~ubuntu-branches/ubuntu/precise/seahorse/precise-proposed : revision 105

1

<?xml version="1.0" encoding="utf-8"?>

2

<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [

3

<!ENTITY legal SYSTEM "legal.xml">

4

<!ENTITY appversion "2.28.x">

5

<!ENTITY manrevision "3.1">

6

<!ENTITY date "July 2005">

7

<!ENTITY app "Passwords and Keys">

8

<!ENTITY daemon "<application>seahorse-daemon</application>">

9

<!ENTITY project "Seahorse">

10

<!ENTITY key "<glossterm>key</glossterm>">

11

<!ENTITY website "http://www.gnome.org/projects/seahorse/">

12

]>

13

14

15

<title>Passwords and Keys Manual</title>

16

17

18

<holder>Jacob Perkins and Adam Schreiber</holder>

19

</copyright>

20

21

<publishername>Seahorse Project</publishername>

22

</publisher>

23

24

25

<para>

26

Permission is granted to copy, distribute and/or modify this

27

document under the terms of the GNU Free Documentation

28

License (GFDL), Version 1.1 or any later version published

29

by the Free Software Foundation with no Invariant Sections,

30

no Front-Cover Texts, and no Back-Cover Texts. You can find

31

a copy of the GFDL at this <ulink type="help" url="ghelp:fdl">link</ulink> or in the file COPYING-DOCS

32

distributed with this manual.

33

</para>

34

<para> This manual is part of a collection of GNOME manuals

35

distributed under the GFDL. If you want to distribute this

36

manual separately from the collection, you can do so by

37

adding a copy of the license to the manual, as described in

38

section 6 of the license.

39

</para>

40

41

<para>

42

Many of the names used by companies to distinguish their

43

products and services are claimed as trademarks. Where those

44

names appear in any GNOME documentation, and the members of

45

the GNOME Documentation Project are made aware of those

46

trademarks, then the names are in capital letters or initial

47

capital letters.

48

</para>

49

50

<para>

51

DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT ARE PROVIDED

52

UNDER THE TERMS OF THE GNU FREE DOCUMENTATION LICENSE

53

WITH THE FURTHER UNDERSTANDING THAT:

54

55

56

57

<para>DOCUMENT IS PROVIDED ON AN "AS IS" BASIS,

58

WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR

59

IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES

60

THAT THE DOCUMENT OR MODIFIED VERSION OF THE

61

DOCUMENT IS FREE OF DEFECTS MERCHANTABLE, FIT FOR

62

A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE

63

RISK AS TO THE QUALITY, ACCURACY, AND PERFORMANCE

64

OF THE DOCUMENT OR MODIFIED VERSION OF THE

65

DOCUMENT IS WITH YOU. SHOULD ANY DOCUMENT OR

66

MODIFIED VERSION PROVE DEFECTIVE IN ANY RESPECT,

67

YOU (NOT THE INITIAL WRITER, AUTHOR OR ANY

68

CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY

69

SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER

70

OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS

71

LICENSE. NO USE OF ANY DOCUMENT OR MODIFIED

72

VERSION OF THE DOCUMENT IS AUTHORIZED HEREUNDER

73

EXCEPT UNDER THIS DISCLAIMER; AND

74

</para>

75

</listitem>

76

77

<para>UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL

78

THEORY, WHETHER IN TORT (INCLUDING NEGLIGENCE),

79

CONTRACT, OR OTHERWISE, SHALL THE AUTHOR,

80

INITIAL WRITER, ANY CONTRIBUTOR, OR ANY

81

DISTRIBUTOR OF THE DOCUMENT OR MODIFIED VERSION

82

OF THE DOCUMENT, OR ANY SUPPLIER OF ANY OF SUCH

83

PARTIES, BE LIABLE TO ANY PERSON FOR ANY

84

DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR

85

CONSEQUENTIAL DAMAGES OF ANY CHARACTER

86

INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS

87

OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR

88

MALFUNCTION, OR ANY AND ALL OTHER DAMAGES OR

89

LOSSES ARISING OUT OF OR RELATING TO USE OF THE

90

DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT,

91

EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF

92

THE POSSIBILITY OF SUCH DAMAGES.

