## SYNOPSIS

           gpg  [--homedir name]  [--options file]  [options]  command  [args]

## DESCRIPTION

           gpg is the main program for the GnuPG system.

           This  man  page only lists the commands and options avail
           able.  For more verbose documentation get the GNU  Privacy
           Handbook   (GPH)   or   one  of  the  other  documents  at
           http://www.gnupg.org/docs.html .

           Please remember that option parsing stops as soon as a non
           option  is  encountered,  you  can  explicitly stop option
           parsing by using the special option "--".

## COMMANDS

           gpg recognizes these commands:

           -s, --sign
                     Make a signature. This command may  be  combined
                     with --encrypt.

           --clearsign
                     Make a clear text signature.

           -b, --detach-sign
                     Make a detached signature.

           -e, --encrypt
                     Encrypt  data.  This option may be combined with
                     --sign.

           -c, --symmetric
                     Encrypt with symmetric cipher only.   This  com
                     mand asks for a passphrase.

           --store   Store only (make a simple RFC1991 packet).

           --decrypt [file]
                     Decrypt  file (or stdin if no file is specified)
                     and write it to stdout (or  the  file  specified
                     with --output). If the decrypted file is signed,
                     the signature is  also  verified.  This  command
                     differs  from the default operation, as it never
                     writes to the filename which is included in  the
                     file and it rejects files which don't begin with
                     an encrypted message.

           --verify [[sigfile]  [signed-files]]
                     Assume that sigfile is a signature and verify it
                     without  generating  any output.   With no argu
                     This  is  a special version of the --verify com
                     mand which does not work  with  detached  signa
                     tures.  The command expects the files to be ver
                     ified either on the command line  or  reads  the
                     filenames from stdin;  each name must be on sep
                     arate line. The command is  intended  for  quick
                     checking of many files.

           --encrypt-files [files]
                     This  is a special version of the --encrypt com
                     mand.  The  command  expects  the  files  to  be
                     encrypted  either  on  the command line or reads
                     the filenames from stdin; each name must  be  on
                     separate  line.  The  command  is intended for a
                     quick encryption of multiple files.

           --decrypt-files [files]
                     The same as --encrypt-files with the  difference
                     that  files will be decrypted. The syntax or the
                     filenames is the same.

           --list-keys [names]

           --list-public-keys [names]
                     List all keys from the public keyrings, or  just
                     the ones given on the command line.

           --list-secret-keys [names]
                     List  all keys from the secret keyrings, or just
                     the ones given on the command line.  A '#' after
                     the  letters  'sec' means that the secret key is
                     not usable (for example, if it was  created  via
                     --export-secret-subkeys).

           --list-sigs [names]
                     Same  as  --list-keys,  but  the  signatures are
                     listed too.

           --check-sigs [names]
                     Same as --list-sigs, but the signatures are ver
                     ified.

           --fingerprint [names]
                     List  all  keys with their fingerprints. This is
                     the same output  as  --list-keys  but  with  the
                     additional  output  of  a  line with the finger
                     print. May also be combined with --list-sigs  or
                     --check-sigs.   If  this command is given twice,
                     the  fingerprints  of  all  secondary  keys  are
                     listed too.

           --list-packets

                     sign      Make  a  signature on key of user name
                               If the key is not yet  signed  by  the
                               default  user (or the users given with
                               -u), the program displays the informa
                               tion  of  the key again, together with
                               its fingerprint and  asks  whether  it
                               should  be  signed.  This  question is
                               repeated for all users specified  with
                               -u.

                     lsign     Same  as  --sign  but the signature is
                               marked  as  non-exportable  and   will
                               therefore  never  be  used  by others.
                               This may be used to  make  keys  valid
                               only in the local environment.

                     nrsign    Same  as  --sign  but the signature is
                               marked as non-revocable and can there
                               fore never be revoked.

                     nrlsign   Combines  the  functionality of nrsign
                               and lsign to make a signature that  is
                               both non-revocable and non-exportable.

                     revsig    Revoke a signature.  For every  signa
                               ture  which  has been generated by one
                               of the secret keys, GnuPG asks whether
                               a  revocation  certificate  should  be
                               generated.

                     trust     Change the  owner  trust  value.  This
                               updates  the  trust-db immediately and
                               no save is required.

                     disable

                     enable    Disable or enable  an  entire  key.  A
                               disabled  key can normally not be used
                               for encryption.

                     adduid    Create an alternate user id.

                     addphoto  Create a photographic user id.

                     deluid    Delete a user id.

                     addkey    Add a subkey to this key.

                     delkey    Remove a subkey.

                     addrevoker
                     passwd    Change the passphrase  of  the  secret
                               key.

                     primary   Flag  the  current user id as the pri
                               mary one, removes the primary user  id
                               flag  from all other user ids and sets
                               the timestamp of  all  affected  self-
                               signatures  one  second  ahead.   Note
                               that setting a photo user ID  as  pri
                               mary makes it primary over other photo
                               user IDs, and setting a  regular  user
                               ID  as  primary  makes it primary over
                               other regular user IDs.

                     uid n     Toggle selection of user id with index
                               n.  Use 0 to deselect all.

                     key n     Toggle  selection of subkey with index
                               n.  Use 0 to deselect all.

                     check     Check all selected user ids.

                     showphoto Display the selected photographic user
                               id.

                     pref      List  preferences  from  the  selected
                               user ID.  This shows the actual  pref
                               erences, without including any implied
                               preferences.

                     showpref  More verbose preferences  listing  for
                               the  selected user ID.  This shows the
                               preferences in effect by including the
                               implied  preferences of 3DES (cipher),
                               SHA-1 (digest), and Uncompressed (com
                               pression)  if  they  are  not  already
                               included in the preference list.

                     setpref string
                               Set the list of user ID preferences to
                               string,  this should be a string simi
                               lar to  the  one  printed  by  "pref".
                               Using  an  empty  string  will set the
                               default   preference   string,   using
                               "none"  will  set  the  preferences to
                               nil.  Use "gpg -v --version" to get  a
                               list  of  available  algorithms.  This
                               command just initializes  an  internal
                               list  and  does  not  change  anything
                               unless  another   command   (such   as
                               "updpref") which changes the self-sig
                               natures is used.
                               listing.

                     save      Save  all changes to the key rings and
                               quit.

                     quit      Quit the program without updating  the
                               key rings.

