EditPageHistoryDiffInfoLikePages

Annotated edit history of gpg(1) version 5 showing authors affecting page license. View with all changes included.

Rev	Author	#	Line
1	perry	1	gpg
		2	!!!gpg
		3	NAME
		4	SYNOPSIS
		5	DESCRIPTION
		6	COMMANDS
		7	OPTIONS
		8	How to specify a user ID
		9	RETURN VALUE
		10	EXAMPLES
		11	ENVIRONMENT
		12	FILES
		13	WARNINGS
		14	BUGS
		15	----
		16	!!NAME
		17
		18
		19	gpg -- encryption and signing tool
		20	!!SYNOPSIS
		21
		22
		23	__gpg__ [[--homedir __name__] [[--options __file__] [[__options__] __ command__ [[__args__]
		24	!!DESCRIPTION
		25
		26
		27	__gpg__ is the main program for the GnuPG
		28	system.
		29
		30
		31	This man page only lists the commands and options available.
		32	For a more verbose documentation get the [GNU] Privacy
		33	Handbook (GPH), which is available at
		34	http://www.gnupg.org/gph/ . You will find a list of HOWTO
		35	documents at http://www.gnupg.org/docs.html .
		36	!!COMMANDS
		37
		38
		39	__gpg__ recognizes these commands:
		40
		41
		42	-s, --sign
		43
		44
		45	Make a signature. This command may be combined with
		46	--encrypt.
		47
		48
		49	--clearsign
		50
		51
		52	Make a clear text signature.
		53
		54
		55	-b, --detach-sign
		56
		57
		58	Make a detached signature.
		59
		60
		61	-e, --encrypt
		62
		63
		64	Encrypt data. This option may be combined with
		65	--sign.
		66
		67
		68	-c, --symmetric
		69
		70
		71	Encrypt with symmetric cipher only. This command asks for a
		72	passphrase.
		73
		74
		75	--store
		76
		77
		78	Store only (make a simple RFC1991 packet).
		79
		80
		81	--decrypt [[__file__]
		82
		83
		84	Decrypt __file__ (or stdin if no file is specified) and
		85	write it to stdout (or the file specified with --output). If
		86	the decrypted file is signed, the signature is also
		87	verified. This command differs from the default operation,
		88	as it never writes to the filename which is included in the
		89	file and it rejects files which don't begin with an
		90	encrypted message.
		91
		92
		93	--verify [[[[__sigfile__]
		94	[[__signed-files__]]
		95
		96
		97	Assume that __sigfile__ is a signature and verify it
		98	without generating any output. With no arguments, the
		99	signature packet is read from stdin. If only a sigfile is
		100	given, it may be a complete signature or a detached
		101	signature, in which case the signed stuff is expected in a
		102	file without the
		103	__-__ as
		104	the second filename. For security reasons a detached
		105	signature cannot read the signed material from stdin without
		106	denoting it in the above way.
		107
		108
		109	--verify-files [[__files__]
		110
		111
		112	This is a special version of the --verify command which does
		113	not work with detached signatures. The command expects the
		114	files to be verified either on the command line or reads the
		115	filenames from stdin; each name must be on separate line.
		116	The command is intended for quick checking of many
		117	files.
		118
		119
		120	--list-keys [[__names__]
		121
		122
		123	--list-public-keys [[__names__]
		124
		125
		126	List all keys from the public keyrings, or just the ones
		127	given on the command line.
		128
		129
		130	--list-secret-keys [[__names__]
		131
		132
		133	List all keys from the secret keyrings, or just the ones
		134	given on the command line.
		135
		136
		137	--list-sigs [[__names__]
		138
		139
		140	Same as --list-keys, but the signatures are listed
		141	too.
		142
		143
		144	--check-sigs [[__names__]
		145
		146
		147	Same as --list-sigs, but the signatures are
		148	verified.
		149
		150
		151	--fingerprint [[__names__]
		152
		153
		154	List all keys with their fingerprints. This is the same
		155	output as --list-keys but with the additional output of a
		156	line with the fingerprint. May also be combined with
		157	--list-sigs or --check-sigs. If this command is given twice,
		158	the fingerprints of all secondary keys are listed
		159	too.
		160
		161
		162	--list-packets
		163
		164
		165	List only the sequence of packets. This is mainly useful for
		166	debugging.
		167
		168
		169	--gen-key
		170
		171
		172	Generate a new key pair. This command is normally only used
		173	interactively.
		174
		175
		176	There is an experimental feature which allows you to create
		177	keys in batch mode. See the file __doc/DETAILS__ in the
		178	source distribution on how to use this.
		179
		180
		181	--edit-key __name__
		182
		183
		184	Present a menu which enables you to do all key related
		185	tasks:
		186
		187
		188	sign
		189
		190
		191	Make a signature on key of user __name__ If the key is
		192	not yet signed by the default user (or the users given with
		193	-u), the program displays the information of the key again,
		194	together with its fingerprint and asks whether it should be
		195	signed. This question is repeated for all users specified
		196	with -u.
		197
		198
		199	lsign
		200
		201
		202	Same as --sign but the signature is marked as non-exportable
		203	and will therefore never be used by others. This may be used
		204	to make keys valid only in the local
		205	environment.
