# Passwords and Encryption Keys Manual

2005, 2006, 2007, 2008
Jacob Perkins e Adam Schreiber
Projècte Seahorse

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License (GFDL), Version 1.1 or any later version published by the Free Software Foundation with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. You can find a copy of the GFDL at this link or in the file COPYING-DOCS distributed with this manual.

This manual is part of a collection of GNOME manuals distributed under the GFDL. If you want to distribute this manual separately from the collection, you can do so by adding a copy of the license to the manual, as described in section 6 of the license.

Many of the names used by companies to distinguish their products and services are claimed as trademarks. Where those names appear in any GNOME documentation, and the members of the GNOME Documentation Project are made aware of those trademarks, then the names are in capital letters or initial capital letters.

DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT ARE PROVIDED UNDER THE TERMS OF THE GNU FREE DOCUMENTATION LICENSE WITH THE FURTHER UNDERSTANDING THAT:

1. DOCUMENT IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS FREE OF DEFECTS MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY, ACCURACY, AND PERFORMANCE OF THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS WITH YOU. SHOULD ANY DOCUMENT OR MODIFIED VERSION PROVE DEFECTIVE IN ANY RESPECT, YOU (NOT THE INITIAL WRITER, AUTHOR OR ANY CONTRIBUTOR) ASSUME THE COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE. NO USE OF ANY DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER; AND

2. UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN TORT (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL THE AUTHOR, INITIAL WRITER, ANY CONTRIBUTOR, OR ANY DISTRIBUTOR OF THE DOCUMENT OR MODIFIED VERSION OF THE DOCUMENT, OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER DAMAGES OR LOSSES ARISING OUT OF OR RELATING TO USE OF THE DOCUMENT AND MODIFIED VERSIONS OF THE DOCUMENT, EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES.

Jacob
Perkins
Projècte Seahorse
Adam
Schreiber
Projècte Seahorse

    						sadam@clemson.edu

Projècte Seahorse
Passwords and Encryption Keys Manual V0.9.1
Novembre de 2006

Milo Casagrande milo_casagrande@yahoo.it

Passwords and Encryption Keys Manual V0.9.0
Julhet de 2005

Adam Schreiber sadam@clemson.edu

Projècte Seahorse

Passwords and Encryption Keys Manual V0.7.0
Febrièr de 2003

Jacob Perkins

Projècte Seahorse

This manual describes version 0.9.9 of Passwords and Encryption Keys

## Feedback

To report a bug or make a suggestion regarding the Passwords and Encryption Keys application or this manual, follow the directions in the Gnome Feedback Page.

Passwords and Encryption Keys is the application for managing encryption keys for the GNOME Desktop

## Introduccion

You can use Passwords and Encryption Keys to create and manage PGP and SSH keys.

Passwords and Encryption Keys provides a front end to many of the features of Gnu Privacy Guard (GPG) and integrates with multiple components of the GNOME desktop.

Features of Passwords and Encryption Keys include:

- A drop-in replacement for gpg-agent

- A DNS-SD HKP key server

- Plugins for Gedit, Nautilus and Epiphany

- A panel applet for encrypting text on the clipboard

With Passwords and Encryption Keys you can:

- Create and manage PGP and SSH keys,

- Export and import PGP and SSH keys,

- Partejar vòstras claus amb d'autres,

- Backup your keys and keyring,

- Cache your passphrase so you don't have to keep typing it,

- Encrypt and decrypt the clipboard.

## Per començar

### Starting Passwords and Encryption Keys

You can start Passwords and Encryption Keys in the following ways:

Menut Applications

  Choose Other Password and Encryption Keys .

Linha de comanda

  Type `seahorse` then press Return.

### When You Start Passwords and Encryption Keys

When you start Passwords and Encryption Keys, the Password and Encryption Keys window is displayed.

#### The Passwords and Encryption Keys Window

Visualizar la Passwords and Encryption Keys fenèstra.

The Passwords and Encryption Keys window contains the following elements:

Barra de menuts

  The menus on the menubar contain all of the commands that you need to perform tasks in Passwords and Encryption Keys.

Barra d'espleches

  Use the toolbar to quickly access commonly-used commands.

Keys and Passwords Tabs

  Provides access to the keys and passwords in the keyring.

First time options

  Provides fast access to useful actions for first time users. From here you can:

  - Explorar lo sistèma d'ajuda

  - Import keys in the keyring,

  - Crear de claus novèlas.