93

</para>

94

</listitem>

95

</orderedlist>

96

</para>

97

</legalnotice>

98

99

100

101

102

<firstname>Jacob</firstname>

103

<surname>Perkins</surname>

104

105

<orgname>Seahorse Project</orgname>

106

<!--

107

108

<email>jap1@users.sourceforge.net</email>

109

</address>

110

-->

111

</affiliation>

112

</author>

113

114

115

<surname>Schreiber</surname>

116

117

<orgname>Seahorse Project</orgname>

118

119

<email>sadam@clemson.edu</email>

120

</address>

121

</affiliation>

122

</author>

123

124

125

<surname>Cutler</surname>

126

127

<orgname>GNOME Documentation Project</orgname>

128

129

<email>pcutler@foresightlinux.org</email>

130

</address>

131

</affiliation>

132

</author>

133

</authorgroup>

134

135

</releaseinfo>

136

137

<publishername>Seahorse Project</publishername>

138

</publisher>

139

140

<publishername>GNOME Documentation Project</publishername>

141

</publisher>

142

143

144

<revnumber>Passwords and Keys Manual V2.11.0</revnumber>

145

146

147

148

Paul Cutler

149

<email>pcutler@foresightlinux.org</email>

150

</para>

151

</revdescription>

152

</revision>

153

154

<revnumber>Passwords and Keys Manual V0.10.1</revnumber>

155

<date>August 2008</date>

156

157

158

Adam Schreiber

159

<email>sadam@clemson.edu</email>

160

</para>

161

</revdescription>

162

</revision>

163

164

<revnumber>Passwords and Keys Manual V0.9.1</revnumber>

165

<date>November 2006</date>

166

167

168

Milo Casagrande

169

<email>milo_casagrande@yahoo.it</email>

170

</para>

171

</revdescription>

172

</revision>

173

174

<revnumber>Passwords and Keys Manual V0.9.0</revnumber>

175

176

177

<para role="author">Adam Schreiber

178

<email>sadam@clemson.edu</email>

179

</para>

180

<para role="publisher">Seahorse Project</para>

181

</revdescription>

182

</revision>

183

184

<revnumber>Passwords and Keys Manual V0.7.0</revnumber>

185

<date>February 2003</date>

186

187

<para role="author">Jacob Perkins

188

189

</para>

190

<para role="publisher">Seahorse Project</para>

191

</revdescription>

192

</revision>

193

</revhistory>

194

<releaseinfo>This manual describes version 2.28.x of Passwords and Keys</releaseinfo>

195

196

<title>Feedback</title>

197

<para>To report a bug or make a suggestion regarding the

198

<application>Passwords and Keys</application> application or this manual, follow the directions in the

199

<ulink url="ghelp:gnome-feedback" type="help">Gnome Feedback Page</ulink>.

200

</para>

201

</legalnotice>

202

203

204

<para>

205

<application>Passwords and Keys</application> is the application for managing encryption keys for the GNOME Desktop

206

</para>

207

</abstract>

208

209

</articleinfo>

210

211

212

<primary>Seahorse</primary>

213

</indexterm>

214

215

216

<primary>seahorse</primary>

217

</indexterm>

218

219

220

<primary>Encryption Keys</primary>

221

</indexterm>

222

223

224

225

226

<title>Introduction</title>

227

<para>

228

You can use <application>Passwords and Keys</application> to create and manage <acronym>PGP</acronym> and <acronym>SSH</acronym> keys.

229

</para>

230

<para>

231

<application>Passwords and Keys</application> provides a front end to many of the features of

232

<ulink url="http://www.gnupg.org" type="http">Gnu Privacy Guard (GPG)</ulink> and

233

integrates with multiple components of the <ulink url="http://www.gnome.org">GNOME</ulink> desktop.

234

</para>

235

<para>

236

With <application>Passwords and Keys</application> you can:

237

238

239

240

<para>Create and manage PGP and SSH keys,</para>

241

</listitem>

242

243

<para>Export and import PGP and SSH keys,</para>

244

</listitem>

245

246

<para>Share your keys with others,</para>

247

</listitem>

248

</itemizedlist>

249

</para>

250

</sect1>

251

252

253

254

255

<title>Getting Started</title>

256

257

<title>Starting <application>Passwords and Keys</application></title>

258

<para>

259

You can start <application>Passwords and Keys</application>

260

in the following ways:

261

</para>

262

263

264

<term><guimenu>Applications</guimenu> menu</term>

265

266

<para>Choose

267

268

<guimenu>Accessories</guimenu>

269

<guimenuitem>Password and Keys</guimenuitem>

270

</menuchoice>.</para>

271

</listitem>

272

</varlistentry>

273

274

<term>Command Line</term>

275

276

<para>

277

Type <command>seahorse</command> then press <keycap>Return</keycap>.

278

</para>

279

</listitem>

280

</varlistentry>

281

</variablelist>

282

</sect2>

283

284

285

<title>When You Start <application>Passwords and Keys</application></title>

286

<para>

287

When you start <application>Passwords and Keys</application>, the <guilabel>Password and Keys</guilabel>

288

window is displayed.

289

</para>

290

291

292

<title>The <application>Passwords and Keys</application> Window</title>

293

294

295

296

297

</imageobject>

298

299

300

Show the <application>Passwords and Keys</application> window.

301

</phrase>

302

</textobject>

303

</mediaobject>

304

</screenshot>

305

</figure>

306

307

<para>

308

The <application>Passwords and Keys</application> window contains the following elements:

309

</para>

310

311

312

<varlistentry><term>Menubar</term>

313

314

<para>The menus on the menubar contain all of the commands that you need to perform tasks in <application>Passwords and Keys</application>.</para>

315

</listitem>

316

</varlistentry>

317

<varlistentry><term>Toolbar</term>

318

319

<para>Use the toolbar to quickly access commonly-used commands.</para>

320

</listitem>

321

</varlistentry>

322

<varlistentry><term>Keys and Passwords Tabs</term>

323

324

<para>Provides access to the keys and passwords in the keyring.</para>

325

</listitem>

326

</varlistentry>

327

<varlistentry><term>First time options</term>

328

329

<para>Provides fast access to useful actions for first time users. From here you can:</para>

330

331

332

<para>Browse the help system,</para>

333

</listitem>

334

335

<para>Import keys in the keyring,</para>

336

</listitem>

337

338

<para>Create new keys.</para>

339

</listitem>

340

</itemizedlist>

341

</listitem>

342

</varlistentry>

343

</variablelist>

344

</sect2>

345

</sect1>

346

347

348

349

350

<title>Creating OpenPGP Keys</title>

351

<para>

352

OpenPGP is a non proprietary protocol for encrypting e-mail with the use of public key

353

cryptography based on <acronym>PGP</acronym>. It defines standard formats for encrypted messages, signatures, private keys

354

and certificates for exchanging public keys.

