PGP Command Line User's Guide

(1)

PGP® Command Line 10.0

(2)

(3)

Version Information

PGP Command Line User's Guide. PGP Command Line Version 10.0.0. Released March 2010.

Copyright Information

Copyright © 1991-2010 by PGP Corporation. All Rights Reserved. No part of this document can be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of PGP Corporation.

Trademark Information

PGP, Pretty Good Privacy, and the PGP logo are registered trademarks of PGP Corporation in the US and other countries. IDEA is a trademark of Ascom Tech AG. Windows and ActiveX are registered trademarks of Microsoft Corporation. AOL is a registered trademark, and AOL Instant Messenger is a trademark, of America Online, Inc. Red Hat and Red Hat Linux are trademarks or registered trademarks of Red Hat, Inc. Linux is a registered trademark of Linus Torvalds. Solaris is a trademark or registered trademark of Sun Microsystems, Inc. AIX is a trademark or registered trademark of International Business Machines Corporation. HP-UX is a trademark or registered trademark of Hewlett-Packard Company. SSH and Secure Shell are trademarks of SSH Communications Security, Inc. Rendezvous and Mac OS X are trademarks or registered trademarks of Apple Computer, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners.

Licensing and Patent Information

The IDEA cryptographic cipher described in U.S. patent number 5,214,703 is licensed from Ascom Tech AG. The CAST-128 encryption algorithm, implemented from RFC 2144, is available worldwide on a royalty-free basis for commercial and non-commercial uses. PGP Corporation has secured a license to the patent rights contained in the patent application Serial Number 10/655,563 by The Regents of the University of California, entitled Block Cipher Mode of Operation for Constructing a Wide-blocksize block Cipher from a Conventional Block Cipher. Some third-party software included in PGP Universal Server is licensed under the GNU General Public License (GPL). PGP Universal Server as a whole is not licensed under the GPL. If you would like a copy of the source code for the GPL software included in PGP Universal Server, contact PGP Support (https://support.pgp.com). PGP Corporation may have patents and/or pending patent applications covering subject matter in this software or its documentation; the furnishing of this software or documentation does not give you any license to these patents.

Acknowledgments

This product includes or may include:

-- The Zip and ZLib compression code, created by Mark Adler and Jean-Loup Gailly, is used with permission from the free Info-ZIP implementation, developed by zlib (http://www.zlib.net). -- Libxml2, the XML C parser and toolkit developed for the Gnome project and distributed and copyrighted under the MIT License found at http://www.opensource.org/licenses/mit-license.html. Copyright © 2007 by the Open Source Initiative. -- bzip2 1.0, a freely available high-quality data compressor, is copyrighted by Julian Seward, © 1996-2005. -- Application server (http://jakarta.apache.org/), web server (http://www.apache.org/), Jakarta Commons (http://jakarta.apache.org/commons/license.html) and log4j, a Java-based library used to parse HTML, developed by the Apache Software Foundation. The license is at www.apache.org/licenses/LICENSE-2.0.txt. -- Castor, an open-source, data-binding framework for moving data from XML to Java programming language objects and from Java to databases, is released by the ExoLab Group under an Apache 2.0-style license, available at http://www.castor.org/license.html. -- Xalan, an open-source software library from the Apache Software Foundation that implements the XSLT XML transformation language and the XPath XML query language, is released under the Apache Software License, version 1.1, available at http://xml.apache.org/xalan-j/#license1.1. -- Apache Axis is an implementation of the SOAP ("Simple Object Access Protocol") used for communications between various PGP products is provided under the Apache license found at

http://www.apache.org/licenses/LICENSE-2.0.txt. -- mx4j, an open-source implementation of the Java Management Extensions (JMX), is released under an Apache-style license, available at http://mx4j.sourceforge.net/docs/ch01s06.html. -- jpeglib version 6a is based in part on the work of the

Independent JPEG Group. (http://www.ijg.org/) -- libxslt the XSLT C library developed for the GNOME project and used for XML transformations is distributed under the MIT License http://www.opensource.org/licenses/mit-license.html. -- PCRE Perl regular expression compiler, copyrighted and distributed by University of Cambridge. ©1997-2006. The license agreement is at http://www.pcre.org/license.txt. -- BIND Balanced Binary Tree Library and Domain Name System (DNS) protocols developed and copyrighted by Internet Systems Consortium, Inc. (http://www.isc.org) -- Free BSD implementation of daemon developed by The FreeBSD Project, © 1994-2006. -- Simple Network Management Protocol Library developed and copyrighted by Carnegie Mellon University © 1989, 1991, 1992, Networks Associates Technology, Inc, © 2001- 2003, Cambridge Broadband Ltd. © 2001- 2003, Sun Microsystems, Inc., © 2003, Sparta, Inc, © 2003-2006, Cisco, Inc and Information Network Center of Beijing University of Posts and Telecommunications, © 2004. The license agreement for these is at http://net-snmp.sourceforge.net/about/license.html. -- NTP version 4.2 developed by Network Time Protocol and copyrighted to various contributors. -- Lightweight Directory Access Protocol developed and copyrighted by OpenLDAP Foundation. OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). Copyright © 1999-2003, The OpenLDAP Foundation. The license agreement is at http://www.openldap.org/software/release/license.html. Secure shell OpenSSH developed by OpenBSD project is released by the OpenBSD Project under a BSD-style license, available at

http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/LICENCE?rev=HEAD. -- PC/SC Lite is a free implementation of PC/SC, a specification for SmartCard integration is released under the BSD license. -- Postfix, an open source mail transfer agent (MTA), is released under the IBM Public License 1.0, available at