                     The listing shows you the key with its secondary
                     keys and all user ids. Selected keys or user ids
                     are indicated by an asterisk. The trust value is
                     displayed with the primary key: the first is the
                     assigned  owner trust and the second is the cal
                     culated trust value.  Letters are used  for  the
                     values:

                     -         No  ownertrust assigned / not yet cal
                               culated.

                     e         Trust calculation has failed; probably
                               due to an expired key.

                     q         Not  enough  information  for calcula
                               tion.

                     n         Never trust this key.

                     m         Marginally trusted.

                     f         Fully trusted.

                     u         Ultimately trusted.

           --sign-key name
                     Signs a public key with your secret key. This is
                     a shortcut version of the subcommand "sign" from
                     --edit.

           --lsign-key name
                     Signs a public key  with  your  secret  key  but
                     marks  it as non-exportable.  This is a shortcut
                     version of the subcommand "lsign" from --edit.

           --nrsign-key name
                     Signs a public key  with  your  secret  key  but
                     marks  it  as non-revocable.  This is a shortcut
                     version of the subcommand "nrsign" from  --edit.

           --delete-key name
                     Remove  key  from  the public keyring.  In batch
                     mode either --yes is required or the key must be
                     specified  by  fingerprint.  This is a safeguard
                     plete  key.  To  revoke a subkey or a signature,
                     use the --edit command.

           --desig-revoke
                     Generate a designated revocation certificate for
                     a  key.  This allows a user (with the permission
                     of the keyholder) to revoke someone elses key.

           --export [names]
                     Either  export  all  keys  from   all   keyrings
                     (default   keyrings  and  those  registered  via
                     option --keyring), or if at least  one  name  is
                     given,  those of the given name. The new keyring
                     is written to stdout or to the file  given  with
                     option  "output".   Use together with --armor to
                     mail those keys.

           --send-keys [names]
                     Same as --export but sends the keys  to  a  key
                     server.  Option --keyserver must be used to give
                     the name of this keyserver. Don't send your com
                     plete keyring to a keyserver - select only those
                     keys which are new or changed by you.

           --export-all [names]
                     Same as --export, but also  exports  keys  which
                     are not compatible with OpenPGP.

           --export-secret-keys [names]

           --export-secret-subkeys [names]
                     Same  as  --export,  but exports the secret keys
                     instead.  This is normally not very useful and a
                     security  risk.   The second form of the command
                     has the special property to  render  the  secret
                     part  of  the primary key useless; this is a GNU
                     extension to OpenPGP and  other  implementations
                     can  not be expected to successfully import such
                     a key.

                     See the option --simple-sk-checksum if you  want
                     to  import  such  an  exported key with an older
                     OpenPGP implementation.

           --import [files]

           --fast-import [files]
                     Import/merge keys. This adds the given  keys  to
                     the keyring.  The fast version is currently just
                     a synonym.

                     There are a few other options which control  how
                     tures,  user  IDs, etc.  Option --keyserver must
                     be used to give the name of this keyserver.

           --search-keys [names]
                     Search the keyserver for the given names.   Mul
                     tiple  names  given here will be joined together
                     to create the search string for  the  keyserver.
                     Option --keyserver must be used to give the name
                     of this keyserver.

           --update-trustdb
                     Do trust DB maintenance.  This command goes over
                     all keys and builds the Web-of-Trust. This is an
                     interactive command because it may  has  to  ask
                     for  the  "ownertrust" values of keys.  The user
                     has to give an estimation in how far she  trusts
                     the owner of the displayed key to correctly cer
                     tify (sign) other keys.  It does  only  ask  for
                     that  value if it has not yet been assigned to a
                     key.  Using the edit menu,  that  value  can  be
                     changed at any time later.

           --check-trustdb
                     Do  trust  DB  maintenance without user interac
                     tion.  Form time to time the trust database must
                     be  updated  so  that expired keys and resulting
                     changes in  the  Web-of-Trust  can  be  tracked.
                     GnuPG  tries to figure when this is required and
                     then does it implicitly;  this  command  can  be
                     used  to  force such a check.  The processing is
                     identically to that of --update-trustdb  but  it
                     skips  keys with a not yet defined "ownertrust".

                     For use with cron jobs, this command can be used
                     together with --batch in which case the check is
                     only done when it is due.  To force a  run  even
                     in batch mode add the option --yes.

           --export-ownertrust [file]
                     Store  the ownertrust values into file (or stdin
                     if not given).  This is useful for  backup  pur
                     poses  as  these  values are the only ones which
                     can't be re-created from a corrupted trust DB.

           --import-ownertrust [files]
                     Update the trustdb with  the  ownertrust  values
                     stored  in files (or stdin if not given); exist
                     ing values will be overwritten.

           --rebuild-keydb-caches
                     When updating from version 1.0.6 to  1.0.7  this
                     command  should  be  used  to  create  signature
                     sequence  of  random  bytes  will  be   emitted.
                     PLEASE,  don't  use this command unless you know
                     what you  are  doing;  it  may  remove  precious
                     entropy from the system!

           --gen-prime mode                  bits             [qbits]
                     Use  the  source, Luke :-). The output format is
                     still subject to change.

           --version Print version information along with a  list  of
                     supported algorithms.

           --warranty
                     Print warranty information.

           -h, --help
                     Print  usage information.  This is a really long
                     list even though it doesn't list all options.

## OPTIONS

           Long options can  be  put  in  an  options  file  (default
           "~/.gnupg/gpg.conf").   Short option names will not work -
           for example, "armor" is a valid  option  for  the  options
           file,  while  "a"  is not.  Do not write the 2 dashes, but
           simply the name of the option and any required  arguments.
           Lines with a hash ('#') as the first non-white-space char
           acter are ignored.  Commands may be put in this file  too,
           but that does not make sense.

           gpg recognizes these options:

           -a, --armor
                     Create ASCII armored output.

