media to Network Associates at your expense with a copy of your receipt. This limited warranty is void if the defect has resulted from accident, abuse, or misapplication. Any replacement media will be warranted for the r emainder of the original warranty period. Outside the United States, this remedyis not availableto the extentNetworkAssociatesis subjectto restrictionsunder United States export c ontrol laws and regulations.

Warranty Disclaimer. To the maximum extent permitted by applicable law, and except fo r the limited warranty set forth herein, THE SOFTWARE IS PROVIDED ON AN "AS IS" BASIS WITHOUT WARRANTYOF ANY KIND, EXPRESS OR IMPL IED. W ITHOUTLIMITING THE FOREGOING PROVISIONS, YOU ASSUME RESPONSIBILITY FOR SELECTING THE SOFTWARE TO ACHIEVE YOUR INTENDED RES ULTS, AND FOR THE INSTALLATION OF, USE OF, AND RESULTS OBTAINED FROM THE SOFTWARE. W ITHOUT LIMITING THE FOREGOING PROVISIONS, NETWORK ASSOCIATES MAKES NO WARRANTY THATTHESOFTWAREWILLBEERROR-FREEORFREEFROMINTERRUPTIONSOR OTHER FAILURES OR T HAT THE SOFTWARE W ILL MEET YOUR REQUIREMENTS. T O THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NETWORKASSOCIATES DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULARPURPOSE, AND NONINFRINGEMENTWITH RESPECT TO THE SOFTWARE AND THE ACCOMPANYING DOCUMENTATION. SOME STATES AND JURISDICTIONS DO NOT ALLOW LIMITATIONS ON IMPLIED WARRANTIES, SO THE ABOVE LIMITATION MAY NOT APPLY TO YOU. The foregoing provis ions shall be enforceable to the maximum extent permitted by applicable law.

LICENSE AGREEMENT

NOTICE TO ALL USERS: FOR THE SPECIFIC TERMS OF YOUR LICENSE TO USE THE SOFTWARE THAT THIS DOCUMENTATION DESCRIBES, CONSULT THE README.1ST, LICENSE.TXT, OR OTHER LICENSE DOCUMENT THAT ACCOMPANIES YOUR SOFTWARE,EITHER AS A TEXT FILE OR AS PART OF THE SOFTWARE PACKAGING. IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH THEREIN, DO NOT INSTALL THE SOFTWARE.IF APPLIC ABLE,YOU MAYRETURN THE PRODUCT TO THEPLACE OF PURCHASE FOR A FULL REFUND.

Export of this software and documentation may be subject to compliance with the rules and regulations promulgated fromtime to time by the Bureau of Export Administration, United States Department of Commerce, which restrict the export and re-export of certain products and technical data.

Network Associates, Inc. (408) 988-3832 main 3965 Freedom C ircle Santa Clara, CA 95054 http://www.nai.com

info@nai.com

* is sometimes used instead of the ® for registered trademarks to protect marks registered outside of the

U.S.