## Creating OpenPGP Keys

OpenPGP is a non proprietary protocol for encrypting e-mail with the use of public key cryptography based on PGP. It defines standard formats for encrypted messages, signatures, private keys and certificates for exchanging public keys.

Public key cryptography is a concept which involves the use of two keys: a public key, that you can give to anyone with whom you would like to communicate, and a private key which is private and must be kept secret.

To create OpenPGP keys:

1. Choose Key Create New Key

2. Select PGP Key and click Continue

3. Enter your full name (first - last), your e-mail address and any additional information. You can also specify advanced options for the key: see below.

4. Click Create to create the new key pair.

5. The Passphrase for New PGP Key dialog will open. Enter the passphrase twice for your new key.

Use similar practices to generating a strong password when choosing a passphrase. The main difference between a password and a passphrase is that, in a passphrase, spaces are valid characters.

### Opcions avançadas

Expand the Advanced key options section to specify the following options for a new key:

Encryption Type

  This field specifies the encryption algorithms used to generate your keys.

  DSA ElGamal

    This is the suggested choice as it will allow you to encrypt, decrypt, sign and verify as needed.

  DSA

    Will allow signing only.

  RSA

    Will allow signing only.

Key Strength (bits)

  This is the length of the key in bits. The longer the key, the more secure it will be, provided a strong passphrase is used. Conversely, performing any operation with a longer key will require more time than it would with a shorter key. Acceptable values are between 1024 and 4096 bits. At least 2048 bits is recommended.

Expiration Date

  This is the date at which the key will cease to be usable for performing encryption or signing operations. 6 months is a reasonable time to set it to. You will have to either change the expiration date or generate a new key or subkey after this amount of time passes.

  Sign your new key with your old one before it expires to preserve your trust status.

## Creating Secure Shell Keys

Secure Shell (SSH) is a way of logging into a remote computer to execute commands on that machine. SSH keys are used in key-based authentication system, as an alternative to the default password authentication system. With key-based authentication there is no need to manually type a password to authenticate.

Secure Shell keys are made of two keys: a private key, that must be kept secret, and a public key which can be uploaded to any computer you need to access.

To create a Secure Shell key:

1. Choose Key Create New Key

2. Select Secure Shell Key and click Continue

3. Enter a description of what the key is to be used for. You can use your e-mail address or any other reminder. You can also specify advanced options for the key: see below.

4. Click Just Create Key to create the new key, or Create and Set Up to create the key and set up another computer to use it for authentication.

5. The Passphrase for New Secure Shell Key dialog opens. Enter the passphrase twice for your new key.

   Use similar practices to generating a strong password when choosing a passphrase. The main difference between a password and a passphrase is that, in a passphrase, spaces are valid characters.

### Opcions avançadas

Expand the Advanced key options section to specify the following options for a new key:

Encryption Type

  This field specifies the encryption algorithms used to generate your key.

  RSA

    Use the Rivest-ShamirAdleman (RSA) algorithm to create the SSH key. This is the preferred and more secure choice.

  DSA

    Use the Digital Signature Algorithm (DSA) to create the SSH key.

Key Strength (bits)

  This is the length of the key in bits. The longer the key, the more secure it will be, provided a strong passphrase is used. Conversely, performing any operation with a longer key will require more time than it would with a shorter key. Acceptable values are between 1024 and 4096 bits. At least 2048 bits is recommended.

## OpenPGP Key Properties

The descriptions in this section apply to all OpenPGP keys.

To view properties of a PGP key:

- Selecciatz la clau PGP dins la fenèstra principala,

- Double click on it or choose Properties from the toolbar,

- Select the Details tab.

### Propietats

Fingerprint

  The fingerprint is a unique string of characters that exactly identifies a key.

KeyID

  The KeyID is similar to the Fingerprint. However the KeyID only contains the last 8 characters of the fingerprint. Most of the time it is possible to identify a key with only the KeyID, but occasionally two keys may have the same ID.

Tipe

  Specifies the encryption algorithm used to generate a key. DSA keys can only sign. ElGamal keys are used to encrypt.

Creat

  Indicates the date the key was created.

Expires

  Indicates the date the key can no longer be used.

Strength

  Indicates the length in bits of a key. In general the longer the key, the more security it provides.

  A long key is not enough to make up for the use of a weak passphrase.