           -o, --output file
                     Write output to file.

           --no-mangle-dos-filenames

           --mangle-dos-filenames
                     The  Windows  version of GPG replaces the exten
                     sion of an output  filename  to  avoid  problems
                     with  filenames  containing  more  than one dot.
                     This is not necessary for newer Windows  version
                     and  such  --no-mangle-dos-filenames can be used
                     to switch this feature off and have  GPG  append
                     the new extension.   This otion has no effect on
                     non-windows platforms.

           -u, --local-user name
                     Use name as the user ID to sign.  This option is
                     silently  ignored for the list commands, so that
                     Use name as default recipient if option --recip
                     ient  is  not  used  and  don't ask if this is a
                     valid one. name must be non-empty.

           --default-recipient-self
                     Use the default  key  as  default  recipient  if
                     option  --recipient is not used and don't ask if
                     this is a valid one.  The  default  key  is  the
                     first one from the secret keyring or the one set
                     with --default-key.

           --no-default-recipient
                     Reset --default-recipient and  --default-recipi
                     ent-self.

           --encrypt-to name
                     Same as --recipient but this one is intended for
                     use in the options file and  may  be  used  with
                     your own user-id as an "encrypt-to-self".  These
                     keys are only used when there are other  recipi
                     ents  given  either  by use of --recipient or by
                     the asked user id.  No trust  checking  is  per
                     formed for these user ids and even disabled keys
                     can be used.

           --no-encrypt-to
                     Disable the use of all --encrypt-to keys.

           -v, --verbose
                     Give more information during processing. If used
                     twice, the input data is listed in detail.

           -q, --quiet
                     Try to be as quiet as possible.

           -z n, --compress n
                     Set  compression  level to n. A value of 0 for n
                     disables compression.  Default  is  to  use  the
                     default  compression level of zlib (normally 6).

           -t, --textmode
                     Use  canonical  text  mode.   If  -t  (but   not
                     --textmode)  is  used together with armoring and
                     signing,  this  enables  clearsigned   messages.
                     This  kludge  is  needed  for PGP compatibility;
                     normally you would use --sign or --clearsign  to
                     selected the type of the signature.

           -n, --dry-run
                     Don't  make  any changes (this is not completely
                     implemented).

           --yes     Assume "yes" on most questions.

           --no      Assume "no" on most questions.

           --default-cert-check-level n
                     The  default  to  use  for  the check level when
                     signing a key.

                     0 means you make no particular claim as  to  how
                     carefully you verified the key.

                     1 means you believe the key is owned by the per
                     son who claims to own it but you could  not,  or
                     did  not  verify the key at all.  This is useful
                     for a "persona" verification, where you sign the
                     key of a pseudonymous user.

                     2  means you did casual verification of the key.
                     For example, this could mean that  you  verified
                     that the key fingerprint and checked the user ID
                     on the key against a photo ID.

                     3 means you did extensive  verification  of  the
                     key.  For example, this could mean that you ver
                     ified the key fingerprint with the owner of  the
                     key in person, and that you checked, by means of
                     a hard to forge document with a photo  ID  (such
                     as  a  passport)  that the name of the key owner
                     matches the name in the user ID on the key,  and
                     finally that you verified (by exchange of email)
                     that the email address on the key belongs to the
                     key owner.

                     Note  that the examples given above for levels 2
                     and 3 are just that: examples.  In the  end,  it
                     is  up  to  you to decide just what "casual" and
                     "extensive" mean to you.

                     This option defaults to 0.

           --trusted-key long key ID
                     Assume that the specified  key  (which  must  be
                     given  as a  full 8 byte key ID) is as trustwor
                     thy as one of your own secret keys. This  option
                     is  useful if you don't want to keep your secret
                     keys (or one of them) online but still  want  to
                     be able to check the validity of a given recipi
                     ent's or signator's key.

           --trust-model classic|always
                     Set what trust model GnuPG should  follow.   The
                               key.

           --always-trust
                     Identical to `--trust-model always'

           --keyserver name
                     Use name as your keyserver.  This is the  server
                     that --recv-keys, --send-keys, and --search-keys
                     will communicate with to receive keys from, send
                     keys  to, and search for keys on.  The format of
                     the  name  is  a   URI:   `scheme:[//]keyserver
                     name[:port]'  The  scheme  is  the  type of key
                     server: "hkp" for the Horowitz  (or  compatible)
                     keyservers,  "ldap"  for the NAI LDAP keyserver,
                     or "mailto" for the  Horowitz  email  keyserver.
                     Note  that your particular installation of GnuPG
                     may have  other  keyserver  types  available  as
                     well.  Keyserver schemes are case-insensitive.

                     Most  keyservers synchronize with each other, so
                     there is generally no need to send keys to  more
                     than  one  server.   Using  the command "host -l
                     pgp.net | grep wwwkeys" gives you a list of  HKP
                     keyservers.   When  using  one  of  the  wwwkeys
                     servers, due to load balancing using round-robin
                     DNS  you may notice that you get a different key
                     server each time.