http://www.opensource.org/licenses/ibmpl.php. -- PostgreSQL, a free software object-relational database management system, is released under a BSD-style license, available at http://www.postgresql.org/about/licence. -- PostgreSQL JDBC driver, a free Java program used to connect to a PostgreSQL database using standard, database independent Java code, (c) 1997-2005, PostgreSQL Global Development Group, is released under a BSD-style license, available at http://jdbc.postgresql.org/license.html. -- PostgreSQL Regular Expression Library, a free software object-relational database management system, is released under a BSD-style license, available at http://www.postgresql.org/about/licence. -- 21.vixie-cron is the Vixie version of cron, a standard UNIX daemon that runs specified programs at scheduled times. Copyright © 1993, 1994 by Paul Vixie; used by permission. -- JacORB, a Java object used to facilitate communication between processes written in Java and the data layer, is open source licensed under the GNU Library General Public License (LGPL) available at http://www.jacorb.org/lgpl.html. Copyright © 2006 The JacORB Project. -- TAO (The ACE ORB) is an open-source implementation of a CORBA Object Request Broker (ORB), and is used for communication between processes written in C/C++ and the data layer. Copyright (c) 1993-2006 by Douglas C. Schmidt and his research group at Washington University, University of California, Irvine, and Vanderbilt University. The open source software license is available at http://www.cs.wustl.edu/~schmidt/ACE-copying.html. -- libcURL, a library for downloading files via common network services, is open source software provided under a MIT/X derivate license available at

http://curl.haxx.se/docs/copyright.html. Copyright (c) 1996 - 2007, Daniel Stenberg. -- libuuid, a library used to generate unique identifiers, is released under a BSD-style license, available at http://thunk.org/hg/e2fsprogs/?file/fe55db3e508c/lib/uuid/COPYING. Copyright (C) 1996, 1997 Theodore Ts'o. -- libpopt, a library that parses command line options, is released under the terms of the GNU Free Documentation License available at

http://directory.fsf.org/libs/COPYING.DOC. Copyright © 2000-2003 Free Software Foundation, Inc. -- gSOAP, a development tool for Windows clients to communicate with the Intel Corporation AMT chipset on a motherboard, is distributed under the gSOAP Public License version 1.3b, available at

(4)

4

under the Common Public License v1.0 found at http://opensource.org/licenses/cpl1.0.php. -- The Perl Kit provides several independent utilities used to automate a variety of maintenance functions and is provided under the Perl Artistic License, found at

http://www.perl.com/pub/a/language/misc/Artistic.html. -- rEFIt - libeg, provides a graphical interface library for EFI, including image rendering, text rendering, and alpha blending, and is distributed under the license found at

http://refit.svn.sourceforge.net/viewvc/*checkout*/refit/trunk/refit/LICENSE.txt?revision=288. Copyright (c) 2006 Christoph Pfisterer. All rights reserved. -- Java Radius Client, used to authenticate PGP Universal Web Messenger users via Radius, is distributed under the Lesser General Public License (LGPL) found at http://www.gnu.org/licenses/lgpl.html. -- Yahoo! User Interface (YUI) library version 2.5.2, a Web UI interface library for AJAX. Copyright (c) 2009, Yahoo! Inc. All rights reserved. Released under a BSD-style license, available at http://developer.yahoo.com/yui/license.html. -- JSON-lib version 2.2.1, a Java library used to convert Java objects to JSON (JavaScript Object Notation) objects for AJAX. Distributed under the Apache 2.0 license, available at http://json-lib.sourceforge.net/license.html. -- EZMorph, used by JSON-lib, is distributed under the Apache 2.0 license, available at http://ezmorph.sourceforge.net/license.html. -- Apache Commons Lang, used by JSON-lib, is distributed under the Apache 2.0 license, available at

http://commons.apache.org/license.html. -- Apache Commons BeanUtils, used by JSON-lib, is distributed under the Apache 2.0 license, available at

http://commons.apache.org/license.html. -- SimpleIni is an .ini format file parser and provides the ability to read and write .ini files, a common configuration file format used on Windows, on other platforms. Distributed under the MIT License found at http://www.opensource.org/licenses/mit-license.html. Copyright 2006-2008, Brodie Thiesfield. -- uSTL provides a small fast implementation of common Standard Template Library functions and data structures and is distributed under the MIT License found at http://www.opensource.org/licenses/mit-license.html. Copyright (c) 2005-2009 by Mike Sharov <[email protected]>. -- Protocol Buffers (protobuf), Google's data interchange format, are used to serialize structure data in the PGP SDK. Distributed under the BSD license found at http://www.opensource.org/licenses/bsd-license.php. Copyright 2008 Google Inc. All rights reserved.

Additional acknowledgements and legal notices are included as part of the PGP Universal Server.

Export Information

Export of this software and documentation may be subject to compliance with the rules and regulations promulgated from time to time by the Bureau of Export Administration, United States Department of Commerce, which restricts the export and re-export of certain products and technical data.

Limitations

The software provided with this documentation is licensed to you for your individual use under the terms of the End User License Agreement provided with the software. The information in this document is subject to change without notice. PGP Corporation does not warrant that the information meets your requirements or that the information is free of errors. The information may include technical inaccuracies or typographical errors. Changes may be made to the information and incorporated in new editions of this document, if and when made available by PGP Corporation.

(5)

i

PGP Command Line Basics

1

Important Concepts 1

Getting Started 2

Installation 5

Overview 5

System Requirements 6

Windows 7 and Vista 6

Windows Server 2003 7 Windows XP 8 Windows 2000 9 IBM AIX 10 HP-UX 11i 10 Solaris 9 and 10 10

Red Hat Enterprise Linux and Fedora Core 10

Mac OS X 11

Installing on AIX 11

Changing the Home Directory on AIX 12

Uninstalling on AIX 13

Installing on HP-UX 13

Changing the Home Directory on HP-UX 14

Installing to a Non-Default Directory on HP-UX 14

Uninstalling on HP-UX 15

Installing on Mac OS X 15

Changing the Home Directory on Mac OS X 16

Uninstalling on Mac OS X 16

Installing on Red Hat Enterprise Linux or Fedora Core 17

Changing the Home Directory on Linux or Fedora Core 18

Uninstalling on Linux or Fedora Core 18

Installing on Solaris 19

Changing the Home Directory on Solaris 20

Uninstalling on Solaris 20

Installing on Windows 21

PGP Command Line for Windows and PGP Desktop on the Same System 21

To Install on Windows 21

Changing the Home Directory on Windows 22

(6)

ii

Licensing 25

Overview 25

License Recovery 26

Using a License Number 27

Using a License Authorization 28

Re-Licensing 29

Through a Proxy Server 30

The Command-Line Interface

33

Overview 33

Flags and Arguments 35

Flags 35

Arguments 36

Configuration File 38

Keyserver Configuration File Settings 42

Environment Variables 43

Standard Input, Output, and Error 44

Redirecting an Existing File 44

Entering Data 45 Specifying a Key 46 'Secure' Options 46 Passphrases 47

First Steps

49

Overview 49

Creating Your Keypair 50

Protecting Your Private Key 52

Distributing Your Public Key 52

Posting Your Public Key to a Keyserver 53

Exporting Your Public Key to a Text File 54

Getting the Public Keys of Others 54

Finding a Public Key on a Keyserver 54

Importing a Public Key from a Keyserver 55

Verifying Keys 56

Cryptographic Operations

59

Overview 60 Commands 60 --armor (-a) 60 --clearsign 62 --decrypt 64 --detached (-b) 66 --dump-packets, --list-packets 67