### Trust

Trust is an indication of how sure you are of a person's ability to correctly extend the web of trust. When you are faced with a key you have not signed, the validity of that person's key will be determined based on the signatures they have collected and how well or not you trust the people who have made those signatures. By default, an unknown key will require 3 signatures with marginal trust value or 1 fully trusted signature.

- Unknown: You are not familiar with the person's ability to sign keys correctly.

- Never: This person cannot correctly sign keys.

- Marginal: This person checks for photo ID before signing a key, but does not necessarily scrutinize the IDs.

- Full: This person scrutinizes each and every person's photo IDs before signing them (e.g. they only sign keys that truely belong to the person asking for the signature).

- Ultimate: This level of trust should only be assigned to your own keys.

### Activar e desactivar de claus

When a key is enabled, it can be used to perform encryption operations. When a key is disabled, it cannot be used to encrypt to or verify signatures made by it.

### Expiration Date

A key can no longer be used to perform key operations after it has expired. Changing a key's expiration date to a point in the future re-enables it. A good general practice would be to have a master key that never expires and multiple subkeys that do and are signed by the master key.

### User IDs

User IDs allow multiple identities and email addresses to be used with the same key.

They usually take the form of:

    Name (comment) <email address>

#### Adding a User ID

Adding a user ID is useful when you want to have an identity for your job and one for your friends.

To add a user ID to a key:

- Seleccionatz la clau dins la fenèstra principala,

- Double click on it or choose Properties from the toolbar,

- Select the Names and Signatures tab,

- Clicatz sus Apondre un nom.

After following the instructions above, you will be presented with a dialog to fill in. The fields are detailed below.

Nom complet

  Enter your full name in the form

      <first> <last>

  A middle name or initial is optional.

  You must enter at least 5 characters in this field.

Adreça electronica

  Your email address is how most people will locate your key on a key server or other key provider. Make sure it is correct before continuing.

  It should be of the form

      <username>@<domainname>

Comentari de clau

  The comment field can be used to place any additional information into the displayed name of your new ID. This information can be searched for on key servers.

### Photo IDs

Photo IDs allow a key owner to embed one or more pictures of themselves in a key. These identities can be signed just like normal user IDs. A photo ID must be in JPEG format and is recommended to be no larger than 240x288 pixels.

If the chosen image is not of the required file type or size Passwords and Encryption Keys can resize and convert it on the fly from any image format supported by the GDK library.

### Changing the Passphrase

To change the passphrase assigned to a key:

- Seleccionatz la clau dins la fenèstra principala,

- Double click on it or choose Properties from the toolbar,

- Click on Change Passphrase.

Enter the new passphrase and click OK.

### Suprimir una clau

To delete a key from your keyring:

- Seleccionatz la clau dins la fenèstra principala,

- Right click on it and choose Delete Key or choose Edit Delete Key .

You can delete your keys, trusted keys and collected keys.

## OpenPGP Subkey Properties

Each OpenPGP key has a single master key used to sign only. Subkeys are used to encrypt and to sign as well. In this way, if your sub key is compromised, you don't need to revoke your master key.

ID

  This is the identifier of the subkey.

Tipe

  Specifies the encryption algorithm used to generate a subkey. DSA keys can only sign, ElGamal keys are used to encrypt while RSA keys are used to sign or to encrypt.

Creat

  Indicates the date the key was created.

Expires

  Indicates the date the key can no longer be used.

Estatut

  Indicates the status of the key.

Strength

  Indicates the length in bits of the key. In general the longer the key, the more security it provides.

  A long key is not enough to make up for the use of a weak passphrase.

### Adding a Subkey

To add a subkey to a key, from the Subkeys section click on Add button.

After following the instructions above, you will be presented with a dialog to fill in. The fields are detailed below.

Tipe de clau

  Specifies the encryption algorithm used to generate a subkey.

  DSA

    Use the Digital Signature Algorithm (DSA) to create the subkey. This subkey can sign only.

  ElGamal

    Use the ElGamal algorithm to create the subkey. This subkey can encrypt only.

  RSA

    Use the Rivest-Shamir Adleman (RSA) algorithm to create the subkey. This subkey can be used to sign or encrypt, but you have to create two different subkeys.

Longor de clau

  Indicates the length in bits of the subkey. In general the longer the key, the more security it provides.

Expiration Date

  Indicates the date the subkey can no longer be used.