		206
		207
		208	revsig
		209
		210
		211	Revoke a signature. GnuPG asks for every signature which has
		212	been done by one of the secret keys, whether a revocation
		213	certificate should be generated.
		214
		215
		216	trust
		217
		218
		219	Change the owner trust value. This updates the trust-db
		220	immediately and no save is required.
		221
		222
		223	disable
		224
		225
		226	enable
		227
		228
		229	Disable or enable an entire key. A disabled key can normally
		230	not be used for encryption.
		231
		232
		233	adduid
		234
		235
		236	Create an alternate user id.
		237
		238
		239	deluid
		240
		241
		242	Delete a user id.
		243
		244
		245	addkey
		246
		247
		248	Add a subkey to this key.
		249
		250
		251	delkey
		252
		253
		254	Remove a subkey.
		255
		256
		257	revkey
		258
		259
		260	Revoke a subkey.
		261
		262
		263	expire
		264
		265
		266	Change the key expiration time. If a key is selected, the
		267	time of this key will be changed. With no selection the key
		268	expiration of the primary key is changed.
		269
		270
		271	passwd
		272
		273
		274	Change the passphrase of the secret key.
		275
		276
		277	uid __n__
		278
		279
		280	Toggle selection of user id with index __n__. Use 0 to
		281	deselect all.
		282
		283
		284	key __n__
		285
		286
		287	Toggle selection of subkey with index __n__. Use 0 to
		288	deselect all.
		289
		290
		291	check
		292
		293
		294	Check all selected user ids.
		295
		296
		297	pref
		298
		299
		300	List preferences.
		301
		302
		303	showpref
		304
		305
		306	More verbose preferences listing.
		307
		308
		309	toggle
		310
		311
		312	Toggle between public and secret key listing.
		313
		314
		315	save
		316
		317
		318	Save all changes to the key rings and quit.
		319
		320
		321	quit
		322
		323
		324	Quit the program without updating the key
		325	rings.
		326
		327
		328	The listing shows you the key with its secondary keys and
		329	all user ids. Selected keys or user ids are indicated by an
		330	asterisk. The trust value is displayed with the primary key:
		331	the first is the assigned owner trust and the second is the
		332	calculated trust value. Letters are used for the
		333	values:
		334
		335
		336	-
		337
		338
		339	No ownertrust assigned / not yet calculated.
		340
		341
		342	e
		343
		344
		345	Trust calculation has failed; probably due to an expired
		346	key.
		347
		348
		349	q
		350
		351
		352	Not enough information for calculation.
		353
		354
		355	n
		356
		357
		358	Never trust this key.
		359
		360
		361	m
		362
		363
		364	Marginally trusted.
		365
		366
		367	f
		368
		369
		370	Fully trusted.
		371
		372
		373	u
		374
		375
		376	Ultimately trusted.
		377
		378
		379	--sign-key __name__
		380
		381
		382	Sign a public key with your secret key. This is a shortcut
		383	version of the subcommand
		384
		385
		386	--lsign-key __name__
		387
		388
		389	Sign a public key with your secret key but mark it as
		390	non-exportable. This is a shortcut version of the subcommand
		391
		392
		393	--trusted-key __long key ID__
		394
		395
		396	Assume that the specified key (which must be given as a full
		397	8 byte key ID) is as trustworthy as one of your own secret
		398	keys. This option is useful if you don't want to keep your
		399	secret keys (or one of them) online but still want to be
		400	able to check the validity of a given recipient's or
		401	signator's key.
		402
		403
		404	--delete-key __name__
		405
		406
		407	Remove key from the public keyring
		408
		409
		410	--delete-secret-key __name__
		411
		412
		413	Remove key from the secret and public keyring
		414
		415
		416	--delete-secret-and-public-key __name__
		417
		418
		419	Same as --delete-key, but if a secret key exists, it will be
		420	removed first.
		421
		422
		423	--gen-revoke
		424
		425
		426	Generate a revocation certificate for the complete key. To
		427	revoke a subkey or a signature, use the --edit
		428	command.
		429
		430
		431	--export [[__names__]
		432
		433
		434	Either export all keys from all keyrings (default keyrings
		435	and those registered via option --keyring), or if at least
		436	one name is given, those of the given name. The new keyring
		437	is written to stdout or to the file given with option
		438
		439
		440	--send-keys [[__names__]
		441
		442
		443	Same as --export but sends the keys to a keyserver. Option
		444	--keyserver must be used to give the name of this keyserver.
		445	Don't send your complete keyring to a keyserver - select
		446	only those keys which are new or changed by
		447	you.
		448
		449
		450	--export-all [[__names__]
		451
		452
		453	Same as --export, but also exports keys which are not
		454	compatible with OpenPGP.
		455
		456
		457	--export-secret-keys [[__names__]
		458
		459
		460	--export-secret-subkeys [[__names__]
		461
		462
		463	Same as --export, but exports the secret keys instead. This
		464	is normally not very useful and a security risk. The second
		465	form of the command has the special property to render the
		466	secret part of the primary key useless; this is a GNU
		467	extension to [OpenPGP] and other implementations can not be
		468	expected to successfully import such a key.
		469
		470
		471	--import [[__files__]
		472
		473
		474	--fast-import [[__files__]
		475
		476
		477	Import/merge keys. This adds the given keys to the keyring.
		478	The fast version does not build the trustdb; this can be
		479	done at any time with the command
		480	--update-trustdb.