(7)

iii --encrypt (-e) 68 --export-session-key 72 --list-sda 73 --list-archive 73 --sign (-s) 74 --symmetric (-c) 76 --verify 77

Key Listings

79

Overview 79 Commands 80 --fingerprint 80 --fingerprint-details 81 --list-key-details 82 --list-keys (-l) 83 --list-keys-xml 84 --list-sig-details 85 --list-sigs 86 --list-userids 86

Working with Keyservers

87

Overview 87 Commands 88 --keyserver-disable 88 --keyserver-recv 89 --keyserver-remove 90 --keyserver-search 90 --keyserver-send 91 --keyserver-update 92

Managing Keys

95

Overview 97 Commands 97 --add-adk 97 --add-photoid 98 --add-preferred-cipher 98 --add-preferred-compression-algorithm 99 --add-preferred-email-encoding 100 --add-preferred-hash 100 --add-revoker 101 --add-userid 101 --cache-passphrase 102 --change-passphrase 103 --clear-key-flag 104 --disable 104

(8)

iv --enable 105 --export, --export-key-pair 105 --export-photoid 108 --gen-key 108 --gen-revocation 111 --gen-subkey 111 --get-email-encoding 112 --import 113 --join-key 114 --join-key-cache-only 118 --key-recon-send 119 --key-recon-recv-questions 120 --key-recon-recv 121 --remove 122 --remove-adk 122 --remove-all-adks 123 --remove-all-photoids 123 --remove-all-revokers 124 --remove-expiration-date 124 --remove-key-pair 125 --remove-photoid 125 --remove-preferred-cipher 126 --remove-preferred-compression-algorithm 126 --remove-preferred-email-encoding 127 --remove-preferred-hash 127 --remove-preferred-keyserver 128 --remove-revoker 128 --remove-sig 129 --remove-subkey 129 --remove-userid 130 --revoke 130 --revoke-sig 131 --revoke-subkey 132 --send-shares 132 --set-expiration-date 133 --set-key-flag 133 --set-preferred-ciphers 134 --set-preferred-compression-algorithms 134 --set-preferred-email-encodings 135 --set-preferred-hashes 136 --set-preferred-keyserver 136 --set-primary-userid 137 --set-trust 137 --sign-key 138 --sign-userid 139 --split-key 140

(9)

v

Working with Email

145

Overview 145 Encrypt Email 147 Sign Email 148 Decrypt Email 148 Verify Email 149 Annotate Email 149

Working with a PGP Key Management Server

151

Overview 152

New Terms and Concepts 152

Relationship with a PGP KMS 153

Authentication for PGP KMS Operations 153

--create-mak 155 --import-mak 156 --export-mak 157 --export-mak-pair 157 --request-cert 158 --edit-mak 159 --search-mak 160 --delete-mak 161 --create-mek-series 161 --edit-mek-series 162 --search-mek-series 163 --delete-mek-series 164 --create-mek 165 --import-mek 165 --export-mek 166 --edit-mek 167 --search-mek 168 --create-msd 168 --export-msd 169 --edit-msd 170 --search-msd 171 --delete-msd 172 --create-consumer 172 --search-consumer 173

Miscellaneous Commands

175

Overview 175 Commands 176 --create-keyrings 176 --help (-h) 177 --license-authorize 177

(10)

vi --purge-all-caches 177 --purge-keyring-cache 177 --purge-passphrase-cache 178 --speed-test 178 --version 178 --wipe 179 --check-sigs 180 --check-userids 180

Options

183

Using Options 183 Boolean Options 184 --alternate-format 184 --annotate 184 --archive 185 --banner 186 --biometric 186 --buffered-stdio 186 --compress, --compression 187 --details 187 --email 188 --encrypt-to-self 188 --eyes-only 188 --fast-key-gen 189 --fips-mode, --fips 189 --force (-f) 189 --halt-on-error 190 --keyring-cache 190 --large-keyrings 190 --license-recover 191 --local-mode 191 --marginal-as-valid 191 --master-key 192 --pass-through 192 --passphrase-cache 192 --photo 192 --quiet (-q) 193 --recursive 193 --reverse-sort, --reverse 193 --sda 193 --skep 194 --text-mode, --text (-t) 194 --truncate-passphrase 195 --verbose (-v) 195 --warn-adk 195 --wrapper-key 196 --xml 196 Integer Options 197

(11)

vii

--3des 197

--aes128, --aes192, --aes256 197

--bits, --encryption-bits 198 --blowfish 198 --bzip2 199 --cast5 199 --creation-days 199 --expiration-days 200 --idea 200 --index 200 --keyring-cache-timeout 201 --keyserver-timeout 201 --md5 202 --passphrase-cache-timeout 202 --partitioned 202 --pgp-mime 203 --ripemd160 203

--sha, --sha256, --sha384, --sha512 204

--signing-bits 205 --skep-timeout 205 --threshold 205 --trust-depth 206 --twofish 206 --wipe-input-passes 206 --wipe-overwrite-passes 207 --wipe-passes 207 --wipe-temp-passes 207 --zip 207 --zlib 208 Enumeration Options 208 --auto-import-keys 208 --cipher 209 --compression-algorithm 209 --compression-level 210 --email-encoding 210 --enforce-adk 211 --export-format 211 --hash 212 --import-format 213 --input-cleanup 213 --key-flag 214 --key-type 215 --manual-import-key-pairs 215 --manual-import-keys 215 --overwrite 216 --sig-type 216 --sort-order, --sort 216 --tar-cache-cleanup 217 --target-platform 218

