Debian gpg-rsaidea package
==========================

This is a Debian package of the RSA and IDEA algorithm modules from the GNU
Privacy Guard contrib archive.

Basic usage
===========

Edit one of the config files ~/.gnupg/options or /usr/share/gnupg/options.skel
and add lines as follows, for general usage:-

## Beginning of config-file-extract
load-extension rsa
load-extension idea	# only if you have also installed gpg-idea and
			# licensing is OK
rfc1991
cipher-algo idea	# only if you want total PGP compatibility; not
			# recommended
digest-algo md5		# PGP 2.x only supports MD5, but make sure you trust
			# it before doing this.
# Add the PGP keyrings
keyring ~/.pgp/pubring.pgp
secret-keyring ~/.pgp/secring.pgp

## End of config-file-extract

The old scripts
===============

It also includes a script to replace the default /usr/bin/gpg to add basic
PGP 2.x compatibility by default (it diverts the real GPG to
/usr/bin/gpg.gnupg). This script will tell GnuPG to load the RSA and IDEA
modules, and to read public and/or secret keys from their default PGP
locations in $HOME/.pgp in addition to their GPG locations. If you want to
generate encrypted data compatible with PGP 2.x, use the script
/usr/bin/gpg-pgp instead of /usr/bin/gpg, which will tell GPG to use IDEA as
the default cipher in addition (not good if you use real GPG, i.e. DSA and/or
ElGamal keys).

NB that this script is by default put in /usr/doc/gpg-rsa/examples, because
it can break a couple of things, and lots of people (including myself)
think its broken.

Notes about IDEA:
=================

IDEA has a horrible software patent on it that doesn't run out anytime soon.
IDEA is required for the following operations:-

* Encrypting data so it can be read by someone using PGP 2.x
* Decrypting data encrypted by someone using PGP 2.x (or IDEA with GPG or
  PGP 5.x)
* Using the passphrase on a key as generated by PGP 2.x (includes signing).

Best policy if you want to get rid of IDEA completely is to remove your
passphrase with PGP, and add a new one with GPG (which will use Blowfish
or some other algorithm not patented). This will allow you to sign, and
also encrypt to PGP 5.x users, while still keeping your old RSA key.

Verifying signatures works perfectly without IDEA in all circumstances.

Mutt
====

This means that, at least with mutt 0.94 and newer, you can put this in
.muttrc:-

set pgp_default_version=gpg

and mutt will use GPG to verify PGP signatures and decrypt PGP data (by
PGP I mean PGP 2.x using RSA and IDEA).

To use RSA encryption do the following in mutt:-

set pgp_gpg=/usr/bin/gpg-pgp

Signatures work fine without this; it's only real encryption that needs it.
The only bit of functionality from PGP 2.x this doesn't add is RSA key
generation.

NB you also need to add a script for gpgm if you want key management to
work properly from within mutt if you use the script method. Otherwise, just
set up the options file as appropriate.

dpkg-buildpackage (and cvs-buildpackage)
========================================

To use it with dpkg-buildpackage, use the arguments "-sgpg -pgpg", eg

dpkg-buildpackage -rfakeroot -sgpg -p/usr/bin/gpg -tc

For cvs-buildpackage, add something like this to /etc/cvsdeb.conf

dpkg_options=("-sgpg" "-p/usr/bin/gpg" "${dpkg_options[@]}").

Also, I had to patch /usr/bin/dpkg-buildpackage with this to coax it
into working (don't know why it was like this, but it's wrong), this
was dpkg-dev 1.4.0.31:-

--- dpkg-buildpackage	Mon Jan 11 18:32:54 1999
+++ /usr/bin/dpkg-buildpackage	Mon Jan 11 18:19:43 1999
@@ -120,7 +120,7 @@
 	if test $signinterface = gpg ; then
 		# --textmode doesn't seem to work; we use perl to filter ^M;
 		# this doesn't affect the actual signature.
-		(cat "../$1"; echo "" ) | \
+		(cat "../$1" ) | \
 		$signcommand --local-user "$maintainer" --clearsign --armor \
 			--textmode --output - - | \
 			perl -n -p -e 's/\r$//' > "../$1.asc" 

Note that if you have a DSA or whatever key in your .gnupg/<blah> files,
you'd better add a comment to the UID, or dpkg will sign with that key.
If you don't like this, file a wishlist bug report against gnupg, asking
for a "--no-default-keyrings" option to remove all the default keyrings,
and add that to the command-line (if it gets implemented).

About the source:-
==================

The rsa.c.Z and idea.c.Z files are both preserved unmodified from the
archive on ftp.guug.de/pub/gcrypt/contrib (although I downloaded them from
ftp.net.lut.ac.uk/gcrypt/contrib). If you are at all serious about
the security of the encryption/sygning offered, download these sources
yourself, and verify I have not modified them. You might also want to
verify they do what they say. NB the same is true with any crypto software;
you want to be VERY sure there aren't any trojans or backdoors ANYWHERE.
 