355

</para>

356

<para>

357

Public key cryptography is a concept which involves the use of two keys:

358

a <emphasis>public key</emphasis>, that you can give to anyone with whom

359

you would like to communicate, and a <emphasis>private key</emphasis> which is

360

private and must be kept secret.

361

</para>

362

<para>

363

To create OpenPGP keys:

364

365

366

<para>

367

Choose <menuchoice><guimenu>File</guimenu><guimenuitem>New...</guimenuitem></menuchoice>

368

</para>

369

</listitem>

370

371

<para>

372

Select <guilabel>PGP Key</guilabel> and click <guibutton>Continue</guibutton>

373

</para>

374

</listitem>

375

376

<para>

377

Enter your full name (first - last), your e-mail address and any additional information.

378

You can also specify advanced options for the key: see below.

379

</para>

380

</listitem>

381

382

<para>

383

Click <guibutton>Create</guibutton> to create the new key pair.

384

</para>

385

</listitem>

386

387

<para>

388

The <guilabel>Passphrase for New PGP Key</guilabel> dialog will open.

389

Enter the passphrase twice for your new key.

390

</para>

391

</listitem>

392

</orderedlist>

393

</para>

394

<tip>

395

<para>

396

Use similar practices to generating a strong password when choosing a

397

passphrase. The main difference between a password and a passphrase is that,

398

in a passphrase, spaces are valid characters.

399

</para>

400

</tip>

401

402

403

<title>Advanced options</title>

404

<para>

405

Expand the <guibutton>Advanced key options</guibutton>

406

section to specify the following options for a new key:

407

</para>

408

409

410

<term><guilabel>Encryption Type</guilabel></term>

411

412

<para>

413

This field specifies the encryption algorithms used

414

to generate your keys.

415

</para>

416

417

418

<term><acronym>DSA</acronym> ElGamal</term>

419

420

<para>

421

This is the suggested choice as it will allow

422

you to encrypt, decrypt, sign and verify as needed.

423

</para>

424

</listitem>

425

</varlistentry>

426

427

428

429

<para>

430

Will allow signing only.

431

</para>

432

</listitem>

433

</varlistentry>

434

435

436

437

<para>

438

Will allow signing only.

439

</para>

440

</listitem>

441

</varlistentry>

442

</variablelist>

443

</listitem>

444

</varlistentry>

445

446

<term><guilabel>Key Strength (bits)</guilabel></term>

447

448

<para>

449

This is the length of the key in bits. The longer the key,

450

the more secure it will be, provided a strong passphrase is

451

used. Conversely, performing any operation with a longer key

452

will require more time than it would with a shorter key. Acceptable

453

values are between 1024 and 4096 bits. At least 2048 bits is recommended.

454

</para>

455

</listitem>

456

</varlistentry>

457

458

<term><guilabel>Expiration Date</guilabel></term>

459

460

<para>

461

This is the date at which the key will cease to be usable for

462

performing encryption or signing operations. 6 months is a reasonable time

463

to set it to. You will have to either change the

464

expiration date or generate a new key or subkey after this amount

465

of time passes.

466

<note>

467

<para>

468

Sign your new key with your old one before it expires

469

to preserve your trust status.

470

</para>

471

</note>

472

</para>

473

</listitem>

474

</varlistentry>

475

</variablelist>

476

</sect2>

477

</sect1>

478

479

480

481

482

<title>Creating Secure Shell Keys</title>

483

<para>

484

Secure Shell (<acronym>SSH</acronym>) is a way of logging into a remote computer to execute commands

485

on that machine.

486

SSH keys are used in key-based authentication system, as an alternative to the default password

487

authentication system.

488

With key-based authentication there is no need to manually type a password to authenticate.

489

</para>

490

<para>

491

Secure Shell keys are made of two keys: a <emphasis>private key</emphasis>, that must be kept secret,

492

and a <emphasis>public key</emphasis> which can be uploaded to any computer you need to access.

493

</para>

494

<para>

495

To create a Secure Shell key:

496

</para>

497

498

499

<para>Choose <menuchoice><guimenu>File</guimenu><guimenuitem>New...</guimenuitem></menuchoice></para>

500

</listitem>

501

502

<para>Select <guilabel>Secure Shell Key</guilabel> and click <guibutton>Continue</guibutton></para>

503

</listitem>

504

505

<para>Enter a description of what the key is to be used for. You can use your e-mail address or any other reminder. You can also specify advanced options for the key: see below.</para>

506

</listitem>

507

508

<para>Click <guibutton>Just Create Key</guibutton> to

509

create the new key, or <guibutton>Create and Set Up</guibutton>

510

to create the key and set up another computer to use it for authentication.</para>

511

</listitem>

512

513

<para>The <guilabel>Passphrase for New Secure Shell Key</guilabel>

514

dialog opens.

