Sigs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

David Wade Hagar AKA Cyclops wrote:
> Did the sig on my last message check out or was it bad?
>
Your public key isn't on a keyserver. You should upload it. If you
send me an email with your public key, I can verify the sig on the
last message for you.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (MingW32)

iD8DBQFE9dnCQkZZy5xsw6MRAgdXAKDPCs4fBKFvCxOxCQ0bjrTQOEtm7wCgtQv5
spVrXs+Hr/OPpA8qow/ugCk=
=0PoJ
-----END PGP SIGNATURE-----

Folks,

(1) I have uploaded my public key to the four keyservers that showed up
on the pull-down list in OpenPGP's Preferences. But I understand that
it is a good idea to post your public key somewhere else on the internet
as well so that people can conveniently get it and be confident that it
is secure, right? How does one do customarily that?

(2) Does a PGP signature (and/or encryption) work ONLY for recipients
who are using PGP? If I want to send secure email to a client (or for
my client to send secure to me) must they be using PGP? And if not, how
does that work?

Thanks!

-Micah

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

In reply to Micah Salb's message sent 2006-08-30 15:59:

> (1) I have uploaded my public key to the four keyservers that showed up
> on the pull-down list in OpenPGP's Preferences. But I understand that
> it is a good idea to post your public key somewhere else on the internet
> as well so that people can conveniently get it and be confident that it
> is secure, right? How does one do customarily that?

If your key is published on public key servers, that may be well enough.
You can try to provide some explicit alternatives, such as including a
note or link in your email tagline that suggests resources from which to
fetch your public key. My tagline, for example, suggests you send an
email to my autoresponder. You can just as well get my public key from
various public key servers or from my personal website.

Your confidence in my key can rarely depend upon where you got it from.
Confidence should be measured by what action you or a trusted third
party has done to validate my public key, whatever that might mean
according to your threat and trust models.

> (2) Does a PGP signature (and/or encryption) work ONLY for recipients
> who are using PGP? If I want to send secure email to a client (or for
> my client to send secure to me) must they be using PGP? And if not, how
> does that work?

Someone else needs an OpenPGP encryption application (ie; GnuPG, PGP) to
perform operations with OpenPGP messages and public keys.

Someone else needs your public key to verify your signature (signatures
require a public key to decrypt).

Someone else needs your public key to encrypt something to you that
requires your private key to decrypt (encrypted messages require a
private key to decrypt).

- --
List Moderator, PGP Encryption Help Team

Mike Daigle http://www.mikedaigle.ca
My PGP Key Send email with subject=pgpkey-request
Gossamer Spider Web of Trust http://www.gswot.org

-----BEGIN PGP SIGNATURE-----
Comment: GSWoT:CA1 Gossamer Spider Web of Trust www.gswot.org
Comment: Mike Daigle Ontario, Canada www.mikedaigle.ca

iEYEAREDAAYFAkT1+dEACgkQTvHh4CsVTmJiCQCeLqHS79ttQBfwa3nFJkK6mgSS
KrkAmwS4jRK1dRoDytPDPSzo16cxSQvi
=8Sje
-----END PGP SIGNATURE-----

Michael,

Thank you for this explanation. By "Someone else needs an OpenPGP
encryption application (ie; GnuPG, PGP) to perform operations with
OpenPGP messages and public keys."; you mean that they need PGP software
to open message that I have signed or encrypted using OpenPGP, right?

So bearing in mind the relatively few people who have PGP software
installed on their computers (and remembering the difficulty I have had
getting it to work on my computer), doesn't this sharply reduce its
usefulness (except among the congnoscenti)?

(I had once had a PGP signature that recipients could open quite easily
without any special software.....)

Thanks.

-Micah

>;
>
>
> Someone else needs your public key to verify your signature (signatures
> require a public key to decrypt).
>
> Someone else needs your public key to encrypt something to you that
> requires your private key to decrypt (encrypted messages require a
> private key to decrypt).
>