iv Product Name

Preface.....................................................ix

OrganizationofthisGuide........................................ ix

ConventionsusedinthisGuide ................................... ix

HowtocontactNetworkAssociates.................................x

Customerservice ............................................x

Technicalsupport ...........................................x

Year 2000 Compliance . . . .................................... xi

NetworkAssociatestraining.................................. xi

Commentsandfeedback..................................... xi

RecommendedReadings ....................................xii

Chapter1. IntroducingPGP ...................................1

UsingPGP ......................................................1

Aquickoverview.................................................1

BasicstepsforusingPGP ....................................2

Chapter2. GettingStarted ....................................5

StartingPGP ....................................................5

LocationofPGPfiles .............................................5

PGPPATH:SetthepathnameforPGP ...........................6

MakingPGPcompatiblewithPGP2.6.2 ..............................6

MakingandExchangingKeys ......................................7

Keyconcepts....................................................7

Makingakeypair ................................................8

Protectingyourkeys ............................................10

Distributingyourpublickey ......................................11

Summaryofkeyservercommands ................................11

Creating a passphrase that you will remember .......................12

PGP’scommandlineoptions .....................................13

EnteringPGPconfigurationparametersonthecommandline......15

User Guide v

Table of Contents

CommonPGPfunctions..........................................15

Creating,disabling,reenabling,andrevokingakey ..............15

Encryptinganddecryptingmessages ..........................16

Wipingyourdisk ...........................................17

Signingmessages ..........................................17

Specifyingfiletypes.........................................17

Keymaintenancecommands .................................18

Creatingsignaturecertificates ................................19

Summaryofcommands ..........................................20

Cancellinganoperation ..........................................20

Chapter3. AdvancedTopics..................................21

Identifyingyourhomedirectory:HOME.............................21

Using PGP non-interactively from UNIX shell scripts or MSDOS

batchfiles ...................................................21

Suppressing unnecessary questions: BATCHMODE ..............21

Eliminatingconfirmationquestions:FORCE ....................22

UnderstandingPGPexitstatuscodes..........................22

UsingPGPasaUNIX-stylefilter ...................................22

Encryptingandtransmittingbinarydata ............................23

Sending binary data files in ASCII-armored form at without

encryptionorsignature....................................23

DecryptingASCII-armoredmessages ..........................24

SendingapublickeyinASCII-armoredformat...................24

SendingASCIItextfilestodifferentmachineenvironments ............24

ManagingSignatureCertificates...................................25

Creatingseparatesignaturecertificateandtextfiles..............25

Receivingseparatesignaturecertificateandtextfiles ............25

FileManagementCommands .....................................26

Decrypting a message and vi ewing plaintext output on your screen . 26 Decrypting a message and renaming the plain text filenam e output . . 26 Decrypting a message and recovering the origi nal plaintext

filename ................................................26

Deletingakeyfromthekeyserver.............................26

Encryptingforviewingbyrecipientonly........................27

Storingsignedfiles:Signingafilewithoutencrypting ............27

Wipingyourdisk ...........................................27

vi PGP Command Line

Table of Contents

KeyManagementCommands .....................................28

Editing your user ID o r passphrase, or making an existing key

yourdefaultsigningkey ...................................28

Editingthetrustparametersforapublickey ....................28

Verifyingthecontentsofyourpublickeyring ...................29

Verifyingapublickeyoverthephone ..........................29

Selecting keys using the key ID . . .............................30

PGPPASS:Storeyourpassphrase.............................30

PGPPASSFD...............................................31

Chapter4. PGP’sConfigurationFile ...........................33

LearningaboutPGP’sconfigurationfile:pgp.cfg.....................33

ARMOR:ASCII-armoroutput .................................34

ARMORLINES:SizeofASCIIarmormultipartfiles ................34

CERT_DEPTH:Depthofintroducersbenested ..................35

CLEARSIG: Signed mess age readable with human eyes ..........35

COMMENT:ASCIIarmorcomment.............................36

COMPATIBLE: Enable user-interface compatibility with PGP 2.6.2 . . 36 COMPLETES_NEE D ED: Number of completely trusted

introducersneeded .......................................36

COMPRESS: Compressi on before encryption . . .................37

CIPHERNUM ...............................................37

ENCRYPTTOSELF: Encrypt to self .............................37

FASTKEYGEN:Fastkeygeneration............................37

HASHNUM .................................................37

INTERACTIVE:Confirmationforkeyadds ......................38

KEYSERVER_URL ..........................................38

MARGINALS_NEEDED: Number of marginally trusted

introducersneeded .......................................38

MYNAME:DefaultuserIDforsignatures........................38

PAGER:Shellcommandtodisplayplaintextoutput ..............39

PGP_MIME ................................................39

PGP_MIMEPARSE ..........................................39

PUBRING: Filename for your public keyring .....................39

RANDOMDEVICE . ..........................................40

RANDSEED: F ilename for random number seed .................40

UserGuide vii

Table of Contents

SECRING:Filenameforyoursecretkeyring .....................40

SHOWPASS:Echopassphrasetouser .........................40

TMP:Directorypathnamefortemporaryfiles ....................41

TEXTMODE:Assumeplaintextisatextfile......................41

TZFIX:Timezoneadjustment .................................41

VERBOSE:Quiet,normal,orverbosemessages .................42

AppendixA. ExitAndErrorCodes..............................43

Index.......................................................45

viii PGP Command Line

Preface

Organizat io n of this Guide

This Guide is divided into the following chapters:

• Chapter 1, “Introducing PGP” This chapter provides an introduction to

using PGP Command Line software.

• Chapter 2, “Getting Started” This chapter describes how to start and stop

PGP, how to make and exchange keys, and how to perform common PGP functions f rom the command line.

• Chapter 3, “Advanced Topics” This chapter describes how to use PGP

non-interactively from UNIX shell scripts and MSDOS batch files, how to use PGP as a UNIX-style filter, and how to encrypt and transmit binary data.