### Changing a Subkey Expiration Date

To change a subkey expiration date, select the subkey from the Subkeys section, then:

- Click on the Expire button on the left,

- From the date dialog choose the new expiration date or select Never expires for no expiration date.

### Revoking a Subkey

To revoke a subkey, select the subkey from the Subkeys section, then:

- Click on the Revoke button on the left,

- Choose a reason why to revoke the subkey:

  No Reason

    There isn't a specific reason to revoke the key.

  Compromised

    The key has been compromised.

  Superseded

    The key has been superseded by another one.

  Not Used

    The key is not used anymore.

- Enter a description of why you are revoking the key,

- Click on Revoke.

The effect of revoking a subkey is immediate.

### Deleting a Subkey

To delete a subkey, select the subkey from the Subkeys section, then:

- Clicatz sul boton Suprimir a l'esquèrra.

## Secure Shell Key Properties

The descriptions in this section apply to all SSH keys.

To view properties of a SSH key:

- Select the Secure Shell key from the main window,

- Double click on it or choose Properties from the toolbar,

- Select the Details tab.

### Propietats

Fingerprint

  The fingerprint is a unique string of characters that exactly identifies a key.

Algorithm

  Specifies the encryption algorithm used to generate a key.

Emplaçament

  This is the location where the private key has been stored.

Strength

  Indicates the length in bits of a key. In general the longer the key, the more security it provides.

  A long key is not enough to make up for the use of a weak passphrase.

### Deleting a Secure Shell Key

To delete a Secure Shell key:

- Seleccionatz la clau SSH dins la fenèstra principala,

- Right click on it and choose Delete key or choose Edit Delete Key .

## Importacion de claus

To import keys choose Key Import and select, from the file chooser, a file containing at least one ASCII armored public key.

Importing can also be performed by pasting the keys inside Passwords and Encryption Keys:

- Select an ASCII armored public block of text,

- Copy it to the clipboard,

- Causissètz Edicion Pegar las claus.

## Exporting Keys

To export keys, select the keys in the main window and choose Key Export .

You can also export keys to the clipboard in an ASCII armored block of text:

- Seleccionatz las claus dins la fenèstra principala,

- Causissètz Edit Copiar las claus.

## Backing up Keyrings

To back up your public and private keyrings to an archived file:

- Choose Key Back up Keyrings ,

- Enter a file name with a valid archive extension and specify the location to save the archive.

You can choose any of the archive types file-roller supports.

## Signing a Key

Signing another person's key means you are giving trust to that person. Before signing a key, you have to carefully check the key's fingerprint to be sure that the key really belongs to that person.

To sign a key in your keyring:

- Select the key you want to sign from the Trusted Keys or Other Collected Keys tabs,

- Choose Sign from the toolbar or Key Sign ,

- Select how carefully the key has been checked,

- Indicate if the signature should be local to your keyring, and if your signature can be revoked,

- Click on Sign.

## File Manager Integration

Passwords and Encryption Keys integrates with Nautilus. You can encrypt, decrypt, sign and verify files as well as import public keys from the file manager window without launching Passwords and Encryption Keys.

### Encrypting Files

To encrypt files from the file manager, perform the following steps:

- Select one or more files from the file manager,

- Right click on any selected file and choose Encrypt,

- Select the people you would like to encypt the file to, and then click OK.

### Signing Files

To sign files from the file manager, perform the following steps:

- Select one or more files from the file manager,

- Right click on any selected file and choose Sign,

- If asked, enter the passphrase of your private key.

### Decrypting Files

To decrypt an encrypted file from the file manager, perform the following steps:

- Double click on the file you want to decrypt,

- If asked, enter the passphrase of your private key.

### Verifing Signatures

To verify files, simply double click on the the detached signature file.

Detached signature file names often take the form <file name>.sig

## Text Editor Integration

To enable Text Encryption plugin in Gedit, the GNOME text editor, perform the following steps:

- Run Gedit by choosing Applications Accessories Text Editor ,

- Causissètz Edicion Preferéncias,

- In the Plugin tab, select the Text Encryption plugin.

### Encrypting Text

To encrypt a selection of text from Gedit, perform the following steps:

- Select the text you want to encrypt, and choose Edit Encrypt ,

- Select the people you want to encrypt the text to, and click OK.

You can now copy or save the encrypted text.

### Signing Text

To sign a selection of text from Gedit, perform the following steps:

- Select the text you want to sign and choose Edit Sign ,

- Insert, if asked, the passphrase of your private key.