(12)

viii

--temp-cleanup 218

--trust 218

String Options 219

--city, --common-name, --contact-email, --country 219

--comment 219 --creation-date 219 --default-key 220 --expiration-date 220 --export-passphrase 221 --home-dir 221

--local-user (-u), --user 221

--license-name, --license-number, --license-organization, --license-email 222 --new-passphrase 223 --organization, --organizational-unit 223 --output (-o) 223 --output-file 224 --passphrase 224 --preferred-keyserver 224 --private-keyring 225

--proxy-passphrase, --proxy-server, --proxy-username 225

--public-keyring 226 --recon-server 226 --regular-expression 226 --random-seed 227 --root-path 227 --share-server 227 --state 227 --status-file 228 --symmetric-passphrase 228 --temp-dir 229 List Options 229 --additional-recipient 229 --adk 229 --input (-i) 230 --question / --answer 230 --keyserver 231 --recipient (-r) 231 --revoker 232 --share 232 File Descriptors 233 --auth-passphrase-fd, auth-passphrase-fd8 233 --export-passphrase-fd, --export-passphrase-fd8 234 --new-passphrase-fd, --new-passphrase-fd8 234 --passphrase-fd, --passphrase-fd8 234 --proxy-passphrase-fd, --proxy-passphrase-fd8 234 --symmetric-passphrase-fd, --symmetric-passphrase-fd8 235

(13)

ix

Lists

237

Basic Key List 237

The Default Key Column 238

The Algorithm Column 238

The Type Column 239

The Size/Type Column 239

The Flags Column 240

The Key ID Column 241

The User ID Column 242

Detailed Key List 242

Main Key Details 244

Subkey Details 251

ADK Details 253

Revoker Details 253

Key List in XML Format 254

Elements with fixed settings 258

X.509 Signatures 260

Detailed Signature List 261

Usage Scenarios

267

Secure Off-Site Backup 267

PGP Command Line and PGP Desktop 268

Compression Saves Money 268

Surpasses Legal Requirements 269

Quick Reference

271

Commands 271

Options 275

Environment Variables 280

Configuration File Variables 280

Codes and Messages

283

Messages Without Codes 283

Messages With Codes 284

Parser 284 Keyrings 285 Wipe 286 Encrypt 287 Sign 287 Decrypt 287 Speed Test 288 Key edit 288 Keyserver 295

(14)

x Key Reconstruction 296 Licensing 297 PGP Universal Server 298 General 298 Exit Codes 307

Frequently Asked Questions

309

Key Used for Encryption 309

"Invalid" Keys 310

Maximum File Size 311

Programming and Scripting Languages 312

File Redirection 312

Protecting Passphrases 312

Searching for Data on a PGP KMS

315

Overview 315

Keyword Listing 316

Example Searches 318

More About Types 319

Time Fields 319

Boolean Values 319

Open PGP Algorithms 319

Open PGP Key Usage Flags 320

Key Modes 320

Index

321

(15)

1

This chapter describes some important PGP Command Line concepts and gives you a high-level overview of the things you need to do to set up and use PGP Command Line.

In This Chapter

Important Concepts... 1 Getting Started ... 2

Important Concepts

The following concepts are important for you to understand:

PGP Command Line: A software product from PGP Corporation that

automates the processes of encrypting/signing, decrypting/verifying, and file wiping; it provides a command-line interface to PGP technology. command-line interface: An interface where you type commands at a

command prompt. PGP Command Line uses a command-line interface. keyboard input: PGP Command Line was designed so that all relevant

information can be entered at the command line, thus requiring no further input from the keyboard to implement the commands.

scripting: PGP Command Line commands can be easily inserted into

scripts to be used for automating tasks. For example, if your company regularly copies a large database to an off-site backup and then stores it there, PGP Command Line commands can be added to the script that does this so that the database is encrypted before it is transmitted to the off-site location and then decrypted when it arrives. PGP Command Line

commands are easily added to shell scripts or scripts written with scripting languages (such as Perl or Python, for example).

environment variables: Environment variables control various aspects of

PGP Command Line behavior; for example, the location of the PGP Command Line home directory. Environment variables are established on the computer running PGP Command Line.

(16)

2

configuration file variables: When PGP Command Line starts, it reads the

configuration file, which includes special configuration variables and values for each variable. These settings affect how PGP Command Line operates. Configuration file variables can be changed permanently by editing the configuration file or overridden on a temporary basis by specifying a value for a configuration file variable on the command line.

Self-Decrypting Archives (SDAs): PGP Command Line lets you create

SDAs, compressed and conventionally encrypted archives that require a passphrase to decrypt. SDAs contain an executable for the target platform, which means the recipient of an SDA does not need to have any PGP software installed to open the archive. You can thus securely transfer data to recipients with no PGP software installed. You will have to communicate the passphrase of the SDA to the recipient, however.

Additional Decryption Key (ADK): PGP Command Line supports the use

of an ADK, which is an additional key to which files or messages are encrypted, thus allowing the keeper of the ADK to retrieve data or messages as well as the intended recipient. Use of an ADK ensures that your corporation has access to all its proprietary information even if employee keys are lost or become unavailable.

PGP Zip archives: The PGP Zip feature lets you encrypt/sign groups of files

or entire directories into a single compressed archive file. The archive format is tar and the supported compression formats are Zip, BZip2, and Zlib.

Getting Started

Now that you know a little bit about PGP Command Line, let’s go deeper into what you need to do to get started using it:

1 Install PGP Command Line. Specific instructions for installing PGP

Command Line on the supported platforms are in Installation.

2 License the software. PGP Command Line functionality is extremely

limited until you license the software. Refer to Licensing for more information.

3 Create your default key pair. Most PGP Command Line operations require

a key pair (a private key and a public key). Refer to Creating Your Keypair for more information.