• Chapter 4, “PGP’s ConfigurationFile” This chapter introduces you to

PGP’s configuration file a nd the configuration parameters in that f ile .

Conventions used in this Guide

The following describes the conventions used in this guide:

Bold Menus, fields, options , and bu ttonsare in bold

typeface. An example follows: Select the Clear option from the Editmenu.

Sans-serif font

Keystrokes

Variables

Pathnames, filenames, icon names, screen text, and special keys on the key board are s how n in a sans-serif font.

Keystrokesthat you enter are shown in bold sans-serif type.

Command-linetextforwhichyoumustsupply a value is shown in italic sans-serif type.

User Guide ix

Preface

How to contact Network Associates

Customer service

To order products or obtain product information, contact the Network Associates C ustomer Care department at (408) 988-3832 or write to the following address:

Network Associates,Inc. McCandless Towers 3965 Freedom Circle Santa Clara, CA 95054-1203 U.S.A.

Technical sup port

Network Associates is famous for its dedicationto customer satisfaction. We have continued this t radition by making our site on the World Wide Web a valuable resource for answers to t echnical support issues. We encourage you to make this your first stop for answers to frequently asked questions, for updatestoNetworkAssociatessoftware,andforaccessto NetworkAssociates news and encryption information

World Wide Web http://www.nai.com

Technical Support for your PGP product is also available thr ough these channels:

Phone Email PGPSupport@pgp.com

To provide the answers you need quickly and efficiently, the Network Associates technical support staff needs some informationabout your computer and your s o ftware. Please have this information ready befo re you call:

If the automatedservices do not havethe answers you need, contactNetwork Associates at one of the following numbers Monday through Friday between 6:00

A.M. and 6:00 P.M. Pacifictime.

Phone (408) 988-3832

x PGP CommandLine

(408) 988-3832

• Product name and version number

• Computer brand and model

• Any additional hardware or peripherals connected to your computer

• Operating system type and version numbers

• Network type and version, if applicable

• Content of any status or error message displayed on screen, or appearing

in a log file (not all products produce log files)

• Email application and version (if theproblem involves using PGP with an

email product, for example, the E udora plug-in)

• Specific s teps to reproduce the problem

Year 2000 Compliance

Preface

InformationregardingNAI productsthat areYear 2000 compliant and its Year 2000 standards and testing models m ay be obtained from NAI’s website at

http://www.nai.com/y2k

. For further information, email y2k@nai.com.

Network Associates training

For informationabout schedulingon-sitetrainingfor any NetworkAssociates product, call (800) 338-8754.

Comments and feedback

Network A ssociates appreciates your comments and feedback, but incurs no obligation to you for information you submit. Please address your comments about PGP product documentation to: Network Associates, Inc., 3965 Freedom Circle Santa Clara, CA 95054-1203 U.S.A.. You can also e-mail comments to tns_documentation@nai.com.

User Guide xi

Preface

Using PGP

This command line version of PGP is designed for two broad types of applications: transferring information securely between batch servers and integration into automated processes.

• A fina ncialinstitution can usePGP to securely tr ansferfiles from one office

to another. Files are encrypted to the receiving server’s key and ftp to a directory on a remote server. The remote server periodically examines its receiving directory. When the remote server identifies newly transferred files, it decr ypts the files a nd sends them to their final destination.

• UNIX and Windows develop ers can use this product to secure financial

transactions that users make on the internet. For example, if you sell products o n your website, you c an include PGP in your scripts to automatically encrypt a customer’s order and credit card information for storage or transfer to a secure machine.

The term MSDOS batch files refers to a W indows NT commandprompt. The term MSDOS means the command prompt window that exists in Windows NT.

A quick overview

PGP is based on a widely accepted encryption technology known as public key cryptography in which two complementary keys, called a key pair,areusedto

maintain secure communications. One of the keys is d esignated as a private k ey to which only you have access and the other is a public k ey w hich you freely exchange with other PGP users. Both your private and your public keys are stored in keyring files.

For a comprehensive overview of PGP encryption technology, refer to “An Introduction to Cryptography,” which is included with the product.

User Guide 1

Introducing PGP

Basic steps for using PGP

This section takes a quick look at the procedures you normally follow in the course of using P GP . For details concerning any of these procedures, refer to the appropriate chapters in this book.

1. Install PGP on your computer. Refer to the documentation included with

PGP for complete installation instructions.

2. Create a private and public key pair.

Before you c a n begin using PGP, you need to generate a key pair. A PGP key pair is composed of a private key to which only you have access and a public key that y ou can copy and make freely available to everyone with whom you exchange information.