You can now copy or save the signed text.

### Decrypting/Verifing Text

To decrypt and/or verify a selection of text from Gedit, perform the following steps:

- Select the text you want to decrypt/verify and choose Edit Decrypt/Verify ,

- Insert, if asked, the passphrase of your private key.

You can now copy or save the decrypted text.

## Preferéncias

This section describes the preferences settable in Passwords and Encryption Keys.

### View preferences

These options control wich columns are visible in the key manager.

To access this options choose View from the menubar.

Tipes

  Shows the Type column, indicating whether the key is an OpenPGP, SSH key or a S/MIME certificate.

  Certificates are not yet supported.

Expiry

  Shows the Expiration Date column, indicating the date after which a key can no longer be used to encrypt or to sign.

Trust

  Shows the Trust column, indicating the level at which you trust the person to verify the identity of other people when they sign keys.

Validitat

  Shows the Validity column, indicating how well you know the key belongs to the person claiming it as their own.

### Encryption Preferences

This section describes the preferences settable by choosing System Preferences Encryption Preferences from the panel or Edit Preferences from within Passwords and Encryption Keys.

#### Encryption Settings

Clau per defaut

  This is the key that will be used by Passwords and Encryption Keys to sign files. It will also be the key that files will be encrypted to if encrypt to self is selected.

When encrypting, always include myself as a recipient

  Sets the encrypt to self option, whether or not you will be added to the recipients list for all files encrypted by Passwords and Encryption Keys.

  If you do not select this and you do not select yourself as a recipient you will not be unable to decrypt any files you encrypt.

#### Passphrase Cache

Enabling Passwords and Encryption Keys's passphrase caching ability will allow you to perform many operations that require entering your passphrase without re-entering it every time. `seahorse-daemon` takes the place of `gpg-agent`. Letting the cached passphrases expire is usually a good idea. This will then require re-entering your passphrase, but adds security.

Never remember passphrases

  Sets to not remember any passphrase.

Remember passphrases for ... minutes

  Sets the amount of time, in minutes, for storing passphrases. Use the spin box to set the desired time.

Always remember passphrases whenever logged in

  Sets to remember any passphrases whenever you are logged in the session.

Ask me before using a cached passphrase

  Sets to ask you before using a stored passphrase.

Automatically load Secure Shell keys

  Sets to automatically cache any Secure Shell key.

#### Servidors de clau

Keep your and other's keys up to date by syncing keys periodically with remote keyservers. Syncing will make sure that you have the latest signatures made on all of your keys so that the web of trust will be the most useful.

Passwords and Encryption Keys provides support for HKP and LDAP keyservers.

Servidors HKP

  HKP keyservers are ordinary web based keyservers such as the popular hkp://pgp.mit.edu:11371, also accessible at http://pgp.mit.edu.

LDAP Keyservers

  LDAP keyservers are less common, but use the standard LDAP protocol to serve keys. ldap://keyserver.pgp.com is a good LDAP server.

#### Key Sharing

Key Sharing is provided by DNS-SD, also known as Bonjour or Rendevous. Enabling key sharing will add the local Passwords and Encryption Keys users' public key rings to the remote search dialog. Using these local "key servers" will most likely be faster than accessing remote servers.

#### GNOME Keyring

You can change the password of the default key ring created the first time you saved a password, a passphrase to access a SSH server or any other secret during a GNOME session.

To change the master password of the key ring, type the original password in the Original Master Password text box, the new password in the New Master Password text box and confirm it in the Confirm Master Password text box. To apply the settings, press Apply. If the original master password is correct, you will get a status message indicating the success of the operation. If the master password is not correct you will be asked to check its correctness.

To clear all the text boxes, press Clear.

## About Passwords and Encryption Keys

Passwords and Encryption Keys, its associated plugins, the preferences applet and the panel applet are known collectively as Seahorse. Seahorse was written by Jacob Perkins. The current maintainers are Stef Walter and Adam Schreiber. This manual is by Adam Schreiber. The project's web site was designed by Jim Pharis. To find more information about Seahorse, the project , please visit the Seahorse web page.

To report a bug or make a suggestion regarding this application or this manual, follow the directions in the Feedback section of the GNOME User Guide.

This program is distributed under the terms of the GNU General Public license as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. A copy of this license is included with this documentation; another can be found in the file COPYING included with the source code of this program.