4 Protect your private key. Because your private key can decrypt your

protected data, it is important that you protect it. Do not write down or tell someone the passphrase. It is a good idea to keep your private key on a machine that only you can access, and in a directory that is not accessible from the network. Also, you should make a backup of the private key and store it in a secure location. Refer to Protecting Your Private Key for more information.

(17)

3

5 Exchange public keys with others. In order to encrypt data to someone

you need their public key; and they need yours to encrypt data to you. Refer to Getting the Public Keys of Others for more information about how to obtain public keys.

6 Verify the public keys you get from the keyserver. Once you have a

copy of someone’s public key, you add it to your public keyring. When you get someone’s public key, you should make sure that it has not been tampered with and that it really belongs to the purported owner. You do this by comparing the unique fingerprint on your copy of someone’s public key to the fingerprint on that person’s original key. For more information about validity and trust, refer to An Introduction to Cryptography (it was put onto your computer during installation). For instructions how to verify someone’s public key, see --fingerprint (page 80).

7 Start securing your data. After you have generated your key pair and have

obtained public keys, you can begin encrypting, signing, decrypting, and verifying your data.

(18)

(19)

5

This chapter lists the system requirements for, and tells you how to install PGP Command Line onto, the six supported platforms: AIX, HP-UX, Mac OS X, Linux, Solaris, and Windows. It also includes uninstall instructions.

In This Chapter

Overview... 5 System Requirements ... 6 Installing on AIX ... 11 Installing on HP-UX ... 13 Installing on Mac OS X... 15

Installing on Red Hat Enterprise Linux or Fedora Core... 17

Installing on Solaris ... 19

Installing on Windows... 21

Overview

PGP Command Line can be installed on these platforms:

Windows 7 (32- and 64-bit), Windows Vista (32- and 64-bit), Windows Server 2003 (SP 1), Windows XP (32- and 64-bit), Windows 2000 (SP 4) HP-UX 11i and above (PA-RISC and Itanium)

IBM AIX 5.3 and 6.1

RedHat Enterprise Linux 3.0 and above (x86 only and x86_64) Fedora Core 3 and above (x86_64 only)

Sun Solaris 9 (SPARC only) and Solaris 10 (SPARC, x86, and x86_64 Apple Mac OS X 10.5.x and 10.6.x (Intel-based systems only)

PGP Command Line uses a specific directory for the application data such as the configuration file, and a specific directory (called the home directory) for the files it creates, such as keyring files.

On any UNIX system, the application data and the home directory are identical and they are configured through the $HOME environment variable. For more information, refer to the installation instructions for the specific UNIX platform.

(20)

6

On Windows, the application data directory is used to store data such as the configuration file PGPprefs.xml. The home directory is called “My

Documents” and is used to store keys. These two directories can be named differently, depending on the specific version on Windows. For more

information, see To Install on Windows (on page 21).

Note: You can also use the --home-dir option on the command line to specify a different home directory. Using this option affects only the command it is used in and does not change the PGP_HOME_DIR environment variable.

Using --home-dir on the command line overrides the current setting of the PGP_HOME_DIR environment variable.

System Requirements

In general, system requirements for PGP Command Line are the same as the system requirements for the host operating system.

In addition to the hard drive space required by the base operating system, PGP Command Line requires additional space for both the data on which

cryptographic operations (such as encryption, decryption, signing, and verifying) will be applied and temporary files created in the process of performing those operations.

For a given file being encrypted or decrypted, PGP Command Line can require several times the size of the original file in free hard drive space (depending on how much the file was compressed), enough to hold both the original file or files and the final file resulting from the encryption or decryption operation.

In cases where PGP Zip functionality is used on a file, PGP Command Line may also require several times the size of the original file or files in free hard drive space, enough to hold the original file, a temporary file created when handling the archive, and the final file resulting from the encryption or decryption operation. Make sure you have adequate free hard drive space on your system before using PGP Command Line.

Windows 7 and Vista

Component Requirement

Computer and processor

PC with 1 GHz 32-bit (x86) processor

Memory 1 gigabyte (GB) of RAM or higher recommended (64 MB minimum supported; may limit performance and some features)

(21)

7

Hard disk 15 GB of available space

Drive DVD-ROM drive

Display Support for DirectX 9 graphics with WDDM driver, 128 MB of graphics memory (minimum), Pixel Shader 2.0 in hardware, 32 bits per pixel

Windows Server 2003

PGP Command Line supports four editions of Windows Server 2003: Standard, Datacenter, Enterprise, and Web.

Standard Edition

PC with a 133-MHz processor required; 550-MHz or faster processor recommended (Windows Server 2003 Standard Edition supports up to four processors on one server) Memory 128 MB of RAM required; 256 MB or more recommended; 4

GB maximum

Hard disk 1.25 to 2 GB of available hard-disk space

Drive CD-ROM or DVD-ROM drive

Display VGA or hardware that supports console redirection required; Super VGA supporting 800 x 600 or higher-resolution monitor recommended Datacenter Edition Component Requirement Computer and processor

Minimum: 400 MHz processor for x86-based computers Recommended: 733 MHz processor

Memory Minimum: 512 MB of RAM

Recommended: 1 GB of RAM

Hard disk 1.5 GB hard-disk space for x86-based computers

Other Minimum: 8-way capable multiprocessor machine required Maximum: 64-way capable multiprocessor machine supported

(22)

8

Enterprise Edition

These system requirements apply only to the 32-bit version of Windows Server 2003 Enterprise Edition; 64-bit versions of Windows Server 2003 Enterprise Edition are

not supported.