		481
		482
		483	There are a few other options which control how this command
		484	works. Most notable here is the --merge-only option which
		485	does not insert new keys but does only the merging of new
		486	signatures, user-IDs and subkeys. See also the option
		487	--allow-secret-key-import.
		488
		489
		490	--recv-keys __key IDs__
		491
		492
		493	Import the keys with the given key IDs from a HKP [KeyServer].
		494	Option --keyserver must be used to give the name of this
		495	keyserver.
		496
		497
		498	--export-ownertrust
		499
		500
		501	List the assigned ownertrust values in [ASCII] format for
		502	backup purposes.
		503
		504
		505	--import-ownertrust [[__files__]
		506
		507
		508	Update the trustdb with the ownertrust values stored in
		509	__files__ (or stdin if not given); existing values will
		510	be overwritten.
		511
		512
		513	--print-md __algo__ [[__files__]
		514
		515
		516	Print message digest of algorithm ALGO for all given files
		517	of stdin. If
		518
		519
		520	--gen-random __0|1|2__ [[__count__]
		521
		522
		523	Emit COUNT random bytes of the given quality level. If count
		524	is not given or zero, an endless sequence of random bytes
		525	will be emitted. PLEASE, don't use this command unless you
		526	know what you are doing; it may remove precious entropy from
		527	the system!
		528
		529
		530	--gen-prime __mode bits__ [[__qbits__]
		531
		532
		533	Use the source, Luke :-). The output format is still subject
		534	to change.
		535
		536
		537	--version
		538
		539
		540	Print version information along with a list of supported
		541	algorithms.
		542
		543
		544	--warranty
		545
		546
		547	Print warranty information.
		548
		549
		550	-h, --help
		551
		552
		553	Print usage information. This is a really long list even
		554	though it doesn't list all options.
		555	!!OPTIONS
		556
		557
		558	Long options can be put in an options file (default
		559
		560
		561	__gpg__ recognizes these options:
		562
		563
		564	-a, --armor
		565
		566
		567	Create ASCII armored output.
		568
		569
		570	-o, --output __file__
		571
		572
		573	Write output to __file__.
		574
		575
		576	-u, --local-user __name__
		577
		578
		579	Use __name__ as the user ID to sign. This option is
		580	silently ignored for the list commands, so that it can be
		581	used in an options file.
		582
		583
		584	--default-key __name__
		585
		586
		587	Use __name__ as default user ID for signatures. If this
		588	is not used the default user ID is the first user ID found
		589	in the secret keyring.
		590
		591
		592	-r, --recipient __name__
		593
		594
		595	Encrypt for user id __name__. If this option is not
		596	specified, GnuPG asks for the user-id unless
		597	--default-recipient is given
		598
		599
		600	--default-recipient __name__
		601
		602
		603	Use __name__ as default recipient if option --recipient
		604	is not used and don't ask if this is a valid one.
		605	__name__ must be non-empty.
		606
		607
		608	--default-recipient-self
		609
		610
		611	Use the default key as default recipient if option
		612	--recipient is not used and don't ask if this is a valid
		613	one. The default key is the first one from the secret
		614	keyring or the one set with --default-key.
		615
		616
		617	--no-default-recipient
		618
		619
		620	Reset --default-recipient and
		621	--default-recipient-self.
		622
		623
		624	--encrypt-to __name__
		625
		626
		627	Same as --recipient but this one is intended for use in the
		628	options file and may be used with your own user-id as an
		629
		630
		631	--no-encrypt-to
		632
		633
		634	Disable the use of all --encrypt-to keys.
		635
		636
		637	-v, --verbose
		638
		639
		640	Give more information during processing. If used twice, the
		641	input data is listed in detail.
		642
		643
		644	-q, --quiet
		645
		646
		647	Try to be as quiet as possible.
		648
		649
		650	-z __n__
		651
		652
		653	Set compression level to __n__. A value of 0 for __n__
		654	disables compression. Default is to use the default
		655	compression level of zlib (normally 6).
		656
		657
		658	-t, --textmode
		659
		660
		661	Use canonical text mode. If -t (but not --textmode) is used
		662	together with armoring and signing, this enables clearsigned
		663	messages. This kludge is needed for PGP compatibility;
		664	normally you would use --sign or --clearsign to selected the
		665	type of the signature.
		666
		667
		668	-n, --dry-run
		669
		670
		671	Don't make any changes (this is not completely
		672	implemented).
		673
		674
		675	-i, --interactive
		676
		677
		678	Prompt before overwriting any files.
		679
		680
		681	--batch
		682
		683
		684	Use batch mode. Never ask, do not allow interactive
		685	commands.
		686
		687
		688	--no-tty
		689
		690
		691	Make sure that the TTY (terminal) is never used for any
		692	output. This option is needed in some cases because GnuPG
		693	sometimes prints warnings to the TTY if --batch is
		694	used.
		695
		696
		697	--no-batch
		698
		699
		700	Disable batch mode. This may be of use if --batch is enabled
		701	from an options file.