515

Enter the passphrase twice for your new key.

516

</para>

517

<tip>

518

<para>

519

Use similar practices to generating a

520

strong password when choosing a

521

passphrase. The main difference between a

522

password and a passphrase is that, in a

523

passphrase, spaces are valid characters.

524

</para>

525

</tip>

526

</listitem>

527

</orderedlist>

528

529

530

531

532

<title>Advanced options</title>

533

<para>

534

Expand the <guilabel>Advanced key options</guilabel> section to specify the following options for a new key:

535

</para>

536

537

538

539

<term><guilabel>Encryption Type</guilabel></term>

540

541

<para>

542

This field specifies the encryption

543

algorithms used to generate your key.

544

</para>

545

546

547

548

549

<para>

550

Use the <emphasis>Rivest-ShamirAdleman</emphasis>

551

(<acronym>RSA</acronym>) algorithm to create the SSH key.

552

This is the preferred and more secure choice.

553

</para>

554

</listitem>

555

</varlistentry>

556

557

558

559

<para>

560

Use the <emphasis>Digital Signature Algorithm</emphasis>

561

(<acronym>DSA</acronym>) to create the SSH key.

562

</para>

563

</listitem>

564

</varlistentry>

565

</variablelist>

566

</listitem>

567

</varlistentry>

568

569

<term><guilabel>Key Strength (bits)</guilabel></term>

570

571

<para>

572

This is the length of the key in bits.

573

The longer the key, the more secure it

574

will be, provided a strong passphrase is

575

used. Conversely, performing any

576

operation with a longer key will require

577

more time than it would with a shorter

578

key. Acceptable values are between 1024

579

and 4096 bits. At least 2048 bits is recommended.

580

</para>

581

</listitem>

582

</varlistentry>

583

</variablelist>

584

</sect2>

585

</sect1>

586

587

588

589

590

<title>OpenPGP Key Properties</title>

591

<para>

592

The descriptions in this section apply to all OpenPGP keys.

593

</para>

594

595

<para>

596

To view properties of a <acronym>PGP</acronym> key:

597

598

599

<para>

600

Select the <acronym>PGP</acronym> key

601

from the main window,

602

</para>

603

</listitem>

604

605

<para>

606

Double click on it or choose <guilabel>Properties</guilabel>

607

from the toolbar,

608

</para>

609

</listitem>

610

611

<para>

612

Select the <guilabel>Details</guilabel> tab.

613

</para>

614

</listitem>

615

</itemizedlist>

616

</para>

617

618

619

<title id="pgp-private-key-properties">Properties</title>

620

<para>

621

622

623

<term><guilabel>Fingerprint</guilabel></term>

624

625

<para>The fingerprint is a unique string of characters that exactly identifies a key.</para>

626

</listitem>

627

</varlistentry>

628

629

<term><guilabel>KeyID</guilabel></term>

630

631

<para>

632

The KeyID is similar to the Fingerprint. However the KeyID only contains the last 8

633

characters of the fingerprint. Most of the time it is possible to identify a key with

634

only the KeyID, but occasionally two keys may have the same ID.

635

</para>

636

</listitem>

637

</varlistentry>

638

639

640

641

<para>

642

Specifies the encryption algorithm used to generate a key. DSA keys can only sign.

643

ElGamal keys are used to encrypt.

644

</para>

645

</listitem>

646

</varlistentry>

647

648

<term><guilabel>Created</guilabel></term>

649

650

<para>

651

Indicates the date the key was created.

652

</para>

653

</listitem>

654

</varlistentry>

655

656

<term><guilabel>Expires</guilabel></term>

657

658

<para>

659

Indicates the date the key can no longer be used.

660

</para>

661

</listitem>

662

</varlistentry>

663

664

<term><guilabel>Strength</guilabel></term>

665

666

<para>

667

Indicates the length in bits of a key. In general the longer the key, the more security it

668

provides.

669

<note>

670

<para>

671

A long key is not enough to make up for the use of a weak passphrase.

672

</para>

673

</note>

674

</para>

675

</listitem>

676

</varlistentry>

677

</variablelist>

678

</para>

679

</sect2>

680

681

682

<title>Trust</title>

683

<para>

684

Trust is an indication of how sure you are of a person's ability to correctly extend

685

the web of trust. When you are faced with a key you have not signed, the validity of

686

that person's key will be determined based on the signatures they have collected and

687

how well or not you trust the people who have made those signatures. By default, an

688

unknown key will require 3 signatures with marginal trust value or 1 fully trusted signature.

689

</para>

690

691

692

<guilabel>Unknown</guilabel>: You are not familiar with the person's ability to sign keys correctly.

693

</para></listitem>

694

695

<guilabel>Never</guilabel>: This person cannot correctly sign keys.

696

</para></listitem>

697

698

<guilabel>Marginal</guilabel>: This person checks for photo ID before signing a key, but

699

does not necessarily scrutinize the IDs.

700

</para></listitem>

701

702

<guilabel>Full</guilabel>: This person scrutinizes each and every person's photo IDs before

703

signing them (e.g. they only sign keys that truely belong to the person asking for the signature).

704

</para></listitem>

705

706

<guilabel>Ultimate</guilabel>: This level of trust should only be assigned to your own keys.