133-MHz or faster processor for x86-based PCs; up to eight processors supported on either the 32-bit

Memory 128 MB of RAM minimum required

Maximum: 32 GB for x86-based PCs with the 32-bit version Hard disk 1.5 GB of available hard-disk space for x86-based PCs;

additional space is required if installing over a network

Display VGA or hardware that supports console redirection required

Web Edition Component Requirement Computer and processor 133-MHz processor (550 MHz recommended)

Memory 128 MB of RAM (256 MB recommended; 2 GB maximum) Hard disk 1.5 GB of available hard-disk space

Windows XP

(23)

9 32-bit Windows XP Component Requirement Computer and processor

PC with 300 megahertz (MHz) or higher processor clock speed recommended; 233-MHz minimum required; Intel Pentium/Celeron family, AMD K6/Athlon/Duron family, or compatible processor recommended

Memory 128 megabytes (MB) of RAM or higher recommended (64 MB minimum supported; may limit performance and some features)

Hard disk 1.5 gigabyte (GB) of available hard disk space

Display Super VGA (800 × 600) or higher resolution video adapter and monitor supporting 800 x 600 or higher-resolution monitor recommended 64-bit Windows XP Component Requirement Computer and processor

PC with AMD Athlon 64, AMD Opteron, Intel Xeon with Intel EM64T support, Intel Pentium 4 with Intel EM64T support

Memory 256 megabytes (MB) of RAM or higher recommended

Hard disk 1.5 gigabyte (GB) of available hard disk space

Display Super VGA (800 × 600) or higher resolution video adapter and monitor supporting 800 x 600 or higher-resolution monitor recommended

Windows 2000

Component Requirement Computer and processor

(24)

10

Memory At least 64 megabytes (MB) of RAM; more memory generally improves responsiveness

Hard disk 2 GB with 650 MB free space

Display VGA or higher resolution monitor

IBM AIX

PGP Command Line runs on the range of IBM eServer p5, IBM eServer pSeries, IBM eServer i5 and IBM RS/6000, as supported by IBM AIX 5.3 and 6.1.

HP-UX 11i

PGP Command Line runs on the list of PA-RISC workstation and servers supported by HP-UX 11i, as specified at http://docs.hp.com/

http://docs.hp.com/en/5187-2239/ch03s01.html.

Solaris 9 and 10

SPARC (32- and 64-bit) platforms

Memory 64 MB minimum (128 MB recommended)

Hard disk 600 MB for desktops; one GB for servers

Red Hat Enterprise Linux and Fedora Core

x86 for Red Hat Enterprise Linux, x86_64 for Fedora Core; see Red Hat or Fedora websites for hardware compatibility.

Memory 256 MB minimum

(25)

11

Mac OS X

Macintosh computer, Intel-based system only

Memory 128 MB of physical RAM

Installing on AIX

This section tells you how to install, change the home directory, and uninstall on AIX.

Installing on AIX

You need to have root or administrator privileges on the machine on which you are installing PGP Command Line.

 To install PGP Command Line on an AIX system:

1 If you have an existing version of PGP Command Line installed on the computer, uninstall it.

2 Download the installer application called PGPCommandLine10IX.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine100AIX.rpm

4 Type: rpm -ivh PGPCommandLine10IX.rpm

5 Press Enter.

By default, the PGP Command Line application, pgp, is installed into the directory /opt/pgp/bin. You need to add this directory to your PATH environment variable in order for the application to be found.

For sh-based shells, use this syntax: PATH=$PATH:/opt/pgp/bin For csh-based shells, use this syntax: set path = ($path /opt/pgp/bin)

Also, in order to access the PGP Command Line man page, you need to set the MANPATH environment variable appropriately.

(26)

12 For sh-based shells, use this syntax:

MANPATH=$MANPATH:/opt/pgp/man; export MANPATH For csh-based shells, use this syntax:

setenv MANPATH "/opt/pgp/man"

By adding the option --prefix to the rpm command, you can install PGP Command Line to a location other than the default.

Type rpm --prefix=/usr/pgp -ivh PGPCommandLine10AIX.rpm and press Enter.

This command installs the application binary in the directory /usr/pgp/bin/pgp, libraries in /usr/pgp/lib, and so on.

You will need to edit the environmental variable LIBPATH to include the new library path (/usr/pgp/lib) so that PGP Command Line can function in a location other than the default.

By adding the option --prefix to the rpm command, you can install PGP Command Line in a location other than the default:

2 Download the installer application called PGPCommandLine10AIX.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine10AIX.rpm

4 Type: rpm --prefix=/opt -ivh PGPCommandLine10AIX.rpm

5 Press Enter.

This command will install the application binary, pgp, in the directory /usr/pgp/bin/pgp, libraries in /usr/pgp/lib, and so on.

You will need to edit the environment variable LIBPATH to include the new library path (/usr/pgp/lib), so that PGP Command Line can function in any location other than the default.

Changing the Home Directory on AIX

The home directory is where PGP Command Line stores the files that it creates and uses; for example, keyring files.

By default, the PGP Command Line installer for AIX creates the PGP Command Line home directory at $HOME/.pgp. If this directory does not exist, it will be created. For example, if the value of $HOME for user "alice"is

/usr/home/alice, PGP Command Line will attempt to create /usr/home/alice/.pgp.

The PGP Command Line installer will not try to create any other part of the directory listed in the $HOME variable, only .pgp.

(27)

13

If you want the home directory changed on a permanent basis, you will need to create the $PGP_HOME_DIR environment variable and specify the path of the desired home directory.

Uninstalling on AIX

Uninstalling PGP Command Line on AIX requires root privileges, either through su or sudo.

 To uninstall PGP Command Line on AIX

1 Type the following command and press Enter: rpm -e pgpcmdln

2 PGP Command Line is uninstalled.

Installing on HP-UX

This section tells you how to install, change the home directory, and uninstall on HP-UX.

Installing on HP-UX

 To install PGP Command Line on an HP-UX system

2 Download the installer file called PGPCommandLine10HPUX.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine10HPUX.depot

4 Type: swinstall -s

/absolute/path/to/PGPCommandLine10HPUX.depot

5 Press Enter.

(28)

14 PATH=$PATH:/opt/pgp/bin For csh-based shells, use this syntax: set path = ($path /opt/pgp/bin)

For sh-based shells, use this syntax:

setenv MANPATH "/opt/pgp/man"

Note: You may encounter an issue generating 2048- or 4096-bit keys on

HP-UX systems running PGP Command Line if you have altered the maximum number of shared memory segments that can be attached to one process, as configured by the shmseg system parameter. if you encounter this issue, reset the shmseg system parameter to its default value of 120. Consult your HP-UX documentation for information about how to alter system parameters.