		702
		703
		704	--yes
		705
		706
		707	Assume
		708
		709
		710	--no
		711
		712
		713	Assume
		714
		715
		716	--always-trust
		717
		718
		719	Skip key validation and assume that used keys are always
		720	fully trusted. You won't use this unless you have installed
		721	some external validation scheme.
		722
		723
		724	--keyserver __name__
		725
		726
		727	Use __name__ to lookup keys which are not yet in your
		728	keyring. This is only done while verifying messages with
		729	signatures. The option is also required for the command
		730	--send-keys to specify the keyserver to where the keys
		731	should be send. All keyservers synchronize with each other -
		732	so there is no need to send keys to more than one server.
		733	Using the command
		734	__
		735
		736
		737	--no-auto-key-retrieve
		738
		739
		740	This option disables the automatic retrieving of keys from a
		741	keyserver while verifying signatures. This option allows you
		742	to keep a keyserver in the options file for the --send-keys
		743	and --recv-keys commands.
		744
		745
		746	--honor-http-proxy
		747
		748
		749	Try to access the keyserver over the proxy set with the
		750	variable
		751
		752
		753	--keyring __file__
		754
		755
		756	Add __file__ to the list of keyrings. If __file__
		757	begins with a tilde and a slash, these are replaced by the
		758	HOME directory. If the filename does not contain a slash, it
		759	is assumed to be in the home-directory (
		760	__
		761
		762
		763
		764
		765
		766
		767	It might make sense to use it together with
		768	--no-default-keyring.
		769
		770
		771	--secret-keyring __file__
		772
		773
		774	Same as --keyring but for the secret keyrings.
		775
		776
		777	--homedir __directory__
		778
		779
		780	Set the name of the home directory to __directory__ If
		781	this option is not used it defaults to
		782	__
		783
		784
		785	--charset __name__
		786
		787
		788	Set the name of the native character set. This is used to
		789	convert some strings to proper [UTF-8] encoding. Valid values
		790	for __name__ are:
		791
		792
		793	iso-8859-1
		794
		795
		796	This is the default Latin 1 set.
		797
		798
		799	iso-8859-2
		800
		801
		802	The Latin 2 set.
		803
		804
		805	koi8-r
		806
		807
		808	The usual Russian set (rfc1489).
		809
		810
		811	utf-8
		812
		813
		814	Bypass all translations and assume that the OS uses native
		815	UTF-8 encoding.
		816
		817
		818	--utf8-strings
		819
		820
		821	--no-utf8-strings
		822
		823
		824	Assume that the arguments are already given as UTF-8 strings.
		825	The default (--no-utf8-strings) is to assume that arguments
		826	are encoded in the character set as specified by --charset.
		827	These options affect all following arguments. Both options
		828	may be used multiple times.
		829
		830
		831	--options __file__
		832
		833
		834	Read options from __file__ and do not try to read them
		835	from the default options file in the homedir (see
		836	--homedir). This option is ignored if used in an options
		837	file.
		838
		839
		840	--no-options
		841
		842
		843	Shortcut for
		844
		845
		846	--load-extension __name__
		847
		848
		849	Load an extension module. If __name__ does not contain a
		850	slash it is searched in
		851	__
		852
		853
		854	--debug __flags__
		855
		856
		857	Set debugging flags. All flags are or-ed and __flags__
		858	may be given in C syntax (e.g. 0x0042).
		859
		860
		861	--debug-all
		862
		863
		864	Set all useful debugging flags.
		865
		866
		867	--status-fd __n__
		868
		869
		870	Write special status strings to the file descriptor
		871	__n__. See the file DETAILS in the documentation for a
		872	listing of them.
		873
		874
		875	--logger-fd __n__
		876
		877
		878	Write log output to file descriptor __n__ and not to
		879	stderr.
		880
		881
		882	--no-comment
		883
		884
		885	Do not write comment packets. This option affects only the
		886	generation of secret keys. Please note, that this has
		887	nothing to do with the comments in clear text
		888	signatures.
		889
		890
		891	--comment __string__
		892
		893
		894	Use __string__ as comment string in clear text
		895	signatures. To suppress those comment strings entirely, use
		896	an empty string here.
		897
		898
		899	--default-comment
		900
		901
		902	Force to write the standard comment string in clear text
		903	signatures. Use this to overwrite a --comment from a config
		904	file.
		905
		906
		907	--no-version
		908
		909
		910	Omit the version string in clear text
		911	signatures.
		912
		913
		914	--emit-version
		915
		916
		917	Force to write the version string in clear text signatures.
		918	Use this to overwrite a previous --no-version from a config
		919	file.
		920
		921
		922	-N, --notation-data __name=value__
		923
		924
		925	Put the name value pair into the signature as notation data.
		926	__name__ must consist only of alphanumeric characters,
		927	digits or the underscore; the first character must not be a
		928	digit. __value__ may be any printable string; it will be
		929	encoded in [UTF-8], so you should check that your --charset is
		930	set correctly. If you prefix __name__ with an exclamation
		931	mark, the notation data will be flagged as critical
3	StuartYeates	932	(RFC:rfc2440 5.2.3.15).
1	perry	933
		934
		935	--set-policy-url __string__
		936
		937
		938	Use __string__ as Policy URL for signatures
3	StuartYeates	939	(RFC:rfc2440 5.2.3.19). If you prefix it with an exclamation
1	perry	940	mark, the policy URL packet will be flagged as
		941	critical.