           --keyserver-options parameters
                     This is a space or comma delimited  string  that
                     gives options for the keyserver.  Options can be
                     prepended with a  `no-'  to  give  the  opposite
                     meaning.  Valid import-options or export-options
                     may be used here as well to apply  to  importing
                     (--recv-key)  or  exporting  (--send-key)  a key
                     from a keyserver.  While  not  all  options  are
                     available  for  all keyserver types, some common
                     options are:

                     include-revoked
                               When  searching   for   a   key   with
                               --search-keys,  include  keys that are
                               marked on the  keyserver  as  revoked.
                               Note  that  this  option is always set
                               when using the NAI HKP  keyserver,  as
                               this  keyserver does not differentiate
                               between revoked and unrevoked keys.

                     include-disabled
                               When  searching   for   a   key   with
                               --search-keys,  include  keys that are
                               marked on the keyserver  as  disabled.
                               efficient  method.  This option forces
                               GnuPG to use temporary files to commu
                               nicate.   On  some  platforms (such as
                               Win32 and RISC  OS),  this  option  is
                               always enabled.

                     keep-temp-files
                               If   using  `use-temp-files',  do  not
                               delete  the  temp  files  after  using
                               them.   This option is useful to learn
                               the keyserver  communication  protocol
                               by reading the temporary files.

                     verbose   Tell  the  keyserver helper program to
                               be more verbose.  This option  can  be
                               repeated  multiple  times  to increase
                               the verbosity level.

                     honor-http-proxy
                               For keyserver schemes  that  use  HTTP
                               (such  as HKP), try to access the key
                               server over the  proxy  set  with  the
                               environment variable "http_proxy".

                     auto-key-retrieve
                               This   option  enables  the  automatic
                               retrieving of keys  from  a  keyserver
                               when verifying signatures made by keys
                               that are not on the local keyring.

           --import-options parameters
                     This is a space or comma delimited  string  that
                     gives  options  for importing keys.  Options can
                     be prepended with a `no-' to give  the  opposite
                     meaning.  The options are:

                     allow-local-sigs
                               Allow  importing key signatures marked
                               as "local".   This  is  not  generally
                               useful  unless a shared keyring scheme
                               is being used.  Defaults to no.

                     repair-hkp-subkey-bug
                               During import, attempt to  repair  the
                               HKP  keyserver  mangling multiple sub
                               keys bug.  Note that this cannot  com
                               pletely repair the damaged key as some
                               crucial data is removed  by  the  key
                               server,  but it does at least give you
                               back one subkey.  Defaults to  no  for
                               regular  --import  and to yes for key
                               server --recv-keys.
                               useful unless a shared keyring  scheme
                               is being used.  Defaults to no.

                     include-attributes
                               Include attribute user IDs (photo IDs)
                               while exporting.  This  is  useful  to
                               export  keys  if  they are going to be
                               used by an OpenPGP program  that  does
                               not   accept   attribute   user   IDs.
                               Defaults to yes.

                     include-sensitive-revkeys
                               Include designated revoker information
                               that   was   marked   as  "sensitive".
                               Defaults to no.

           --show-photos
                     Causes --list-keys, --list-sigs,  --list-public-
                     keys, --list-secret-keys, and verifying a signa
                     ture to also display the photo  ID  attached  to
                     the key, if any.  See also --photo-viewer.

           --no-show-photos
                     Resets the --show-photos flag.

           --photo-viewer string
                     This  is  the command line that should be run to
                     view a photo ID.  "%i" will  be  expanded  to  a
                     filename  containing  the  photo.  "%I" does the
                     same, except the file will not be  deleted  once
                     the  viewer exits.  Other flags are "%k" for the
                     key ID, "%K" for the long key ID, "%f"  for  the
                     key  fingerprint,  "%t" for the extension of the
                     image type (e.g. "jpg"), "%T" for the MIME  type
                     of  the  image (e.g. "image/jpeg"), and "%%" for
                     an actual percent sign.  If neither %i or %I are
                     present,  then the photo will be supplied to the
                     viewer on standard input.

                     The default viewer is "xloadimage  -fork  -quiet
                     -title 'KeyID 0x%k' stdin"

           --exec-path string
                     Sets  a  list of directories to search for photo
                     viewers and keyserver helpers.  If not provided,
                     keyserver  helpers  use  the compiled-in default
                     directory, and photo viewers use the $PATH envi
                     ronment variable.

           --show-keyring
                     Causes   --list-keys,   --list-public-keys,  and
                     --list-secret-keys to display the  name  of  the

                     It might make sense  to  use  it  together  with
                     --no-default-keyring.

           --secret-keyring file
                     Same as --keyring but for the secret keyrings.

           --homedir directory
                     Set  the name of the home directory to directory
                     If this  option  is  not  used  it  defaults  to
                     "~/.gnupg".  It  does not make sense to use this
                     in a options file. This also overrides the envi
                     ronment variable "GNUPGHOME".

           --charset name
                     Set  the name of the native character set.  This
                     is used to convert some strings to proper  UTF-8
                     encoding.  If  this  option  is  not  used,  the
                     default character set  is  determined  from  the
                     current  locale.   A  verbosity level of 3 shows
                     the used one.  Valid values for name are:

                     iso-8859-1
                               This is the Latin 1 set.

                     iso-8859-2
                               The Latin 2 set.

                     iso-8859-15
                               This is currently  an  alias  for  the
                               Latin 1 set.

                     koi8-r    The usual Russian set (rfc1489).

                     utf-8     Bypass  all  translations  and  assume
                               that the OS uses native  UTF-8  encod
                               ing.

           --utf8-strings

           --no-utf8-strings
                     Assume  that  the arguments are already given as
                     UTF8 strings.  The  default  (--no-utf8-strings)
                     is  to  assume that arguments are encoded in the
                     character set as specified by  --charset.  These
                     options  affect  all  following arguments.  Both
                     options may be used multiple times.

           --options file
                     Read options from file and do not  try  to  read
                     them  from the default options file in the home
                     dir (see --homedir). This option is  ignored  if
                     option is deprecated.

           --debug flags
                     Set  debugging  flags.  All  flags are or-ed and
                     flags may be given in C syntax (e.g. 0x0042).

           --debug-all
                     Set all useful debugging flags.

           --status-fd n
                     Write  special  status  strings  to   the   file
                     descriptor n.  See the file DETAILS in the docu
                     mentation for a listing of them.

           --logger-fd n
                     Write log output to file descriptor n and not to
                     stderr.

           --attribute-fd n
                     Write  attribute subpackets to the file descrip
                     tor n.  This is most useful for use with  --sta
                     tus-fd,  since the status messages are needed to
                     separate out the  various  subpackets  from  the
                     stream delivered to the file descriptor.

           --sk-comments
                     Include  secret key comment packets when export
                     ing secret keys.  This is a GnuPG  extension  to
                     the  OpenPGP  standard,  and  is off by default.
                     Please note that this has nothing to do with the
                     comments in clear text signatures or armor head
                     ers.

