Encryption Made Easy with kgpg and the KDE Desktop 185

In this technique, we also show you ways to keep your e-mail private. Encrypting e-mail adds a new level of security, enabling you to prevent Peeping Toms from reading your e-mail as it travels across the Internet. Add a digital signature to your e-mail messages for extra protection. If your message is tampered with, the recipient knows (because the signature is invalid).

Encryption Made Easy with kgpg and the KDE Desktop

If you’re working in a desktop environment, a graphical package such as kgpg makes gpg encryption much faster and easier to use. You still may need to return to the command line if you’re encrypting an entire directory tree, but for most of your everyday needs, a graphical tool works great.

kgpg is a user interface that works with the KDE Desktop to make using and managing gpg keys easy and fast. With kgpg, you can encrypt and decrypt files on your desktop in seconds.

To get started, you need to create a pair of keys (a public key and a private key). See the section titled “Creating keys with kgpg,” later in this technique, for details.

To send encrypted e-mail (or e-mail that contains a digital signature), you have to publish your public key. See the section titled “Sharing your key with the world,” later in this technique, for more information.

To read an encrypted e-mail message (or other secure document), you need to import a public key first. See the section titled “Importing a public key from a public-key server,” later in this technique, to understand the process.

To encrypt documents that need to be secure, see the section, “Encrypting documents on your home system.”

kgpg is part of the kdeutils package in KDE Versions 3.2 and later. If you’re using an older version of KDE, search the Web for a kgpg RPM package that matches your version.

Creating keys with kgpg

gpg keys (both public and private) are stored in a key ring (which is a set of files in your ~/.gnupg directory). The first time you run kgpg, it offers to create a new gpg key pair (unless you’ve already created a key pair with another tool). Here’s what you need to do to create a key pair:

1. Open KGpg:

To open kgpg on Fedora Linux, open the Main Menu and choose Accessories More Accessories KGpg.

If you’re using SuSE, open the Main Menu and choose System Security KGpg.

On Mandrake, find kgpg by opening the Main Menu and choosing System Other KGpg.

2. In the dialog that appears, click Yes.

The Key Generation dialog opens, as shown in Figure 28-1.

3. Enter your name, e-mail address, and a comment and then click OK.

Enter your first name for the real name, your last name for the comment, and your real e-mail address. When you publish your public key on a public-key server, it appears as name(comment)[e-mail], so everyone can tell with a glance who owns the public key.

The passphrase dialog appears, as shown in Figure 28-2.

4. Enter a passphrase in the Password field and then reenter it in the Verify field. Click OK to continue.

186 Technique 28: Using Encryption for Extra Security

After you’ve created a key pair, the taskbar icon becomes your interface to kgpg. Click the taskbar icon and choose Open Key Manager from the menu. The Key Management window opens, showing the key you’ve just created (see Figure 28-4).

• Figure 28-1: The Key Generation dialog.

It’s important to keep your private key private. If gpg simply stored your private key in plain text, anyone with access to your home directory could use your private key. Instead, gpg protects your key ring with a passphrase. You must provide the passphrase whenever you want to encrypt, decrypt, and sign documents. Don’t give out your passphrase, or others will be able to decrypt documents encrypted with your key.

• Figure 28-2: The passphrase dialog.

After you click OK in Step 4, the Tip of the Day window opens. Look carefully, and you’ll notice that an icon has been added to the taskbar. The icon looks like a padlock covering a sheet of paper, as shown in the lower-right corner of Figure 28-3. This means your key has been created.

• Figure 28-3: The kgpg icon is now included on the taskbar.

From the Key Management window, you can export your key (to a file, to the clipboard, or to an e-mail message), get key information, sign your key, make changes to your keys, import other keys, generate new key pairs, and more.

• Figure 28-4: The Key Management window.

Sharing your key with the world

After you have an encryption key pair, you need to publish the public part. Other people can encrypt

Encryption Made Easy with kgpg and the KDE Desktop 187

private messages with your public key, but you’re the only person who can decrypt these messages because you hold the private key. When you send an e-mail, sign the message with your private key and the recipient can use your public key to verify that the message really came from you. How do you distribute your public key? Use a public-key server.

