1 \input texinfo @c -*- mode: texinfo -*-
3 @setfilename ../../info/epa
4 @settitle EasyPG Assistant User's Manual
10 This file describes EasyPG Assistant @value{VERSION}.
12 Copyright @copyright{} 2007, 2008, 2009, 2010 Free Software Foundation, Inc.
15 Permission is granted to copy, distribute and/or modify this document
16 under the terms of the GNU Free Documentation License, Version 1.3 or
17 any later version published by the Free Software Foundation; with no
18 Invariant Sections, with the Front-Cover texts being ``A GNU Manual,''
19 and with the Back-Cover Texts as in (a) below. A copy of the license
20 is included in the section entitled ``GNU Free Documentation License''
23 (a) The FSF's Back-Cover Text is: ``You have the freedom to copy and
24 modify this GNU manual. Buying copies from the FSF supports it in
25 developing GNU and promoting software freedom.''
27 This document is part of a collection distributed under the GNU Free
28 Documentation License. If you want to distribute this document
29 separately from the collection, you can do so by adding a copy of the
30 license to the document, as described in section 6 of the license.
36 * EasyPG Assistant: (epa). An Emacs user interface to GNU Privacy Guard.
40 @title EasyPG Assistant
45 @vskip 0pt plus 1filll
52 @top EasyPG Assistant user's manual
54 EasyPG Assistant is an Emacs user interface to GNU Privacy Guard
55 (GnuPG, @pxref{Top, , Top, gnupg, Using the GNU Privacy Guard}).
57 EasyPG Assistant is a part of the package called EasyPG, an all-in-one
58 GnuPG interface for Emacs. EasyPG also contains the library interface
59 called EasyPG Library.
69 * Caching Passphrases::
76 EasyPG Assistant provides the following features.
80 @item Cryptographic operations on regions.
81 @item Cryptographic operations on files.
82 @item Dired integration.
83 @item Mail-mode integration.
84 @item Automatic encryption/decryption of *.gpg files.
90 EasyPG Assistant commands are prefixed by @samp{epa-}. For example,
93 @item To browse your keyring, type @kbd{M-x epa-list-keys}
95 @item To create a cleartext signature of the region, type @kbd{M-x epa-sign-region}
97 @item To encrypt a file, type @kbd{M-x epa-encrypt-file}
100 EasyPG Assistant provides several cryptographic features which can be
101 integrated into other Emacs functionalities. For example, automatic
102 encryption/decryption of @samp{*.gpg} files.
107 This chapter introduces various commands for typical use cases.
111 * Cryptographic operations on regions::
112 * Cryptographic operations on files::
113 * Dired integration::
114 * Mail-mode integration::
115 * Encrypting/decrypting *.gpg files::
119 @section Key management
120 Probably the first step of using EasyPG Assistant is to browse your
121 keyring. @kbd{M-x epa-list-keys} is corresponding to @samp{gpg
122 --list-keys} from the command line.
124 @deffn Command epa-list-keys name mode
125 Show all keys matched with @var{name} from the public keyring.
129 The output looks as follows.
132 u A5B6B2D4B15813FE Daiki Ueno <ueno@@unixuser.org>
136 A character on the leftmost column indicates the trust level of the
137 key. If it is @samp{u}, the key is marked as ultimately trusted. The
138 second column is the key ID, and the rest is the user ID.
140 You can move over entries by @key{TAB}. If you type @key{RET} or
141 click button1 on an entry, you will see more detailed information
142 about the key you selected.
145 u Daiki Ueno <ueno@@unixuser.org>
146 u A5B6B2D4B15813FE 1024bits DSA
149 Capabilities: sign certify
150 Fingerprint: 8003 7CD0 0F1A 9400 03CA 50AA A5B6 B2D4 B158 13FE
151 u 4447461B2A9BEA2D 2048bits ELGAMAL_E
154 Capabilities: encrypt
155 Fingerprint: 9003 D76B 73B7 4A8A E588 10AF 4447 461B 2A9B EA2D
159 To browse your private keyring, use @kbd{M-x epa-list-secret-keys}.
161 @deffn Command epa-list-secret-keys name
162 Show all keys matched with @var{name} from the private keyring.
166 In @samp{*Keys*} buffer, several commands are available. The common
167 use case is to export some keys to a file. To do that, type @kbd{m}
168 to select keys, type @kbd{o}, and then supply the filename.
170 Below are other commands related to key management. Some of them take
171 a file as input/output, and others take the current region.