           --no-sk-comments
                     Resets the --sk-comments option.

           --no-comment
                     See --sk-comments.  This  option  is  deprecated
                     and may be removed soon.

           --comment string
                     Use  string as comment string in clear text sig
                     natures.  The default is not do write a  comment
                     string.

           --default-comment
                     Force  to  write  the standard comment string in
                     clear text signatures.  Use this to overwrite  a
                     --comment  from  a  config file.  This option is
                     now obsolete because there is no default comment
                     string anymore.

                     Put the name value pair into  the  signature  as
                     notation data.  name must consist only of print
                     able characters or spaces, and  must  contain  a
                     '@'  character.   This is to help prevent pollu
                     tion of the IETF  reserved  notation  namespace.
                     The --expert flag overrides the encoded in UTF8,
                     so you should check that your --charset  is  set
                     correctly.   If you prefix name with an exclama
                     tion mark, the notation data will be flagged  as
                     critical   (rfc2440:5.2.3.15).    --sig-notation
                     sets a notation for  data  signatures.   --cert-
                     notation  sets  a  notation  for  key signatures
                     (certifications).  --notation-data sets both.

                     There are special codes  that  may  be  used  in
                     notation  names.  "%k" will be expanded into the
                     key ID of the key being  signed,  "%K"  for  the
                     long  key  ID  of the key being signed, "%f" for
                     the key fingerprint of  the  key  being  signed,
                     "%s" for the key ID of the key making the signa
                     ture, "%S" for the long key ID of the key making
                     the signature, and "%%" results in a single "%".
                     %k, %K, and %f are only meaningful when making a
                     key signature (certification).

           --show-notation
                     Show  signature  notations in the --list-sigs or
                     --check-sigs listings as well as when  verifying
                     a signature with a notation in it.

           --no-show-notation
                     Do not show signature notations.

           --sig-policy-url string

           --cert-policy-url string

           --set-policy-url string
                     Use   string   as   Policy  URL  for  signatures
                     (rfc2440:5.2.3.19).  If you prefix  it  with  an
                     exclamation  mark, the policy URL packet will be
                     flagged as critical.  --sig-policy-url sets a  a
                     policy  url for data signatures.  --cert-policy-
                     url sets a policy url for key signatures (certi
                     fications).  -set-policy-url sets both.

                     The  same  %-expandos used for notation data are
                     available here as well.

           --show-policy-url
                     Show policy URLs in the --list-sigs or  --check-
                     sigs listings as well as when verifying a signa
                     resistant  font  to  display  the message.  This
                     option overrides --set-filename.

           --no-for-your-eyes-only
                     Resets the --for-your-eyes-only flag.

           --use-embedded-filename
                     Try to create a file with a name as embedded  in
                     the  data.  This can be a dangerous option as it
                     allows to overwrite files.

           --completes-needed n
                     Number of completely trusted users to  introduce
                     a new key signer (defaults to 1).

           --marginals-needed n
                     Number  of marginally trusted users to introduce
                     a new key signer (defaults to 3)

           --max-cert-depth n
                     Maximum depth of a certification chain  (default
                     is 5).

           --cipher-algo name
                     Use   name as cipher algorithm. Running the pro
                     gram with the command --version yields a list of
                     supported  algorithms.  If  this is not used the
                     cipher algorithm is selected  from  the  prefer
                     ences stored with the key.

           --digest-algo name
                     Use  name  as the message digest algorithm. Run
                     ning the  program  with  the  command  --version
                     yields a list of supported algorithms.

           --cert-digest-algo name
                     Use  name  as  the message digest algorithm used
                     when signing a key.  Running  the  program  with
                     the command --version yields a list of supported
                     algorithms.  Be aware  that  if  you  choose  an
                     algorithm  that GnuPG supports but other OpenPGP
                     implementations do not, then some users will not
                     be  able  to use the key signatures you make, or
                     quite possibly your entire key.

           --s2k-cipher-algo name
                     Use name as the cipher algorithm used to protect
                     secret keys.  The default cipher is CAST5.  This
                     cipher is also used for conventional  encryption
                     if --cipher-algo is not given.

           --s2k-digest-algo name
           --simple-sk-checksum
                     Secret keys are integrity protected by  using  a
                     SHA-1  checksum.  This method will be part of an
                     enhanced OpenPGP specification but GnuPG already
                     uses  it  as  a  countermeasure  against certain
                     attacks.  Old applications don't understand this
                     new format, so this option may be used to switch
                     back to the  old  behaviour.   Using  this  this
                     option  bears  a security risk.  Note that using
                     this option only takes effect  when  the  secret
                     key is encrypted - the simplest way to make this
                     happen is to change the passphrase  on  the  key
                     (even  changing  it to the same value is accept
                     able).

           --compress-algo n
                     Use compression algorithm n.   The  value  2  is
                     RFC1950   ZLIB  compression.   The  value  1  is
                     RFC-1951 ZIP compression which is used  by  PGP.
                     0  disables  compression.  If this option is not
                     used, the default behavior  is  to  examine  the
                     recipient  key  preferences  to  see which algo
                     rithms the  recipient  supports.   If  all  else
                     fails,  ZIP  is  used for maximum compatibility.
                     Note, however, that ZLIB may  give  better  com
                     pression  results  if that is more important, as
                     the compression window size is  not  limited  to
                     8k.

           --disable-cipher-algo name
                     Never allow the use of name as cipher algorithm.
                     The given name will not be  checked  so  that  a
                     later  loaded algorithm will still get disabled.

           --disable-pubkey-algo name
                     Never allow the use of name as public key  algo
                     rithm.   The  given  name will not be checked so
                     that a later loaded  algorithm  will  still  get
                     disabled.

           --no-sig-cache
                     Do not cache the verification status of key sig
                     natures.  Caching gives a  much  better  perfor
                     mance  in key listings.  However, if you suspect
                     that your public keyring  is  not  save  against
                     write  modifications, you can use this option to
                     disable the caching.  It probably does not  make
                     sense  to  disable it because all kind of damage
                     can be done if someone else has write access  to
                     your public keyring.