<!-- #ygrp-mlmsg {font-size:13px; font-family:
arial,helvetica,clean,sans-serif;*font-size:small;*font-small;}
#ygrp-mlmsg table {font-size:inherit;font:100%;} #ygrp-mlmsg select,
input, textarea {font:99% arial,helvetica,clean,sans-serif;}
#ygrp-mlmsg pre, code {font:115% monospace;*font-size:100%;}
#ygrp-mlmsg * {line-height:1.22em;} #ygrp-text{ font-family:
Georgia; } #ygrp-text p{ margin: 0 0 1em 0; } #ygrp-tpmsgs{
font-family: Arial; clear: both; } #ygrp-vitnav{ padding-top: 10px;
font-family: Verdana; font-size: 77%; margin: 0; } #ygrp-vitnav a{
padding: 0 1px; } #ygrp-actbar{ clear: both; margin: 25px 0;
white-space:nowrap; color: #666; text-align: right; } #ygrp-actbar
.left{ float: left; white-space:nowrap; } .bld{font-weight:bold;}
#ygrp-grft{ font-family: Verdana; font-size: 77%; padding: 15px 0; }
#ygrp-ft{ font-family: verdana; font-size: 77%; border-top: 1px
solid #666; padding: 5px 0; } #ygrp-mlmsg #logo{ padding-bottom:
10px; } #ygrp-vital{ background-color: #e0ecee; margin-bottom: 20px;
padding: 2px 0 8px 8px; } #ygrp-vital #vithd{ font-size: 77%;
font-family: Verdana; font-weight: bold; color: #333;
text-transform: uppercase; } #ygrp-vital ul{ padding: 0; margin: 2px
0; } #ygrp-vital ul li{ list-style-type: none; clear: both; border:
1px solid #e0ecee; } #ygrp-vital ul li .ct{ font-weight: bold;
color: #ff7900; float: right; width: 2em; text-align:right;
padding-right: .5em; } #ygrp-vital ul li .cat{ font-weight: bold; }
#ygrp-vital a { text-decoration: none; } #ygrp-vital a:hover{
text-decoration: underline; } #ygrp-sponsor #hd{ color: #999;
font-size: 77%; } #ygrp-sponsor #ov{ padding: 6px 13px;
background-color: #e0ecee; margin-bottom: 20px; } #ygrp-sponsor #ov
ul{ padding: 0 0 0 8px; margin: 0; } #ygrp-sponsor #ov li{
list-style-type: square; padding: 6px 0; font-size: 77%; }
#ygrp-sponsor #ov li a{ text-decoration: none; font-size: 130%; }
#ygrp-sponsor #nc { background-color: #eee; margin-bottom: 20px;
padding: 0 8px; } #ygrp-sponsor .ad{ padding: 8px 0; } #ygrp-sponsor
.ad #hd1{ font-family: Arial; font-weight: bold; color: #628c2a;
font-size: 100%; line-height: 122%; } #ygrp-sponsor .ad a{
text-decoration: none; } #ygrp-sponsor .ad a:hover{ text-decoration:
underline; } #ygrp-sponsor .ad p{ margin: 0; } o {font-size: 0; }
.MsoNormal { margin: 0 0 0 0; } #ygrp-text tt{ font-size: 120%; }
blockquote{margin: 0 0 0 4px;} .replbq {margin:4} -->

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Micah Salb wrote:
> (1) I have uploaded my public key to the four keyservers that showed up
> on the pull-down list in OpenPGP's Preferences. But I understand that
> it is a good idea to post your public key somewhere else on the internet
> as well so that people can conveniently get it and be confident that it
> is secure, right? How does one do customarily that?

This is a common misunderstanding. While it certainly does no harm to
put your key up on your own webpage, it doesn't give you any increased
security. It's a convenience thing done for those who aren't
comfortable using keyservers, mostly.

> (2) Does a PGP signature (and/or encryption) work ONLY for recipients
> who are using PGP?

Yes.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQEcBAEBCgAGBQJE9jXnAAoJELcA9IL+r4EJdpsH/26xYV09E6KprBm11Ma+zA4g
xfEhzfcgxAtun9zWcmMPdk2njvFNlYxmnoH+;UjxeMvQcX4oyxI4V4Ime4G3hpPno
M+uebPX+swPBtMQzg6AZ9ykXT5fJpKD7q8ef+96THYtfdWIHJcquspKIAb+ifbvZ
fdrsS+fuBbBBvVslwJwSXE5NVLGNiiPw0+Ib0V1mIy62cKyXyUenhNDIMQOyeaDv
nRMqrPU4ubVy8POus5iYZVArlxMXAyE09JmxnLEu72nzQPXqulch0LIVZuBzFsmu
YcDbhWJ82cEebMshgSEOY7028RbmO/mILomBp5tCiqtAXAQYGBS7SodLjpWICiQ=
=XQTX
-----END PGP SIGNATURE-----

here is one that is easer to work and its free go to ghostphrase.com and sign up gor the 2.5 verison pass it on to your friends and get back with me go program john andersen

----- Original Message ----
From: Michael Daigle <pgp-basicsgswot.org>
To: PGP-Basics on Yahoo! Groups * <pgp-basicsgswot.org>
Sent: Wednesday, August 30, 2006 6:04:23 PM
Subject: Re: URL for public key?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

In reply to Micah Salb's message sent 2006-08-30 17:33:

> Thank you for this explanation. By "Someone else needs an OpenPGP
&gt; encryption application (ie; GnuPG, PGP) to perform operations with
> OpenPGP messages and public keys."; you mean that they need PGP software
> to open message that I have signed or encrypted using OpenPGP, right?

Right.

&gt; So bearing in mind the relatively few people who have PGP software
> installed on their computers (and remembering the difficulty I have had
> getting it to work on my computer), doesn't this sharply reduce its
> usefulness (except among the congnoscenti) ?

Yes.

> (I had once had a PGP signature that recipients could open quite easily
&gt; without any special software.... .)

A digital signature is an encrypted message. It can't be decrypted
without special software. Sometimes it may seem as though you don't,
such as with the native support of X.509 certificates and S/MIME
messaging on the Windows platform, but these operations rely on
cryptographic features installed in the OS.

- --
List Moderator, PGP Encryption Help Team

Mike Daigle http://www.mikedaig le.ca
My PGP Key Send email with subject=pgpkey- request
Gossamer Spider Web of Trust http://www.gswot. org

-----BEGIN PGP SIGNATURE--- --
Comment: GSWoT:CA1 Gossamer Spider Web of Trust www.gswot.org
Comment: Mike Daigle Ontario, Canada www.mikedaigle. ca

iEYEAREDAAYFAkT2C74 ACgkQTvHh4CsVTmK IIQCfSIAeVW54n+ cyyTrVBQKCZsI7
vEUAoK4Ov7BTMLct0fC s3ArDHw4CvLGZ
=sHBm
-----END PGP SIGNATURE--- --

[Non-text portions of this message have been removed]