You can create a new key pa ir any time after you have finished the PGP installation procedure.

For more information about creating a private and public ke y pair, referto

“Making a key pair” on page 8

3. Exchange public keys with others.

Afteryou have createda key pair, youcan begin correspondingwith other PGP u sers. You will need a copy of their public key and they will need yours. Your public key is j ust a block of text, so it’s quiteeasy to trade keys with someone. You can include your publickey in an emailmessage, copy it to a file, or post it on a public or corporate key server where anyone can get a copy when they need it.

For more informationabout exchanging public keys, refer to and “Making

and Exchanging Keys”on page 7 and “Distributing your public key” on page 11.

4. V alidate public keys.

Once you have a copy of someone’s public key, you can add it to your public keyring. You should then check to m ake sure that the key has not been tampered with and that it really belongs to t he purpo rted owner. You do this by comparing the unique fingerprint on your copy of someone’s public key to the fingerprint on that person’s original key.

Youcan also ac cept a key as valid based onthe presence o f a signaturefrom a trusted introducer. PGP users often have other trusted users sign their public keys to further attest to their authenticity. For instance, you might send a trusted colleaguea copyof your publickey with a request that h e or she certify and return it so you can include the signature when you post your key on a public key server. Using PGP, when someone gets a copy of yourpublickey,theydon’thaveto check thekey’sauthenticitythemselves,

2 PGPCommand Line

Introducing PGP

but can instead rely on how well they trust the person(s) who signed your key. PGP provides themea ns for estab lishing thislevel of validityfor each of t he public keys you add to you r public keyring. This means that when you get a key from someone whose key is signed by a trusted introducer, you can be fairly sure that the key belongs to the purported user.

Your Security Officer c an act as a trusted introducer, and you may then trust any keys signed by the corporate key to be valid keys. If you wo rk for a large company with several locations, you may have regional introducers, and your Security Officer may be a meta-introducer, or a trusted introducer of trusted introducers.

When you are sur e that you have a valid public key, you sign it to indicate that you feel the key is safe to use. In addition, you can grant the owner of the key a level of trust indicating how much confidence you have in that person to vouch for the authenticity of someone else’s p ublic key.

5. Encrypt and sign your email and files .

After you have generated your key pair and have exchang ed public keys, you can begin encrypting and signing email messages and files.

6. Dec rypt and verify your email and files.

When someone sends you encrypted data, you can decrypt the contents and verify any appended signature to make sure that the data originated with the alleged sender and that it has not been altered.

7. Wipe files.

When you need to permanently delete a file, you can use the wipe command to ensure that the file is unrecoverable. The file is immediately overwritten so that it cannot be retrieved using disk recovery software.

User Guide 3

Introducing PGP

4 PGPCommand Line

2Getting Started

This chapter covers the following topics:

• Starting and quitting PGP

• Making and exchanging k ey pairs

• Perfor ming common PGP functions from the command line

• Viewing PGP’s online User Guide

Starting PGP

To start PGP, enter the following at the command line: pgp You can perform all PGP functions from the command line.

Location of PGP files

In UNIX:

The first time you start PGP, the software checks to see if the environment variable PGPPATH is defined. If PGPPATH is defined, the s oftware puts t he PGP preferences file, keyring files, pgp.cfg, and the randseed file in the %PGPPATH% directory.

If PGPPATH is not defined, the software checks to see if the environment variable USERPROFILE is defined. If USERPROFILE is d efined, the software puts the files in the %USERPROFILE%\Application Data\pgp directory.

If USERPROFILE is not defined,the softwareputs the files in %SYSTEMROOT%\pgp.

In Windows NT: The first time you start PGP, the software checks to see if the environment

variable PGPPATH is defined. If PGPPATH is defined, the s oftware puts t he pgp.cfg in the %P GP PATH% directory.

If PGPPATH is not defined, the software checks to see if the environment variable USERPROFILE is defined. If USERPROFILE is d efined, the software puts the pgp.cfg f ile in the %USERPROFILE%\Application Data\pgp directory.

User Guide 5

+ 44 hidden pages

PGP Command Line - 6.5 Instruction Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

Table of Contents

Preface

Organizat io n of this Guide

Conventions used in this Guide

How to contact Network Associates

Customer service

Technical sup port

Year 2000 Compliance

Network Associates training

Comments and feedback

Recommended Readings

Using PGP

A quick overview

Basic steps for using PGP

Starting PGP

Location of PGP files