707

</para></listitem>

708

</itemizedlist>

709

</sect2>

710

711

712

<title>Enabling and Disabling Keys</title>

713

<para>

714

When a key is enabled, it can be used to perform encryption operations.

715

When a key is disabled, it cannot be used to encrypt to or verify signatures made by it.

716

</para>

717

</sect2>

718

719

720

<title>Expiration Date</title>

721

<para>

722

A key can no longer be used to perform key operations after it has expired. Changing a

723

key's expiration date to a point in the future re-enables it. A good general practice

724

would be to have a master key that never expires and multiple subkeys that do and are

725

signed by the master key.

726

</para>

727

</sect2>

728

729

730

731

<para>

732

User IDs allow multiple identities and email addresses to

733

be used with the same key.

734

</para>

735

<para>

736

They usually take the form of:

737

<programlisting>Name (comment) <email address></programlisting>

738

</para>

739

740

741

<title>Adding a User ID</title>

742

<para>

743

Adding a user ID is useful when you want to have

744

an identity for your job and one for your friends.

745

</para>

746

<para>

747

To add a user ID to a key:

748

749

750

<para>

751

Select the key from the main window,

752

</para>

753

</listitem>

754

755

<para>

756

Double click on it or choose <guibutton>Properties</guibutton> from the toolbar,

757

</para>

758

</listitem>

759

760

<para>

761

Select the <guilabel>Names and Signatures</guilabel> tab,

762

</para>

763

</listitem>

764

765

<para>

766

Click on <guibutton>Add Name</guibutton>.

767

</para>

768

</listitem>

769

</itemizedlist>

770

</para>

771

<para>

772

After following the instructions above, you will be presented with a

773

dialog to fill in. The fields are detailed below.

774

</para>

775

776

777

778

779

<para>

780

Enter your full name in the form

781

782

A middle name or initial is optional.

783

</para>

784

<para>

785

<note>

786

<para>

787

You must enter at least 5 characters in this field.

788

</para>

789

</note>

790

</para>

791

</listitem>

792

</varlistentry>

793

794

<term><guilabel>Email Address</guilabel></term>

795

796

<para>

797

Your email address is how most

798

people will locate your key on a

799

key server or other key provider.

800

Make sure it is correct before

801

continuing.

802

</para>

803

<para>

804

<note>

805

<para>

806

It should be of the form

807

808

</para>

809

</note>

810

</para>

811

</listitem>

812

</varlistentry>

813

814

<term><guilabel>Key Comment</guilabel></term>

815

816

<para>

817

The comment field can be used to

818

place any additional information

819

into the displayed name of your new

820

ID. This information can be

821

searched for on key servers.

822

</para>

823

</listitem>

824

</varlistentry>

825

</variablelist>

826

</sect3>

827

</sect2>

828

829

830

<title>Photo IDs</title>

831

<para>

832

Photo IDs allow a key owner to embed one or more pictures of themselves in a key.

833

These identities can be signed just like normal user IDs. A photo ID must be in JPEG

834

format and is recommended to be no larger than 240x288 pixels.</para>

835

<para>

836

If the chosen image is not of the required file type or size <application>Passwords and Keys</application>

837

can resize and convert it on the fly from

838

any image format supported by the <acronym>GDK</acronym> library.

839

</para>

840

</sect2>

841

842

843

<title>Changing the Passphrase</title>

844

<para>

845

To change the passphrase assigned to a key:

846

847

848

<para>

849

Select the key from the main window,

850

</para>

851

</listitem>

852

853

<para>

854

Double click on it or choose <guilabel>Properties</guilabel> from the toolbar,

855

</para>

856

</listitem>

857

858

<para>

859

Click on <guibutton>Change Passphrase</guibutton>.

860

</para>

861

</listitem>

862

</itemizedlist>

863

</para>

864

<para>

865

Enter the new passphrase and click <guibutton>OK</guibutton>.

866

</para>

867

</sect2>

868

869

870

<title>Deleting a Key</title>

871

<para>

872

To delete a key from your keyring:

873

874

875

<para>

876

Select the key from the main window,

877

</para>

878

</listitem>

879

880

<para>

881

Right click on it and choose <guilabel>Delete Key</guilabel>

882

or choose

883

884

885

<guimenuitem>Delete Key</guimenuitem>

886

</menuchoice>.

887

</para>

888

</listitem>

889

</itemizedlist>

890

</para>

891

<note>

892

<para>

893

You can delete your keys, trusted keys and collected keys.

894

</para>

895

</note>

896

</sect2>

897

</sect1>

898

899

900

901

902

<title>OpenPGP Subkey Properties</title>

903

<para>

904

Each OpenPGP key has a single master key used

905

to sign only. Subkeys are used to encrypt and

906

to sign as well. In this way, if your sub key is

907

compromised, you don't need to revoke your master key.

908

</para>

909

910

911

912

913

<para>

914

This is the identifier of the subkey.

915

</para>

916

</listitem>

917

</varlistentry>

918

919

920

921

<para>

922

Specifies the encryption algorithm used to generate a subkey.

923

<acronym>DSA</acronym> keys can only sign, ElGamal

924

keys are used to encrypt while <acronym>RSA</acronym> keys are

925

used to sign or to encrypt.