173 @deffn Command epa-insert-keys keys
174 Insert selected @var{keys} after the point. It will let you select
175 keys before insertion. By default, it will encode keys in the OpenPGP
179 @deffn Command epa-import-keys file
180 Import keys from @var{file} to your keyring.
183 @deffn Command epa-import-keys-region start end
184 Import keys from the current region between @var{start} and @var{end}
188 @deffn Command epa-import-armor-in-region start end
189 Import keys in the OpenPGP armor format in the current region between
190 @var{start} and @var{end}. The difference from
191 @code{epa-import-keys-region} is that
192 @code{epa-import-armor-in-region} searches armors in the region and
193 applies @code{epa-import-keys-region} to each of them.
196 @deffn Command epa-delete-keys allow-secret
197 Delete selected keys. If @var{allow-secret} is non-@code{nil}, it
198 also delete the secret keys.
201 @node Cryptographic operations on regions
202 @section Cryptographic operations on regions
204 @deffn Command epa-decrypt-region start end
205 Decrypt the current region between @var{start} and @var{end}. It
206 replaces the region with the decrypted text.
209 @deffn Command epa-decrypt-armor-in-region start end
210 Decrypt OpenPGP armors in the current region between @var{start} and
211 @var{end}. The difference from @code{epa-decrypt-region} is that
212 @code{epa-decrypt-armor-in-region} searches armors in the region
213 and applies @code{epa-decrypt-region} to each of them. That is, this
214 command does not alter the original text around armors.
217 @deffn Command epa-verify-region start end
218 Verify the current region between @var{start} and @var{end}. It sends
219 the verification result to the minibuffer or a popup window. It
220 replaces the region with the signed text.
223 @deffn Command epa-verify-cleartext-in-region
224 Verify OpenPGP cleartext blocks in the current region between
225 @var{start} and @var{end}. The difference from
226 @code{epa-verify-region} is that @code{epa-verify-cleartext-in-region}
227 searches OpenPGP cleartext blocks in the region and applies
228 @code{epa-verify-region} to each of them. That is, this command does
229 not alter the original text around OpenPGP cleartext blocks.
232 @deffn Command epa-sign-region start end signers type
233 Sign the current region between @var{start} and @var{end}. By
234 default, it creates a cleartext signature. If a prefix argument is
235 given, it will let you select signing keys, and then a signature
239 @deffn Command epa-encrypt-region start end recipients sign signers
240 Encrypt the current region between @var{start} and @var{end}. It will
241 let you select recipients. If a prefix argument is given, it will
242 also ask you whether or not to sign the text before encryption and if
243 you answered yes, it will let you select the signing keys.
246 @node Cryptographic operations on files
247 @section Cryptographic operations on files
249 @deffn Command epa-decrypt-file file
253 @deffn Command epa-verify-file file
257 @deffn Command epa-sign-file file signers type
258 Sign @var{file}. If a prefix argument is given, it will let you
259 select signing keys, and then a signature type.
262 @deffn Command epa-encrypt-file file recipients
263 Encrypt @var{file}. It will let you select recipients.
266 @node Dired integration
267 @section Dired integration
269 EasyPG Assistant extends Dired Mode for GNU Emacs to allow users to
270 easily do cryptographic operations on files. For example,
275 : e (or M-x epa-dired-do-encrypt)
276 (select recipients by 'm' and click [OK])
280 The following keys are assigned.
285 @findex epa-dired-do-decrypt
286 Decrypt marked files.
290 @findex epa-dired-do-verify
295 @findex epa-dired-do-sign
300 @findex epa-dired-do-encrypt
301 Encrypt marked files.
305 @node Mail-mode integration
306 @section Mail-mode integration
308 EasyPG Assistant provides a minor mode @code{epa-mail-mode} to help
309 user compose inline PGP messages. Inline PGP is a traditional style
310 of sending signed/encrypted emails by embedding raw OpenPGP blobs
311 inside a message body, not using modern MIME format.
313 NOTE: Inline PGP is not recommended and you should consider to use
315 @uref{http://josefsson.org/inline-openpgp-considered-harmful.html,
316 Inline PGP in E-mail is bad, Mm'kay?}.
319 Once @code{epa-mail-mode} is enabled, the following keys are assigned.
320 You can do it by @kbd{C-u 1 M-x epa-mail-mode} or through the Customize
321 interface. Try @kbd{M-x customize-variable epa-global-mail-mode}.
325 @kindex @kbd{C-c C-e d}
326 @findex epa-mail-decrypt
327 Decrypt OpenPGP armors in the current buffer.
330 @kindex @kbd{C-c C-e v}
331 @findex epa-mail-verify
332 Verify OpenPGP cleartext signed messages in the current buffer.
335 @kindex @kbd{C-c C-e s}
336 @findex epa-mail-sign
337 Compose a signed message from the current buffer.
340 @kindex @kbd{C-c C-e e}
341 @findex epa-mail-encrypt
342 Compose an encrypted message from the current buffer.
343 By default it tries to build the recipient list from @samp{to},
344 @samp{cc}, and @samp{bcc} fields of the mail header. To include your
345 key in the recipient list, use @samp{encrypt-to} option in
346 @file{~/.gnupg/gpg.conf}.