A public-key server is a directory that lists people and their public keys. kgpg knows how to export your public key to a key server and how to import keys from a key server. kgpg is preconfigured to talk to two public-key servers, but you can add more servers if you want to.

To publish your public key, follow these steps:

1. Click the kgpg taskbar icon (which looks like a padlock; refer to Figure 28-3) and choose Open Key Manager from the menu.

The Key Management window opens (refer to Figure 28-4).

2. Choose File Key Server Dialog (or click the toolbar icon that looks like a globe).

The Key Server Operation dialog appears.

3. Select the Export tab.

The dialog displays two drop-down lists, as shown in Figure 28-5.

4. Use the Key Server drop-down list to choose the server that you want to distribute your key.

5. Use the Key to Be Exported list to select the public key that you want to export.

6. After you’ve chosen the server and key to be exported, click Export.

Now that you’ve published yourself, your friends can find your public key on the server that you chose. (Many servers share their public keys with other servers, so after you’ve published your public key, it appears on other servers as well.) With your public key, someone can send encrypted e-mail to you, and no one else can read the e-mail.

• Figure 28-5: The Export tab of the Key Server Operation dialog.

Importing a public key from a public-key server

You can also use kgpg to locate and import keys from a public-key server. Here’s how to find and import keys:

1. Click the kgpg taskbar icon (which looks like a padlock) and choose Open Key Manager from the menu.

The Key Management window opens.

2. Choose File Key Server Dialog (or click the toolbar icon that looks like a globe).

The Key Server Operation dialog appears.

3. Select the Import tab.

4. Choose a public-key server from the top list box and enter the name or e-mail address of the person you’d like to contact in the second field.

You can choose any of the public-key servers listed; they all talk to each other and share the same database of public keys.

5. Click the Search button to continue.

The Search Result dialog appears, as shown in Figure 28-6.

Common names are likely to yield many results. Search by e-mail address to narrow the field a bit.

188 Technique 28: Using Encryption for Extra Security

The newly encrypted file appears in the same directory as the original: The encrypted version has .asc tacked on to the end of the filename. kgpg doesn’t delete the original version.

•Figure 28-6: The Search Result dialog.

6.When you find the key you’re looking for, click the key and then click Import to import that key.

After you’ve imported a public key into your key ring, you can encrypt e-mail (and other documents) with that key. The only person who can decrypt that e-mail is the person who holds the matching private key.

Encrypting and decrypting documents with drag-and-drop ease

kpgp is well-integrated with the rest of KDE, making it quick and easy to encrypt and decrypt files.

Keep private information private by encrypting your personal files. After encrypting a file, delete the unencrypted version. Decrypt the file again when you need it. Only those entrusted with your passphrase can read your private documents.

To encrypt a document, follow these steps:

1. Open Konqueror and browse to the directory that contains the file you want to encrypt.

2. Right-click the file icon and choose Encrypt File from the menu.

The Encryption dialog opens, as shown in

Figure 28-7.

3. Highlight the key you want to use and then click Encrypt.

kgpg encrypts the file with your public key; that way, only someone with the matching private key (that would be you) can decrypt the file.

• Figure 28-7: The Encryption dialog.

4. If you want to keep the content private, be sure to delete the unencrypted version.

To decrypt an encrypted file, follow these steps:

1. Click the encrypted file in your Konqueror browser.

Konqueror asks for the passphrase to unlock your private key.

2. Enter the proper passphrase.

kgpg decrypts the file and saves it in the same directory as the encrypted version (the name of the encrypted version ends with the extension

.asc; the decrypted version does not). The newly decrypted file appears in your browser window.

3. To view a decrypted file in a simple text browser (without saving it), drag the file icon onto the kgpg icon in the taskbar, and choose Show Decrypted File from the menu.

If you drag an unencrypted document to the trash to delete it, it’s still there (and still exposed) until you empty the trash. To really