		942
		943
		944	--set-filename __string__
		945
		946
		947	Use __string__ as the name of file which is stored in
		948	messages.
		949
		950
		951	--use-embedded-filename
		952
		953
		954	Try to create a file with a name as embedded in the data.
		955	This can be a dangerous option as it allows to overwrite
		956	files.
		957
		958
		959	--completes-needed __n__
		960
		961
		962	Number of completely trusted users to introduce a new key
		963	signer (defaults to 1).
		964
		965
		966	--marginals-needed __n__
		967
		968
		969	Number of marginally trusted users to introduce a new key
		970	signer (defaults to 3)
		971
		972
		973	--max-cert-depth __n__
		974
		975
		976	Maximum depth of a certification chain (default is
		977	5).
		978
		979
		980	--cipher-algo __name__
		981
		982
		983	Use __name__ as cipher algorithm. Running the program
		984	with the command --version yields a list of supported
		985	algorithms. If this is not used the cipher algorithm is
		986	selected from the preferences stored with the
		987	key.
		988
		989
		990	--digest-algo __name__
		991
		992
		993	Use __name__ as message digest algorithm. Running the
		994	program with the command --version yields a list of
		995	supported algorithms. Please note that using this option may
		996	violate the OpenPGP requirement, that a 160 bit hash is to
		997	be used for DSA.
		998
		999
		1000	--s2k-cipher-algo __name__
		1001
		1002
		1003	Use __name__ as the cipher algorithm used to protect
		1004	secret keys. The default cipher is BlowFish. This cipher is
		1005	also used for conventional encryption if --cipher-algo is
		1006	not given.
		1007
		1008
		1009	--s2k-digest-algo __name__
		1010
		1011
		1012	Use __name__ as the digest algorithm used to mangle the
		1013	passphrases. The default algorithm is RIPE-MD-160. This
		1014	digest algorithm is also used for conventional encryption if
		1015	--digest-algo is not given.
		1016
		1017
		1018	--s2k-mode __n__
		1019
		1020
		1021	Selects how passphrases are mangled. If __n__ is 0 a
		1022	plain passphrase (which is not recommended) will be used, a
		1023	1 (default) adds a salt to the passphrase and a 3 iterates
		1024	the whole process a couple of times. Unless --rfc1991 is
		1025	used, this mode is also used for conventional
		1026	encryption.
		1027
		1028
		1029	--compress-algo __n__
		1030
		1031
		1032	Use compress algorithm __n__. Default is 2 which is
3	StuartYeates	1033	[RFC:RFC1950] compression. You may use 1 to use the old zlib
		1034	version ([RFC:RFC1951]) which is used by PGP. The default
1	perry	1035	algorithm may give better results because the window size is
		1036	not limited to 8K. If this is not used the OpenPGP behavior
		1037	is used, i.e. the compression algorithm is selected from the
		1038	preferences; note, that this can't be done if you do not
		1039	encrypt the data.
		1040
		1041
		1042	--disable-cipher-algo __name__
		1043
		1044
		1045	Never allow the use of __name__ as cipher algorithm. The
		1046	given name will not be checked so that a later loaded
		1047	algorithm will still get disabled.
		1048
		1049
		1050	--disable-pubkey-algo __name__
		1051
		1052
		1053	Never allow the use of __name__ as public key algorithm.
		1054	The given name will not be checked so that a later loaded
		1055	algorithm will still get disabled.
		1056
		1057
		1058	--no-sig-cache
		1059
		1060
		1061	Do not cache the verification status of key signatures.
		1062	Caching gives a much better performance in key listings.
		1063	However, if you suspect that your public keyring is not save
		1064	against write modifications, you can use this option to
		1065	disable the caching. It probably does not make sense to
		1066	disable it because all kind of damage can be done if someone
		1067	else has write access to your public keyring.
		1068
		1069
		1070	--no-sig-create-check
		1071
		1072
		1073	GnuPG normally verifies each signature right after creation
		1074	to protect against bugs and hardware malfunctions which
		1075	could leak out bits from the secret key. This extra
		1076	verification needs some time (about 115% for DSA keys), and
		1077	so this option can be used to disable it. However, due to
		1078	the fact that the signature creation needs manual
		1079	interaction, this performance penalty does not matter in
		1080	most settings.
		1081
		1082
		1083	--throw-keyid
		1084
		1085
		1086	Do not put the keyid into encrypted packets. This option
		1087	hides the receiver of the message and is a countermeasure
		1088	against traffic analysis. It may slow down the decryption
		1089	process because all available secret keys are
		1090	tried.
		1091
		1092
		1093	--not-dash-escaped
		1094
		1095
		1096	This option changes the behavior of cleartext signatures so
		1097	that they can be used for patch files. You should not send
		1098	such an armored file via email because all spaces and line
		1099	endings are hashed too. You can not use this option for data
		1100	which has 5 dashes at the beginning of a line, patch files
		1101	don't have this. A special armor header line tells GnuPG
		1102	about this cleartext signature option.
		1103
		1104
		1105	--escape-from-lines
		1106
		1107
		1108	Because some mailers change lines starting with
		1109
		1110
		1111	--passphrase-fd __n__
		1112
		1113
		1114	Read the passphrase from file descriptor __n__. If you
		1115	use 0 for __n__, the passphrase will be read from stdin.