           --no-sig-create-check
                     This may be a time consuming process.

           --no-auto-check-trustdb
                     Resets the --auto-check-trustdb option.

           --throw-keyid
                     Do not put the  keyid  into  encrypted  packets.
                     This  option  hides  the receiver of the message
                     and is a countermeasure against  traffic  analy
                     sis.   It  may  slow down the decryption process
                     because all available secret keys are tried.

           --not-dash-escaped
                     This option changes the  behavior  of  cleartext
                     signatures  so  that  they can be used for patch
                     files. You should not send such an armored  file
                     via  email  because  all spaces and line endings
                     are hashed too.  You can not use this option for
                     data  which  has  5 dashes at the beginning of a
                     line, patch files don't  have  this.  A  special
                     armor header line tells GnuPG about this cleart
                     ext signature option.

           --escape-from-lines
                     Because some mailers change lines starting  with
                     "From  "  to  "<From " it is good to handle such
                     lines in a special way when  creating  cleartext
                     signatures.  All  other  PGP versions do it this
                     way too. This option is not enabled  by  default
                     because it would violate rfc2440.

           --passphrase-fd n
                     Read  the  passphrase from file descriptor n. If
                     you use 0 for n, the  passphrase  will  be  read
                     from  stdin.     This  can  only be used if only
                     one passphrase  is  supplied.   Don't  use  this
                     option if you can avoid it.

           --command-fd n
                     This is a replacement for the deprecated shared-
                     memory IPC mode.  If  this  option  is  enabled,
                     user input on questions is not expected from the
                     TTY but from  the  given  file  descriptor.   It
                     should  be  used  together with --status-fd. See
                     the file doc/DETAILS in the source  distribution
                     for details on how to use it.

           --use-agent
                     Try  to  use  the  GnuPG-Agent. Please note that
                     this agent is  still  under  development.   With
                     this option, GnuPG first tries to connect to the
                     agent before it asks for a passphrase.
                     but the MIT release is a good common baseline.

                     This  option  implies  `--rfc1991   --no-openpgp
                     --disable-mdc  --no-force-v4-certs  --no-comment
                     --escape-from-lines  --force-v3-sigs   --no-ask-
                     sig-expire   --no-ask-cert-expire  --cipher-algo
                     IDEA --digest-algo MD5 --compress-algo  1'.   It
                     also disables --textmode when encrypting.

           --no-pgp2 Resets the --pgp2 option.

           --pgp6    Set  up  all options to be as PGP 6 compliant as
                     possible.  This restricts  you  to  the  ciphers
                     IDEA  (if  the  IDEA plugin is installed), 3DES,
                     and CAST5, the hashes MD5, SHA1  and  RIPEMD160,
                     and  the  compression  algorithms  none and ZIP.
                     This also  disables  --throw-keyid,  and  making
                     signatures  with  signing  subkeys as PGP 6 does
                     not understand signatures made by  signing  sub
                     keys.

                     This  option implies `--disable-mdc --no-comment
                     --escape-from-lines  --force-v3-sigs   --no-ask-
                     sig-expire --compress-algo 1'

           --no-pgp6 Resets the --pgp6 option.

           --pgp7    Set  up  all options to be as PGP 7 compliant as
                     possible.  This is identical  to  --pgp6  except
                     that  MDCs  are  not  disabled,  and the list of
                     allowable ciphers is  expanded  to  add  AES128,
                     AES192, AES256, and TWOFISH.

           --no-pgp7 Resets the --pgp7 option.

           --pgp8    Set  up  all options to be as PGP 8 compliant as
                     possible.  PGP 8 is a lot closer to the  OpenPGP
                     standard  than  previous versions of PGP, so all
                     this  does  is  disable  --throw-keyid  and  set
                     --escape-from-lines  and --compress-algo 1.  The
                     allowed algorithms list is the same as --pgp7.

           --no-pgp8 Resets the --pgp8 option.

           --openpgp Reset all packet, cipher and digest  options  to
                     OpenPGP  behavior.  Use this option to reset all
                     previous  options   like   --rfc1991,   --force-
                     v3-sigs,  --s2k-*,  --cipher-algo, --digest-algo
                     and --compress-algo to OpenPGP compliant values.
                     All PGP workarounds are also disabled.

           --force-v3-sigs
                     rithm for v3 RSA keys from MD5 to SHA-1.

           --no-force-v4-certs
                     Reset the --force-v4-certs option.

           --force-mdc
                     Force  the use of encryption with a modification
                     detection code.  This is always  used  with  the
                     newer  ciphers  (those  with a blocksize greater
                     than 64 bits), or if the recipient key  has  one
                     of those ciphers as a preference.

           --disable-mdc
                     Disable  the  use  of the modification detection
                     code.  Note  that  by  using  this  option,  the
                     encrypted  message  becomes vulnerable to a mes
                     sage modification attack.

           --allow-non-selfsigned-uid
                     Allow the import and use of keys with  user  IDs
                     which  are  not self-signed.  This is not recom
                     mended, as a non self-signed user ID is  trivial
                     to forge.

           --no-allow-non-selfsigned-uid
                     Reset the --allow-non-selfsigned-uid option.

           --allow-freeform-uid
                     Disable  all  checks  on the form of the user ID
                     while generating a new one.  This option  should
                     only  be used in very special environments as it
                     does not ensure the de-facto standard format  of
                     user IDs.

           --ignore-time-conflict
                     GnuPG  normally checks that the timestamps asso
                     ciated with keys and signatures  have  plausible
                     values.  However, sometimes a signature seems to
                     be older than the key  due  to  clock  problems.
                     This option makes these checks just a warning.

           --ignore-valid-from
                     GnuPG  normally  does not select and use subkeys
                     created in the future.  This option  allows  the
                     use of such keys and thus exhibits the pre-1.0.7
                     behaviour.   You  should  not  use  this  option
                     unless you there is some clock problem.