926

</para>

927

</listitem>

928

</varlistentry>

929

930

<term><guilabel>Created</guilabel></term>

931

932

<para>

933

Indicates the date the key was created.

934

</para>

935

</listitem>

936

</varlistentry>

937

938

<term><guilabel>Expires</guilabel></term>

939

940

<para>

941

Indicates the date the key can no longer be used.

942

</para>

943

</listitem>

944

</varlistentry>

945

946

<term><guilabel>Status</guilabel></term>

947

948

<para>

949

Indicates the status of the key.

950

</para>

951

</listitem>

952

</varlistentry>

953

954

<term><guilabel>Strength</guilabel></term>

955

956

<para>

957

Indicates the length in bits of the key. In general the longer the key, the more security it

958

provides.

959

<note>

960

<para>

961

A long key is not enough to make up for the use of a weak passphrase.

962

</para>

963

</note>

964

</para>

965

</listitem>

966

</varlistentry>

967

</variablelist>

968

969

970

<title>Adding a Subkey</title>

971

<para>

972

To add a subkey to a key, from the <guilabel>Subkeys</guilabel>

973

section click on <guibutton>Add</guibutton> button.

974

</para>

975

<para>

976

After following the instructions above, you will be presented with a

977

dialog to fill in. The fields are detailed below.

978

</para>

979

980

981

982

983

<para>

984

Specifies the encryption algorithm used to generate a subkey.

985

</para>

986

987

988

989

990

<para>

991

Use the <emphasis>Digital Signature Algorithm</emphasis>

992

(<acronym>DSA</acronym>) to create the subkey.

993

This subkey can sign only.

994

</para>

995

</listitem>

996

</varlistentry>

997

998

<term>ElGamal</term>

999

1000

<para>

1001

Use the <emphasis>ElGamal</emphasis> algorithm to create the subkey.

1002

This subkey can encrypt only.

1003

</para>

1004

</listitem>

1005

</varlistentry>

1006

1007

1008

1009

<para>

1010

Use the <emphasis>Rivest-Shamir Adleman</emphasis> (<acronym>RSA</acronym>)

1011

algorithm to create the subkey. This subkey can be used to sign or encrypt,

1012

but you have to create two different subkeys.

1013

</para>

1014

</listitem>

1015

</varlistentry>

1016

</variablelist>

1017

</listitem>

1018

</varlistentry>

1019

1020

<term>Key Length</term>

1021

1022

<para>

1023

Indicates the length in bits of the subkey.

1024

In general the longer the key, the more security it provides.

1025

</para>

1026

</listitem>

1027

</varlistentry>

1028

1029

<term>Expiration Date</term>

1030

1031

<para>

1032

Indicates the date the subkey can no longer be used.

1033

</para>

1034

</listitem>

1035

</varlistentry>

1036

</variablelist>

1037

</sect2>

1038

1039

1040

<title>Changing a Subkey Expiration Date</title>

1041

<para>

1042

To change a subkey expiration date, select

1043

the subkey from the <guilabel>Subkeys</guilabel>

1044

section, then:

1045

1046

1047

<para>

1048

Click on the <guibutton>Expire</guibutton> button on the left,

1049

</para>

1050

</listitem>

1051

1052

<para>

1053

From the date dialog choose the new expiration date or select

1054

<guilabel>Never expires</guilabel> for no expiration date.

1055

</para>

1056

</listitem>

1057

</itemizedlist>

1058

</para>

1059

</sect2>

1060

1061

1062

<title>Revoking a Subkey</title>

1063

<para>

1064

To revoke a subkey, select the subkey from the <guilabel>Subkeys</guilabel>

1065

section, then:

1066

1067

1068

<para>

1069

Click on the <guibutton>Revoke</guibutton> button on the left,

1070

</para>

1071

</listitem>

1072

1073

<para>

1074

Choose a reason why to revoke the subkey:

1075

</para>

1076

<para>

1077

1078

1079

<term>No Reason</term>

1080

1081

<para>

1082

There isn't a specific reason to revoke the key.

1083

</para>

1084

</listitem>

1085

</varlistentry>

1086

1087

<term>Compromised</term>

1088

1089

<para>

1090

The key has been compromised.

1091

</para>

1092

</listitem>

1093

</varlistentry>

1094

1095

<term>Superseded</term>

1096

1097

<para>

1098

The key has been superseded by another one.

1099

</para>

1100

</listitem>

1101

</varlistentry>

1102

1103

1104

1105

<para>

1106

The key is not used anymore.

1107

</para>

1108

</listitem>

1109

</varlistentry>

1110

</variablelist>

1111

</para>

1112

</listitem>

1113

1114

<para>

1115

Enter a description of why you are revoking the key,

1116

</para>

1117

</listitem>

1118

1119

<para>

1120

Click on <guibutton>Revoke</guibutton>.

1121

</para>

1122

</listitem>

1123

</itemizedlist>

1124

</para>

1125

<note>

1126

<para>

1127

The effect of revoking a subkey is immediate.

1128

</para>

1129

</note>

1130

</sect2>

1131

1132

1133

<title>Deleting a Subkey</title>

1134

<para>

1135

To delete a subkey, select the subkey from the <guilabel>Subkeys</guilabel>

1136

section, then:

1137

1138

1139

<para>

1140

Click on the <guibutton>Delete</guibutton> button on the left.