350 @node Encrypting/decrypting *.gpg files
351 @section Encrypting/decrypting *.gpg files
352 By default, every file whose extension is @samp{.gpg} will be treated
353 as encrypted. That is, when you attempt to open such a file which
354 already exists, the decrypted text is inserted in the buffer rather
355 than encrypted one. On the other hand, when you attempt to save the
356 buffer to a file whose extension is @samp{.gpg}, encrypted data is
359 If you want to temporarily disable this behavior, use @kbd{M-x
360 epa-file-disable}, and then to enable this behavior use @kbd{M-x
363 @deffn Command epa-file-disable
364 Disable automatic encryption/decryption of *.gpg files.
367 @deffn Command epa-file-enable
368 Enable automatic encryption/decryption of *.gpg files.
372 @code{epa-file} will let you select recipients. If you want to
373 suppress this question, it might be a good idea to put the following
374 line on the first line of the text being encrypted.
375 @vindex epa-file-encrypt-to
379 ;; -*- epa-file-encrypt-to: ("ueno@@unixuser.org") -*-
383 The file name extension of encrypted files can be controlled by
384 @var{epa-file-name-regexp}.
386 @defvar epa-file-name-regexp
387 Regexp which matches filenames treated as encrypted.
390 Other variables which control the automatic encryption/decryption
393 @defvar epa-file-cache-passphrase-for-symmetric-encryption
394 If non-@code{nil}, cache passphrase for symmetric encryption. The
395 default value is @code{nil}.
398 @defvar epa-file-inhibit-auto-save
399 If non-@code{nil}, disable auto-saving when opening an encrypted file.
400 The default value is @code{t}.
403 @node Caching Passphrases
404 @chapter Caching Passphrases
406 Typing passphrases is an irritating task if you frequently open and
407 close the same file. GnuPG and EasyPG Assistant provide mechanisms to
408 remember your passphrases. However, the configuration is a bit
409 confusing since it depends on your GnuPG installation (GnuPG version 1 or
410 GnuPG version 2), encryption method (symmetric or public key), and whether or
411 not you want to use gpg-agent. Here are some questions:
414 @item Do you use GnuPG version 2 instead of GnuPG version 1?
415 @item Do you use symmetric encryption rather than public key encryption?
416 @item Do you want to use gpg-agent?
419 Here are configurations depending on your answers:
421 @multitable {111} {222} {333} {configuration configuration configuration}
422 @item @b{1} @tab @b{2} @tab @b{3} @tab Configuration
423 @item Yes @tab Yes @tab Yes @tab Set up gpg-agent.
424 @item Yes @tab Yes @tab No @tab You can't, without gpg-agent.
425 @item Yes @tab No @tab Yes @tab Set up gpg-agent.
426 @item Yes @tab No @tab No @tab You can't, without gpg-agent.
427 @item No @tab Yes @tab Yes @tab Set up elisp passphrase cache.
428 @item No @tab Yes @tab No @tab Set up elisp passphrase cache.
429 @item No @tab No @tab Yes @tab Set up gpg-agent.
430 @item No @tab No @tab No @tab You can't, without gpg-agent.
433 To set up gpg-agent, follow the instruction in GnuPG manual.
434 @pxref{Invoking GPG-AGENT, , Invoking GPG-AGENT, gnupg}.
436 To set up elisp passphrase cache, set
437 @code{epa-file-cache-passphrase-for-symmetric-encryption}.
438 @xref{Encrypting/decrypting *.gpg files}.
443 Bugs and problems with EasyPG Assistant are actively worked on by the
444 Emacs development team. Feature requests and suggestions are also
445 more than welcome. Use @kbd{M-x report-emacs-bug}, @pxref{Bugs, ,
446 Bugs, emacs, Reporting Bugs}.
448 When submitting a bug report, please try to describe in excruciating
449 detail the steps required to reproduce the problem. Also try to
450 collect necessary information to fix the bug, such as:
453 @item the GnuPG version. Send the output of @samp{gpg --version}.
454 @item the GnuPG configuration. Send the contents of @file{~/.gnupg/gpg.conf}.
457 Before reporting the bug, you should set @code{epg-debug} in the
458 @file{~/.emacs} file and repeat the bug. Then, include the contents
459 of the @samp{ *epg-debug*} buffer. Note that the first letter of the
460 buffer name is a whitespace.
467 arch-tag: 7404e246-7d4c-4db4-9332-c1293a455a4f