           --ignore-crc-error
                     The  ASCII armor used by OpenPGP is protected by
                     a  CRC  checksum  against  transmission  errors.
                     Sometimes  it  happens that the CRC gets mangled

           --lock-once
                     Lock the databases the  first  time  a  lock  is
                     requested  and do not release the lock until the
                     process terminates.

           --lock-multiple
                     Release the locks every time a lock is no longer
                     needed.  Use this to override a previous --lock-
                     once from a config file.

           --lock-never
                     Disable locking entirely.  This option should be
                     used only in very special environments, where it
                     can be assured that only one process is  access
                     ing  those  files.   A  bootable  floppy  with a
                     stand-alone encryption system will probably  use
                     this.  Improper usage of this option may lead to
                     data and key corruption.

           --no-random-seed-file
                     GnuPG uses a file to store its  internal  random
                     pool over invocations.  This makes random gener
                     ation faster; however sometimes write operations
                     are  not  desired.   This  option can be used to
                     achieve that with the cost of slower random gen
                     eration.

           --no-verbose
                     Reset verbose level to 0.

           --no-greeting
                     Suppress  the  initial  copyright message but do
                     not enter batch mode.

           --no-secmem-warning
                     Suppress the warning about "using insecure  mem
                     ory".

           --no-permission-warning
                     Suppress  the  warning about unsafe file permis
                     sions.  Note that  the  file  permission  checks
                     that  GnuPG does are not intended to be authori
                     tative, rather they simply  warn  about  certain
                     common  permission problems.  Do not assume that
                     the lack of a warning means that your system  is
                     secure.

           --no-mdc-warning
                     Suppress the warning about missing MDC integrity
                     protection.

                     Print key listings delimited by  colons.   Note,
                     that the output will be encoded in UTF-8 regard
                     less of any --charset setting.

           --with-key-data
                     Print key listings  delimited  by  colons  (like
                     --with-colons) and print the public key data.

           --with-fingerprint
                     Same  as  the  command --fingerprint but changes
                     only the format of the output and  may  be  used
                     together with another command.

           --fast-list-mode
                     Changes  the output of the list commands to work
                     faster; this is achieved by leaving  some  parts
                     empty.  Some applications don't need the user ID
                     and the trust information given in the listings.
                     By  using  this  options  they  can get a faster
                     listing.  The exact behaviour of this option may
                     change in future versions.

           --fixed-list-mode
                     Do  not merge user ID and primary key in --with-
                     colon listing mode and print all  timestamps  as
                     seconds since 1970-01-01.

           --list-only
                     Changes the behaviour of some commands.  This is
                     like --dry-run but different in some cases.  The
                     semantic  of this command may be extended in the
                     future.  Currently  it  only  skips  the  actual
                     decryption  pass  and  therefore  enables a fast
                     listing of the encryption keys.

           --no-literal
                     This is not for normal use.  Use the  source  to
                     see for what it might be useful.

           --set-filesize
                     This  is  not for normal use.  Use the source to
                     see for what it might be useful.

           --emulate-md-encode-bug
                     GnuPG versions prior to 1.0.2 had a bug  in  the
                     way  a  signature  was  encoded.   This  options
                     enables a workaround by checking  faulty  signa
                     tures  again  with the encoding used in old ver
                     sions.  This may only happen for ElGamal  signa
                     tures which are not widely used.

           --show-session-key
                     string.  The format of this string is  the  same
                     as  the one printed by --show-session-key.  This
                     option is normally not used but comes  handy  in
                     case someone forces you to reveal the content of
                     an encrypted message; using this option you  can
                     do this without handing out the secret key.

           --ask-sig-expire
                     When  making  a  data  signature,  prompt for an
                     expiration time.  If this option is  not  speci
                     fied, the expiration time is "never".

           --no-ask-sig-expire
                     Resets the --ask-sig-expire option.

           --ask-cert-expire
                     When making a key signature, prompt for an expi
                     ration time.  If this option is  not  specified,
                     the expiration time is "never".

           --no-ask-cert-expire
                     Resets the --ask-cert-expire option.

           --expert  Allow  the  user  to  do  certain nonsensical or
                     "silly"  things  like  signing  an  expired   or
                     revoked key, or certain potentially incompatible
                     things like  generating  deprecated  key  types.
                     This  also  disables  certain  warning  messages
                     about potentially incompatible actions.  As  the
                     name  implies,  this option is for experts only.
                     If you don't fully understand  the  implications
                     of what it allows you to do, leave this off.

           --no-expert
                     Resets the --expert option.

           --merge-only
                     Don't  insert  new  keys into the keyrings while
                     doing an import.

           --allow-secret-key-import
                     This is an obsolete option and is not used  any
                     where.

           --try-all-secrets
                     Don't  look  at the key ID as stored in the mes
                     sage but try all secret keys in turn to find the
                     right  decryption  key.   This option forces the
                     behaviour as used by anonymous recipients  (cre
                     ated  by  using  --throw-keyid)  and  might come
                     handy in case where an  encrypted  message  con
                     tains a bogus key ID.
                     will be expanded to the values specified.

                     The  values are key IDs or fingerprints, but any
                     key description is accepted.  Note that a  value
                     with spaces in it will be treated as two differ
                     ent values.  Note also there is only  one  level
                     of  expansion  -  you  cannot make an group that
                     points to another group.   When  used  from  the
                     command  line,  it may be necessary to quote the
                     argument to this option  to  prevent  the  shell
                     from treating it as multiple arguments.

           --preserve-permissions
                     Don't change the permissions of a secret keyring
                     back to user read/write only.  Use  this  option
                     only if you really know what you are doing.

           --personal-cipher-preferences string
                     Set  the  list of personal cipher preferences to
                     string, this list should be a string similar  to
                     the  one  printed  by  the command "pref" in the
                     edit menu.  This allows the user  to  factor  in
                     their  own  preferred algorithms when algorithms
                     are chosen via recipient key preferences.

           --personal-digest-preferences string
                     Set the list of personal digest  preferences  to
                     string,  this list should be a string similar to
                     the one printed by the  command  "pref"  in  the
                     edit  menu.   This  allows the user to factor in
                     their own preferred algorithms  when  algorithms
                     are chosen via recipient key preferences.