Changing the Home Directory on HP-UX

By default, the PGP Command Line installer for HP-UX creates the PGP

Command Line home directory in $HOME/.pgp. If this directory does not exist, it will be created. For example, if the value of $HOME for user "alice" is

If you want the PGP Command Line home directory changed on a permanent basis, you can define the $PGP_HOME_DIR environment variable and specify the path of the desired home directory.

Installing to a Non-Default Directory on HP-UX

This procedure describes how to install PGP Command Line for HP-UX into a non-default directory. The information provided is in addition to the information provided in Installing on HP-UX.

Note: This procedure uses /opt/pgp_alt as the non-default directory. Be sure to substitute the desired directory in place of /opt/pgp_alt.

(29)

15

 To install PGP Command Line for HP-UX to a non-default directory

1 Add the following extra argument to the swinstall command: swinstall -s /path/to/pgpcmdln.depot

pgpcmdln,l=/opt/pgp_alt

2 Set all libraries to respect the SHLIB_PATH environment variable: chatr +s enable /opt/pgp_alt/lib/*

3 Set the SHLIB_PATH environment variable to the new library directory when starting PGP Command Line:

export SHLIB_PATH=/opt/pgp_alt/lib

Uninstalling on HP-UX

Uninstalling PGP Command Line on HP-UX requires root privileges, either su or sudo.

 To uninstall PGP Command Line on HP-UX:

1 Type the following command and press Enter: swremove pgpcmdln

Installing on Mac OS X

This section tells you how to install, change the home directory, and uninstall on Mac OS X.

Installing on Mac OS X

 To install PGP Command Line on a Mac OS X system:

1 Close all applications.

2 Download the installer application, PGPCommandLine10MacOSX.tgz, to your desktop.

3 Double-click on the file PGPCommandLine10MacOSX.tgz.

4 If you have Stuffit Expander, it will automatically first uncompress this file into PGPCommandLine10MacOSX.tar, and then untar it into

PGPCommandLine10MacOSX.pkg.

(30)

16

6 Follow the on-screen instructions.

The Mac OS X PGP Command Line application, pgp, is installed into /usr/bin/.

After you run PGP Command Line for the first time, its home directory will be created automatically in the directory $HOME/Documents/PGP. This directory may already exist if PGP Desktop for Mac OS X is already installed on the system.

Changing the Home Directory on Mac OS X

By default, the PGP Command Line installer for Mac OS X creates the PGP Command Line home directory at $HOME/Documents/PGP. If this directory does not exist, it will be created.

The PGP Command Line installer will not try to create any other part of directory listed in the $HOME variable, only .pgp.

If you want the home directory changed permanently, you need to create the $PGP_HOME_DIR environment variable and specify the path of the desired home directory.

Uninstalling on Mac OS X

Uninstalling PGP Command Line on Mac OS X requires administrative privileges.

Caution: If you have PGP Desktop for Mac OS X installed on the same system with PGP Command Line, do not uninstall PGP Command Line unless you also plan to uninstall PGP Desktop. Uninstalling PGP Command Line will delete files that PGP Desktop requires to operate; you will have to reinstall PGP Desktop to return to normal operation.

 To uninstall PGP Command Line on Mac OS X:

1 Using the Terminal application, enter the following commands: rm -rf /usr/bin/pgp

rm -rf /Library/Frameworks/PGP* rm -rf /Library/Receipts/PGP*

Preferences and keyrings are not removed when PGP Command Line is uninstalled.

(31)

17

Installing on Red Hat Enterprise Linux or Fedora Core

This section tells you how to install, change the home directory, and uninstall on a Linux or Fedora Core system.

Installing on Red Hat Enterprise Linux or Fedora Core

Linux installations now default to /opt/pgp, which matches the default

installation location on other UNIX platforms. To install PGP Command Line on Linux to the previous installation location (/usr/bin/), use the "--prefix=/usr" option.

If you have an existing Linux installation of PGP Command Line and do not install the new version using the "--prefix=/usr" option, you will need to update your path to include /opt/pgp/bin and you will need to update any scripts accordingly.

Caution: If you want to use the XML key list functionality in PGP Command Line, you need to upgrade libxml2 to Version 2.6.8; the default is Version 2.5.10. If you attempt to use the XML key list functionality without upgrading, you will receive an error.

 To install PGP Command Line on a Linux system:

2 Download the installer file called PGPCommandLine10Linux.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine10Linux.rpm

4 Type: rpm -ivh PGPCommandLine10Linux.rpm

5 Press Enter.

The PGP Command Line application, pgp, is installed by default into /opt/pgp/.

By adding the option --prefix to the rpm command, you can install PGP Command Line in a location other than the default.

 To install PGP Command Line into a different directory:

(32)

18

2 Download the installer file called PGPCommandLine10Linux.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine10Linux.rpm

4 Type: rpm --prefix=/opt -ivh PGPCommandLine10Linux.rpm

5 Press Enter.

This command will install the application binary in the directory

/opt/bin/pgp, libraries in /opt/lib, etc. You will need to edit the

environment variable LD_LIBRARY_PATH to include the new library path for the software to function in any location other than the default.

Changing the Home Directory on Linux or Fedora Core

By default, the PGP Command Line installer for Linux creates the PGP

Command Line home directory at $HOME/.pgp. If this directory does not exist, it will be created. For example, if the value of $HOME for user "alice" is

If you want the home directory changed on a permanent basis, you need to create the $PGP_HOME_DIR environment variable and specify the path of the desired home directory.

Uninstalling on Linux or Fedora Core

Uninstalling PGP Command Line on Linux requires root privileges, either su or sudo.

 To uninstall PGP Command Line on Linux or Fedora Core:

1 Type the following command and press Enter: rpm -e pgpcmdln

(33)

19

Installing on Solaris

This section tells you how to install, change the home directory, and uninstall on Solaris.

Installing on Solaris

 To install PGP Command Line onto a Solaris machine in the default

directory:

2 Download the installer file called PGPCommandLine10Solaris.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine10Solaris.pkg

4 Type pkgadd -d PGPCommandLine10Solaris.pkg and press Enter.

5 At the first prompt, enter "1" or "all" to install the package.

If the directories /usr/bin and /usr/lib are not owned by root:bin, the install application pkgadd will ask if you want to change the ownership/group on these directories. It is not necessary to change them, but as an admin you may do so if you wish.