		1116	This can only be used if only one passphrase is supplied.
		1117	Don't use this option if you can avoid it.
		1118
		1119
		1120	--command-fd __n__
		1121
		1122
		1123	This is a replacement for the deprecated shared-memory IPC
		1124	mode. If this option is enabled, user input on questions is
		1125	not expected from the TTY but from the given file
		1126	descriptor. It should be used together with --status-fd. See
		1127	the file doc/DETAILS in the source distribution for details
		1128	on how to use it.
		1129
		1130
		1131	--use-agent
		1132
		1133
		1134	Try to use the GnuPG-Agent. Please note that this agent is
		1135	still under development. With this option, GnuPG first tries
		1136	to connect to the agent before it asks for a
		1137	passphrase.
		1138
		1139
		1140	--rfc1991
		1141
		1142
		1143	Try to be more RFC1991 ([PGP] 2.x) compliant.
		1144
		1145
		1146	--openpgp
		1147
		1148
		1149	Reset all packet, cipher and digest options to [OpenPGP]
		1150	behavior. Use this option to reset all previous options like
		1151	--rfc1991, --force-v3-sigs, --s2k-*, --cipher-algo,
		1152	--digest-algo and --compress-algo to OpenPGP compliant
		1153	values. All PGP workarounds are also disabled.
		1154
		1155
		1156	--force-v3-sigs
		1157
		1158
		1159	OpenPGP states that an implementation should generate v4
		1160	signatures but PGP 5.x recognizes v4 signatures only on key
		1161	material. This option forces v3 signatures for signatures on
		1162	data.
		1163
		1164
		1165	--force-mdc
		1166
		1167
		1168	Force the use of encryption with appended manipulation code.
		1169	This is always used with the newer ciphers (those with a
		1170	blocksize greater than 64 bit). This option might not be
		1171	implemented yet.
		1172
		1173
		1174	--allow-non-selfsigned-uid
		1175
		1176
		1177	Allow the import of keys with user IDs which are not
		1178	self-signed, but have at least one signature. This only
		1179	allows the import - key validation will fail and you have to
		1180	check the validity of the key my other means. This hack is
		1181	needed for some German keys generated with pgp 2.6.3in. You
		1182	should really avoid using it, because OpenPGP has better
		1183	mechanics to do separate signing and encryption
		1184	keys.
		1185
		1186
		1187	--allow-freeform-uid
		1188
		1189
		1190	Disable all checks on the form of the user ID while
		1191	generating a new one. This option should only be used in
		1192	very special environments as it does not ensure the de-facto
		1193	standard format of user IDs.
		1194
		1195
		1196	--ignore-time-conflict
		1197
		1198
		1199	GnuPG normally checks that the timestamps associated with
		1200	keys and signatures have plausible values. However,
		1201	sometimes a signature seems to be older than the key due to
		1202	clock problems. This option makes these checks just a
		1203	warning.
		1204
		1205
		1206	--ignore-crc-error
		1207
		1208
		1209	The [ASCII] armor used by OpenPG is protected by a [CRC]
		1210	checksum against transmission errors. Sometimes it happens
		1211	that the CRC gets mangled somewhere on the transmission
		1212	channel but the actual content (which is anyway protected by
		1213	the OpenPGP protocol) is still okay. This option will let
		1214	gpg ignore CRC errors.
		1215
		1216
		1217	--lock-once
		1218
		1219
		1220	Lock the databases the first time a lock is requested and do
		1221	not release the lock until the process
		1222	terminates.
		1223
		1224
		1225	--lock-multiple
		1226
		1227
		1228	Release the locks every time a lock is no longer needed. Use
		1229	this to override a previous --lock-once from a config
		1230	file.
		1231
		1232
		1233	--lock-never
		1234
		1235
		1236	Disable locking entirely. This option should be used only in
		1237	very special environments, where it can be assured that only
		1238	one process is accessing those files. A bootable floppy with
		1239	a stand-alone encryption system will probably use this.
		1240	Improper usage of this option may lead to data and key
		1241	corruption.
		1242
		1243
		1244	--no-random-seed-file
		1245
		1246
		1247	GnuPG uses a file to store its internal random pool over
		1248	invocations. This makes random generation faster; however
		1249	sometimes write operations are not desired. This option can
		1250	be used to achieve that with the cost of slower random
		1251	generation.
		1252
		1253
		1254	--no-verbose
		1255
		1256
		1257	Reset verbose level to 0.
		1258
		1259
		1260	--no-greeting
		1261
		1262
		1263	Suppress the initial copyright message but do not enter
		1264	batch mode.
		1265
		1266
		1267	--no-secmem-warning
		1268
		1269
		1270	Suppress the warning about
		1271
		1272
		1273	--no-armor
		1274
		1275
		1276	Assume the input data is not in ASCII armored
		1277	format.
		1278
		1279
		1280	--no-default-keyring
		1281
		1282
		1283	Do not add the default keyrings to the list of
		1284	keyrings.
		1285
		1286
		1287	--skip-verify
		1288
		1289
		1290	Skip the signature verification step. This may be used to
		1291	make the decryption faster if the signature verification is
		1292	not needed.