1141

</para>

1142

</listitem>

1143

</itemizedlist>

1144

</para>

1145

</sect2>

1146

</sect1>

1147

1148

1149

1150

1151

<title>Secure Shell Key Properties</title>

1152

<para>

1153

The descriptions in this section apply to all <acronym>SSH</acronym> keys.

1154

</para>

1155

<para>

1156

To view properties of a <acronym>SSH</acronym> key:

1157

1158

1159

<para>

1160

Select the Secure Shell key

1161

from the main window,

1162

</para>

1163

</listitem>

1164

1165

<para>

1166

Double click on it or choose <guilabel>Properties</guilabel>

1167

from the toolbar,

1168

</para>

1169

</listitem>

1170

1171

<para>

1172

Select the <guilabel>Details</guilabel> tab.

1173

</para>

1174

</listitem>

1175

</itemizedlist>

1176

</para>

1177

1178

1179

<title>Properties</title>

1180

<para>

1181

1182

1183

<term><guilabel>Fingerprint</guilabel></term>

1184

1185

<para>

1186

The fingerprint is a unique string of

1187

characters that exactly identifies a key.

1188

</para>

1189

</listitem>

1190

</varlistentry>

1191

1192

<term><guilabel>Algorithm</guilabel></term>

1193

1194

<para>

1195

Specifies the encryption algorithm used to

1196

generate a key.

1197

</para>

1198

</listitem>

1199

</varlistentry>

1200

1201

<term><guilabel>Location</guilabel></term>

1202

1203

<para>

1204

This is the location where the

1205

<emphasis>private key</emphasis>

1206

has been stored.

1207

</para>

1208

</listitem>

1209

</varlistentry>

1210

1211

<term><guilabel>Strength</guilabel></term>

1212

1213

<para>

1214

Indicates the length in bits of a key.

1215

In general the longer the key, the more

1216

security it provides.

1217

<note>

1218

<para>

1219

A long key is not enough to make up

1220

for the use of a weak passphrase.

1221

</para>

1222

</note>

1223

</para>

1224

</listitem>

1225

</varlistentry>

1226

</variablelist>

1227

</para>

1228

</sect2>

1229

1230

1231

<title>Deleting a Secure Shell Key</title>

1232

<para>

1233

To delete a Secure Shell key:

1234

1235

1236

<para>

1237

Select the <acronym>SSH</acronym> key from the main window,

1238

</para>

1239

</listitem>

1240

1241

<para>

1242

Right click on it and choose <guilabel>Delete key</guilabel> or choose

1243

1244

1245

<guimenuitem>Delete Key</guimenuitem>

1246

</menuchoice>.

1247

</para>

1248

</listitem>

1249

</itemizedlist>

1250

</para>

1251

</sect2>

1252

</sect1>

1253

1254

1255

1256

1257

<title>Importing Keys</title>

1258

<para>

1259

To import keys choose

1260

1261

1262

<guimenuitem>Import</guimenuitem>

1263

</menuchoice> and select, from the file chooser, a file containing at least one ASCII armored public key.

1264

</para>

1265

<para>

1266

Importing can also be performed by pasting the keys inside <application>Passwords and Keys</application>:

1267

1268

1269

<para>

1270

Select an ASCII armored public block of text,

1271

</para>

1272

</listitem>

1273

1274

<para>

1275

Copy it to the clipboard,

1276

</para>

1277

</listitem>

1278

1279

<para>

1280

Choose

1281

1282

1283

<guimenuitem>Paste Keys</guimenuitem>

1284

</menuchoice>.

1285

</para>

1286

</listitem>

1287

</itemizedlist>

1288

</para>

1289

</sect1>

1290

1291

1292

1293

1294

<title>Exporting Keys</title>

1295

<para>

1296

To export keys, select the keys in the main window

1297

and choose

1298

1299

1300

<guimenuitem>Export</guimenuitem>

1301

</menuchoice>.

1302

</para>

1303

<para>

1304

You can also export keys to the clipboard in an

1305

ASCII armored block of text:

1306

1307

1308

<para>

1309

Select the keys in the main window,

1310

</para>

1311

</listitem>

1312

1313

<para>

1314

Choose

1315

1316

1317

1318

</menuchoice>.

1319

</para>

1320

</listitem>

1321

</itemizedlist>

1322

</para>

1323

</sect1>

1324

1325

1326

1327

1328

1329

<title>Signing a Key</title>

1330

<para>

1331

Signing another person's key means you are giving trust to that person.

1332

Before signing a key, you have to carefully check the key's fingerprint

1333

to be sure that the key really belongs to that person.

1334

</para>

1335

<para>

1336

To sign a key in your keyring:

1337

1338

1339

<para>

1340

Select the key you want to sign from the

1341

<guilabel>Trusted Keys</guilabel> or

1342

<guilabel>Other Collected Keys</guilabel> tabs,

1343

</para>

1344

</listitem>

1345

1346

<para>

1347

Choose <guibutton>Sign</guibutton> from the toolbar

1348

or <menuchoice>

1349

1350

1351

</menuchoice>,

1352

</para>

1353

</listitem>

1354

1355

<para>

1356

Select how carefully the key has been checked,

1357

</para>

1358

</listitem>

1359

1360

<para>

1361

Indicate if the signature should be local to your keyring,

1362

and if your signature can be revoked,

1363

</para>

1364

</listitem>

1365

1366

<para>

1367

Click on <guibutton>Sign</guibutton>.