           --personal-compress-preferences string
                     Set the list of personal compression preferences
                     to string, this list should be a string  similar
                     to  the one printed by the command "pref" in the
                     edit menu.  This allows the user  to  factor  in
                     their  own  preferred algorithms when algorithms
                     are chosen via recipient key preferences.

           --default-preference-list string
                     Set the list of default preferences  to  string,
                     this  list should be a string similar to the one
                     printed by the command "pref" in the edit  menu.
                     This  affects  both key generation and "updpref"
                     in the edit menu.

## How to specify a user ID

           There are different ways on how to specify a  user  ID  to
           GnuPG; here are some examples:

           0F323456784E56EAB

           01AB3FED1347A5612

           0x234AABBCC34567C4
                     Here the key ID is given in  the  long  form  as
                     used  by  OpenPGP  (you  can get the long key ID
                     using the option --with-colons).

           1234343434343434C434343434343434

           123434343434343C3434343434343734349A3434

           0E12343434343434343434EAB3484343434343434

           0xE12343434343434343434EAB3484343434343434
                     The best way to specify a key ID is by using the
                     fingerprint of the key.  This avoids any ambigu
                     ities in case that there are duplicated key  IDs
                     (which are really rare for the long key IDs).

           =Heinrich Heine <heinrichh@uni-duesseldorf.de>
                     Using  an exact to match string.  The equal sign
                     indicates this.

           <heinrichh@uni-duesseldorf.de>
                     Using the email address part  which  must  match
                     exactly.  The  left angle bracket indicates this
                     email address mode.

           +Heinrich Heine duesseldorf
                     All words must match exactly  (not  case  sensi
                     tive)  but  can  appear in any order in the user
                     ID.  Words are any sequences of letters, digits,
                     the  underscore  and  all  characters with bit 7
                     set.

           Heine

           *Heine    By case insensitive substring matching.  This is
                     the  default  mode  but applications may want to
                     explicitly indicate this by putting the asterisk
                     in front.

           Note that you can append an exclamation mark to key IDs or
           fingerprints.  This flag tells GnuPG to  use  exactly  the
           given  primary  or  secondary key and not to try to figure
           out which secondary or primary key to use.

## RETURN VALUE

           gpg --list-keys  user_ID
                     show keys

           gpg --fingerprint  user_ID
                     show fingerprint

           gpg --verify  pgpfile

           gpg --verify  sigfile [files]
                     Verify the signature of the file but do not out
                     put  the  data.  The  second  form  is  used for
                     detached  signatures,  where  sigfile   is   the
                     detached  signature  (either  ASCII  armored  of
                     binary) and [files] are the signed data; if this
                     is  not  given  the name of the file holding the
                     signed data is constructed by  cutting  off  the
                     extension  (".asc"  or  ".sig") of sigfile or by
                     asking the user for the filename.

## ENVIRONMENT

           HOME      Used to locate the default home directory.

           GNUPGHOME If set directory used instead of "~/.gnupg".

           GPG_AGENT_INFO
                     Used to locate the gpg-agent; only honored  when
                     --use-agent  is  set.   The  value consists of 3
                     colon delimited fields: The first is the path to
                     the  Unix  Domain  Socket, the second the PID of
                     the gpg-agent and  the  protocol  version  which
                     should be set to 1.  When starting the gpg-agent
                     as described in its documentation, this variable
                     is  set to the correct value.  The option --gpg-
                     agent-info can be used to override it.

           http_proxy
                     Only honored when  the  keyserver-option  honor-
                     http-proxy is set.

## FILES

           ~/.gnupg/secring.gpg
                     The secret keyring

           ~/.gnupg/secring.gpg.lock
                     and the lock file

           ~/.gnupg/pubring.gpg
                     The public keyring

           ~/.gnupg/pubring.gpg.lock
                     and the lock file
                     Old  style  configuration  file;  only used when
                     gpg.conf is not found

           /usr[/local]/share/gnupg/options.skel
                     Skeleton options file

           /usr[/local]/lib/gnupg/
                     Default location for extensions

## WARNINGS

           Use a *good* password for your user account and  a  *good*
           passphrase to protect your secret key.  This passphrase is
           the weakest part of the whole system.  Programs to do dic
           tionary  attacks  on  your secret keyring are very easy to
           write and so you should protect your "~/.gnupg/" directory
           very well.

           Keep  in mind that, if this program is used over a network
           (telnet), it is *very* easy to spy out your passphrase!

           If you are going to verify detached signatures, make  sure
           that  the  program  knows  about it; either be giving both
           filenames on the command line or using - to specify stdin.

## INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS

           GnuPG  tries  to  be a very flexible implementation of the
           OpenPGP standard.  In particular, GnuPG implements many of
           the   "optional"  parts  of  the  standard,  such  as  the
           RIPEMD/160 hash, and the ZLIB compression algorithms.   It
           is  important  to  be  aware that not all OpenPGP programs
           implement these optional algorithms and  that  by  forcing
           their  use  via  the --cipher-algo, --digest-algo, --cert-
           digest-algo, or --compress-algo options in  GnuPG,  it  is
           possible  to create a perfectly valid OpenPGP message, but
           one that cannot be read by the intended recipient.

           For example, as of this writing, no  version  of  official
           PGP  supports  the  BLOWFISH cipher algorithm.  If you use
           it, no PGP user will be able to decrypt your message.  The
           same  thing applies to the ZLIB compression algorithm.  By
           default, GnuPG will do the right thing and create messages
           that  are  usable  by  any OpenPGP program.  Only override
           this safe default if you know what you are doing.

           If you absolutely must override the safe default, you  are
           far  better  off  using  the  --pgp2,  --pgp6,  or  --pgp7
           options.  These options are safe as they do not force  any
           particular  algorithms in violation of OpenPGP, but rather
           reduce the available algorithms to a "PGP-safe" list.

## BUGS

           On many  systems  this  program  should  be  installed  as