		1293
		1294
		1295	--with-colons
		1296
		1297
		1298	Print key listings delimited by colons.
		1299
		1300
		1301	--with-key-data
		1302
		1303
		1304	Print key listings delimited by colons and print the public
		1305	key data.
		1306
		1307
		1308	--with-fingerprint
		1309
		1310
		1311	Same as the command --fingerprint but changes only the
		1312	format of the output and may be used together with another
		1313	command.
		1314
		1315
		1316	--fast-list-mode
		1317
		1318
		1319	Changes the output of the list commands to work faster; this
		1320	is achieved by leaving some parts empty. Some applications
		1321	don't need the user ID and the trust information given in
		1322	the listings. By using this options they can get a faster
		1323	listing. The exact behaviour of this option may change in
		1324	future versions.
		1325
		1326
		1327	--fixed-list-mode
		1328
		1329
		1330	Do not merge user ID and primary key in --with-colon listing
		1331	mode and print all timestamps as seconds since
		1332	1970-01-01.
		1333
		1334
		1335	--list-only
		1336
		1337
		1338	Changes the behaviour of some commands. This is like
		1339	--dry-run but different in some cases. The semantic of this
		1340	command may be extended in the future. Currently it only
		1341	skips the actual decryption pass and therefore enables a
		1342	fast listing of the encryption keys.
		1343
		1344
		1345	--no-literal
		1346
		1347
		1348	This is not for normal use. Use the source to see for what
		1349	it might be useful.
		1350
		1351
		1352	--set-filesize
		1353
		1354
		1355	This is not for normal use. Use the source to see for what
		1356	it might be useful.
		1357
		1358
		1359	--emulate-md-encode-bug
		1360
		1361
		1362	GnuPG versions prior to 1.0.2 had a bug in the way a
		1363	signature was encoded. This options enables a workaround by
		1364	checking faulty signatures again with the encoding used in
		1365	old versions. This may only happen for !ElGamal signatures
		1366	which are not widely used.
		1367
		1368
		1369	--show-session-key
		1370
		1371
		1372	Display the session key used for one message. See
		1373	--override-session-key for the counterpart of this
		1374	option.
		1375
		1376
		1377	We think that Key-Escrow is a Bad Thing; however the user
		1378	should have the freedom to decide whether to go to prison or
		1379	to reveal the content of one specific message without
		1380	compromising all messages ever encrypted for one secret key.
		1381	DON'T USE IT UNLESS YOU ARE REALLY FORCED TO DO
		1382	SO.
		1383
		1384
		1385	--override-session-key __string__
		1386
		1387
		1388	Don't use the public key but the session key __string__.
		1389	The format of this string is the same as the one printed by
		1390	--show-session-key. This option is normally not used but
		1391	comes handy in case someone forces you to reveal the content
		1392	of an encrypted message; using this option you can do this
		1393	without handing out the secret key.
		1394
		1395
		1396	--merge-only
		1397
		1398
		1399	Don't insert new keys into the keyrings while doing an
		1400	import.
		1401
		1402
		1403	--allow-secret-key-import
		1404
		1405
		1406	Allow import of secret keys. The import command normally
		1407	skips secret keys because a secret key can otherwise be used
		1408	to attack the trust calculation.
		1409
		1410
		1411	--try-all-secrets
		1412
		1413
		1414	Don't look at the key ID as stored in the message but try
		1415	all secret keys in turn to find the right decryption key.
		1416	This option forces the behaviour as used by anonymous
		1417	recipients (created by using --throw-keyid) and might come
		1418	handy in case where an encrypted message contains a bogus
		1419	key ID.
		1420
		1421
		1422	--enable-special-filenames
		1423
		1424
		1425	This options enables a mode in which filenames of the form
		1426	__-__, where n is a non-negative decimal number,
		1427	refer to the file descriptor n and not to a file with that
		1428	name.
		1429
		1430
		1431	--no-expensive-trust-checks
		1432
		1433
		1434	Experimental use only.
		1435	!!How to specify a user ID
		1436
		1437
		1438	There are different ways on how to specify a user ID to
		1439	GnuPG; here are some examples:
		1440
		1441
		1442	234567C4
		1443
		1444
		1445	0F34E556E
		1446
		1447
		1448	01347A56A
		1449
		1450
		1451	0xAB123456
		1452
		1453
		1454	Here the key ID is given in the usual short
		1455	form.
		1456
		1457
		1458	234AABBCC34567C4
		1459
		1460
		1461	0F323456784E56EAB
		1462
		1463
		1464	01AB3FED1347A5612
		1465
		1466
		1467	0x234AABBCC34567C4
		1468
		1469
		1470	Here the key ID is given in the long form as used by
		1471	OpenPGP.
		1472
		1473
		1474	1234343434343434C434343434343434
		1475
		1476
		1477	123434343434343C3434343434343734349A3434
		1478
		1479
		1480	0E12343434343434343434EAB3484343434343434
		1481
		1482
		1483	0xE12343434343434343434EAB3484343434343434
		1484
		1485
		1486	The best way to specify a key ID is by using the fingerprint
		1487	of the key. This avoids any ambiguities in case that there
		1488	are duplicated key IDs (which are really rare for the long
		1489	key IDs).
		1490
		1491
		1492	=Heinrich Heine
		1493
		1494
		1495	Using an exact to match string. The equal sign indicates
		1496	this.