1368

</para>

1369

</listitem>

1370

</itemizedlist>

1371

</para>

1372

</sect1>

1373

1374

1375

1376

1377

<title>Preferences</title>

1378

<para>

1379

This section describes the preferences settable in <application>Passwords and Keys</application> by choosing

1380

1381

1382

<guimenuitem>Preferences</guimenuitem>

1383

</menuchoice> from within <application>Passwords and Keys</application>.

1384

</para>

1385

1386

1387

<title>Password Keyrings</title>

1388

<sect3>

1389

<title>Creating Keyrings</title>

1390

<para>

1391

To create a new keyring, from the menu choose <menuchoice><guimenu>File</guimenu><guimenuitem>New</guimenuitem></menuchoice> and choose <guibutton>Password Keyring</guibutton>. Enter a name for the new keyring, and press enter.

1392

</para>

1393

</sect3>

1394

<sect3>

1395

<title>Changing Keyring Passwords</title>

1396

<para>

1397

To change the unlock password of the keyring, first select the appropriate keyring and then

1398

press <guibutton>Change Unlock Password</guibutton> button. You will then be prompted to

1399

type the old password in the <guilabel>Old password</guilabel> text box, the new password in the

1400

<guilabel>New password</guilabel> text box and

1401

confirm it in the <guilabel>Confirm password</guilabel> text box.

1402

To apply the settings, press <guibutton>Change</guibutton>.

1403

If the old password is correct, you will get a status

1404

message indicating the success of the operation. If the

1405

old password is not correct you will be asked to check

1406

its correctness.

1407

</para>

1408

</sect3>

1409

<sect3>

1410

<title>Removing Keyrings</title>

1411

<para>

1412

To remove a keyring, first select the appropriate keyring and then

1413

from the menu choose <menuchoice><guimenu>Edit</guimenu> <guimenuitem>Delete</guimenuitem></menuchoice>.

1414

</para>

1415

</sect3>

1416

</sect2>

1417

1418

1419

<title>Key Servers</title>

1420

<para>

1421

Keep your and other's keys up to date by syncing keys periodically with

1422

remote keyservers. Syncing will make sure that you have the latest

1423

signatures made on all of your keys so that the web of trust will be the

1424

most useful.

1425

</para>

1426

<para>

1427

<application>Passwords and Keys</application> provides support for HKP and LDAP keyservers.

1428

</para>

1429

1430

1431

<term><emphasis>HKP Servers</emphasis></term>

1432

1433

<para>

1434

HKP keyservers are ordinary web based keyservers such as the

1435

popular <ulink url="hkp://pool.sks-keyservers.net" type="hkp">hkp://pool.sks-keyservers.net</ulink>, also accessible at

1436

<ulink url="http://sks-keyservers.net" type="http">http://sks-keyservers.net</ulink>.

1437

</para>

1438

</listitem>

1439

</varlistentry>

1440

1441

<term><emphasis><acronym>LDAP</acronym> Keyservers</emphasis></term>

1442

1443

<para>

1444

<acronym>LDAP</acronym> keyservers are less common, but use the standard LDAP

1445

protocol to serve keys.

1446

<ulink url="ldap://keyserver.pgp.com" type="ldap">ldap://keyserver.pgp.com</ulink> is a good LDAP

1447

server.

1448

</para>

1449

</listitem>

1450

</varlistentry>

1451

</variablelist>

1452

</sect2>

1453

1454

1455

<title>Key Sharing</title>

1456

<para>

1457

Key Sharing is provided by DNS-SD, also known as Bonjour or Rendevous.

1458

Enabling key sharing will add the local <application>Passwords and Keys</application> users' public key rings

1459

to the remote search dialog. Using these local "key servers" will most

1460

likely be faster than accessing remote servers.

1461

</para>

1462

</sect2>

1463

</sect1>

1464

1465

1466

1467

1468

<title>About Passwords and Keys</title>

1469

<para>

1470

<application>Passwords and Keys</application>, its associated plugins, the preferences applet and the panel

1471

applet are known collectively as Seahorse. Seahorse was written by Jacob Perkins. The current

1472

maintainers are Stef Walter and Adam Schreiber. This manual is by Adam Schreiber. The project's web

1473

site was designed by Jim Pharis. To find more information about Seahorse, the project , please visit

1474

the <ulink url="http://www.gnome.org/projects/seahorse/" type="http">Seahorse web page</ulink>.

1475

</para>

1476

<para>

1477

To report a bug or make a suggestion regarding this application or

1478

this manual, follow the directions in the

1479

<ulink url="ghelp:user-guide?feedback-bugs" type="help">Feedback section of the GNOME User Guide</ulink>.

1480

</para>

1481

<para>

1482

This program is distributed under the terms of the GNU

1483

General Public license as published by the Free Software

1484

Foundation; either version 2 of the License, or (at your option)

1485

any later version. A

1486

<ulink url="ghelp:gpl" type="help">copy of this license</ulink>

1487

is included with this documentation; another can be found in the file

1488

COPYING included with the source code of this program.

1489

</para>

1490

</sect1>

1491

</article>