		1497
		1498
		1499
		1500
		1501	Using the email address part which must match exactly. The
		1502	left angle bracket indicates this email address
		1503	mode.
		1504
		1505
		1506	+Heinrich Heine duesseldorf
		1507
		1508
		1509	All words must match exactly (not case sensitive) but can
		1510	appear in any order in the user ID. Words are any sequences
		1511	of letters, digits, the underscore and all characters with
		1512	bit 7 set.
		1513
		1514
		1515	#34
		1516
		1517
		1518	Using the Local ID. This is a very low level method and
		1519	should only be used by applications which really need it.
		1520	The hash character indicates this method. An application
		1521	should not assume that this is only a number.
		1522
		1523
		1524	Heine
		1525
		1526
		1527	*Heine
		1528
		1529
		1530	By case insensitive substring matching. This is the default
		1531	mode but applications may want to explicitly indicate this
		1532	by putting the asterisk in front.
		1533
		1534
		1535	Note that you can append an exclamation mark to key IDs or
		1536	fingerprints. This flag which tells GnuPG to use exactly
		1537	that primary or secondary key and don't try to figure out
		1538	which secondary or primary key to use.
		1539	!!RETURN VALUE
		1540
		1541
		1542	The program returns 0 if everything was fine, 1 if at least
		1543	a signature was bad, and other error codes for fatal
		1544	errors.
		1545	!!EXAMPLES
		1546
		1547
		1548	gpg -se -r __Bob file__
		1549
		1550
		1551	sign and encrypt for user Bob
		1552
		1553
		1554	gpg --clearsign __file__
		1555
		1556
		1557	make a clear text signature
		1558
		1559
		1560	gpg -sb __file__
		1561
		1562
		1563	make a detached signature
		1564
		1565
		1566	gpg --list-keys __user_ID__
		1567
		1568
		1569	show keys
		1570
		1571
		1572	gpg --fingerprint __user_ID__
		1573
		1574
		1575	show fingerprint
		1576
		1577
		1578	gpg --verify __pgpfile__
		1579
		1580
		1581	gpg --verify __sigfile__ [[__files__]
		1582
		1583
		1584	Verify the signature of the file but do not output the data.
		1585	The second form is used for detached signatures, where
		1586	__sigfile__ is the detached signature (either ASCII
		1587	armored of binary) and [[__files__] are the signed data;
		1588	if this is not given the name of the file holding the signed
		1589	data is constructed by cutting off the extension
		1590	(__sigfile__ or
		1591	by asking the user for the filename.
		1592	!!ENVIRONMENT
		1593
		1594
		1595	HOME
		1596
		1597
		1598	Used to locate the default home directory.
		1599
		1600
		1601	GNUPGHOME
		1602
		1603
		1604	If set directory used instead of
		1605
		1606
		1607	http_proxy
		1608
		1609
		1610	Only honored when the option --honor-http-proxy is
		1611	set.
		1612	!!FILES
		1613
		1614
		1615	~/.gnupg/secring.gpg
		1616
		1617
		1618	The secret keyring
		1619
		1620
		1621	~/.gnupg/secring.gpg.lock
		1622
		1623
		1624	and the lock file
		1625
		1626
		1627	~/.gnupg/pubring.gpg
		1628
		1629
		1630	The public keyring
		1631
		1632
		1633	~/.gnupg/pubring.gpg.lock
		1634
		1635
		1636	and the lock file
		1637
		1638
		1639	~/.gnupg/trustdb.gpg
		1640
		1641
		1642	The trust database
		1643
		1644
		1645	~/.gnupg/trustdb.gpg.lock
		1646
		1647
		1648	and the lock file
		1649
		1650
		1651	~/.gnupg/random_seed
		1652
		1653
		1654	used to preserve the internal random pool
		1655
		1656
		1657	~/.gnupg/options
		1658
		1659
		1660	May contain options
		1661
		1662
		1663	/usr[[/local]/share/gnupg/options.skel
		1664
		1665
		1666	Skeleton options file
		1667
		1668
		1669	/usr[[/local]/lib/gnupg/
		1670
		1671
		1672	Default location for extensions
		1673	!!WARNINGS
		1674
		1675
		1676	Use a *good* password for your user account and a *good*
		1677	passphrase to protect your secret key. This passphrase is
		1678	the weakest part of the whole system. Programs to do
		1679	dictionary attacks on your secret keyring are very easy to
		1680	write and so you should protect your
		1681
		1682
		1683	Keep in mind that, if this program is used over a network
		1684	(telnet), it is *very* easy to spy out your
		1685	passphrase!
		1686
		1687
		1688	If you are going to verify detached signatures, make sure
		1689	that the program nows about it; either be giving both
		1690	filenames on the commandline or using __-__ to specify
		1691	stdin.
		1692	!!BUGS
		1693
		1694
		1695	On many systems this program should be installed as
		1696	setuid(root). This is necessary to lock memory pages.
		1697	Locking memory pages prevents the operating system from
		1698	writing memory pages to disk. If you get no warning message
		1699	about insecure memory your operating system supports locking
		1700	without being root. The program drops root privileges as
		1701	soon as locked memory is allocated.
		1702	----
3	StuartYeates	1703	CategoryCryptography