For sh-based shells, use this syntax: PATH=$PATH:/opt/pgp/bin For csh-based shells, use this syntax:

set path = ($path /opt/pgp/bin)

For sh-based shells, use this syntax:

(34)

20

 To install PGP Command Line onto a Solaris machine in another

directory:

2 Download the installer application PGPCommandLine10Solaris.tar to a known location on your system.

3 Untar the package first. You will get the following file: PGPCommandLine10Solaris.pkg

4 Type: pkgadd -a none -d PGPCommandLine10Solaris.pkg (This will force an interactive installation).

5 Press Enter.

6 At the first prompt, enter “1” or “all” to install the package.

You will be asked to enter the path to the package’s base directory. If you enter /usr/pgp, the binary will be installed to /usr/pgp/bin/pgp, libraries will be installed to /usr/pgp/lib, and so on.

You need to edit the environment variable LD_LIBRARY_PATH to include the new library path (/usr/pgp/lib) so that PGP Command Line can function in this location.

Changing the Home Directory on Solaris

By default, the PGP Command Line installer for Solaris creates the PGP

Command Line home directory in $HOME/.pgp. If this directory does not exist, it will be created. For example, if the value of $HOME for user "alice" is

If you want the PGP Command Line home directory changed on a permanent basis, you can define the $PGP_HOME_DIR environment variable and specify the path of the desired home directory.

Uninstalling on Solaris

Uninstalling PGP Command Line on Solaris requires root privileges, either su or sudo.

(35)

21

 To uninstall PGP Command Line on Solaris:

1 Type the following command and press Enter: pkgrm PGPcmdln

To uninstall with no confirmation, use: pkgrm -n PGPcmdln

Installing on Windows

This section tells you how to install, change the home directory, and uninstall on Windows.

PGP Command Line for Windows and PGP Desktop on the Same System

PGP Command Line and PGP Desktop can be installed on the same system at the same time.

To use PGP Command Line for Windows and PGP Desktop for Windows on the same 64-bit system, you must use the 64-bit version of PGP Desktop and the 32-bit version of PGP Command Line.

This ensures compatible versions of the PGP SDK are used. The PGP SDK for the 64-bit version of PGP Command Line for Windows includes functionality that makes it incompatible with PGP Desktop for Windows.

To Install on Windows

 To install PGP Command Line onto a Windows system:

1 Close all Windows applications.

2 Download the installer application, PGPCommandLine10Win.zip, to a known location on your system.

3 Unzip the file PGPCommandLine10Win.zip. You will get the following file: PGPCommandLine10Win.msi.

4 Double click on PGPCommandLine10Win.msi.

5 Follow the on-screen instructions.

6 If prompted, restart your machine. A restart is needed only if other PGP products are also installed on the same machine.

The Windows PGP Command Line application, pgp.exe, is installed into: C:\Program Files\PGP Corporation\PGP Command Line\

(36)

22

After you run PGP Command Line for the first time, its home directory will be created automatically in the user’s home directory:

C:\Documents and Settings\<user>\My Documents\PGP\ Application data is stored in the directory:

C:\Documents and Settings\<user>\Application Data\PGP Corporation\PGP

Locations may be different for the different Windows versions.

Changing the Home Directory on Windows

The home directory is where PGP Command Line stores its keyring files. If a different PGP product has already created this directory, PGP Command Line will also use it (thus, PGP Command Line can automatically use existing PGP keys).

PGP Command Line data files, such as keys, are stored in the home directory: C:\Documents and Settings\<user>\My Documents\PGP\

PGP Command Line application files, such as the configuration file PGPprefs.xml, are stored in:

C:\Documents and Settings\<user>\Application Data\PGP Corporation\PGP\

If you want the home directory changed on a permanent basis, you need to create the PGP_HOME_DIR environment variable and specify the path of the desired home directory.

 To create the PGP_HOME_DIR environment variable on a Windows

system:

1 Click Start, select Settings, select Control Panel, and then select

System.

The System Properties dialog appears.

2 Select the Advanced tab, then click Environment Variables. The Environment Variables screen appears.

3 In the User Variables section, click New. The New User Variable dialog appears.

4 In the Variable name field, enter PGP_HOME_DIR. In the Variable value

field, enter the path of the home directory you want to use. For example:

C:\PGP\PGPhomedir\

5 Click OK.

The Environment Variables screen reappears. PGP_HOME_DIR appears in the list of user variables.

(37)

23

Uninstalling on Windows

 To remove PGP Command Line from a Windows system:

1 Navigate to the Add or Remove Programs Control Panel.

2 Select PGP Command Line from the list of installed programs.

3 Click Remove, then follow the on-screen instructions. PGP Command Line is uninstalled.

(38)

(39)

25

PGP Command Line requires a valid license to operate. This chapter describes how to license your copy of PGP Command Line.

In This Chapter

Overview ... 25 License Recovery ... 26 Using a License Number ... 27 Using a License Authorization ... 28 Re-Licensing ... 29 Through a Proxy Server ... 30

Overview

PGP Command Line requires a valid license to support full functionality. If you use PGP Command Line without entering a license or after your license has expired, only basic functionality will be available. You will only be able to get help and version information; perform a speed test; list keys, user IDs, fingerprints, and signatures; export public keys and keypairs; and license PGP Command Line.

Note: As PGP Command Line will not operate normally until licensed, you should license it immediately after installation.

When your license gets within 60 days of expiration, PGP Command Line begins issuing warnings that license expiration is nearing. There is no grace period once the license expiration date has been reached.

PGP Command Line supports the following licensing scenarios:

Using a License Number (on page 27). This is the normal method to license PGP Command Line. You must have your license number and a working connection to the Internet.

Using a License Authorization (on page 28). This licensing method uses

licensing information in a file that was obtained from PGP Corporation. This method does not require a working connection to the Internet.

(40)

26

Re-Licensing (on page 29).If you have already licensed PGP Command Line on a system but want to re-license it with a new license number (to support additional functionality, for example), use this method. You must have your new license number and a working connection to the Internet.

Through a Proxy Server (on page 30). If you connect to the Internet through

a proxy server, use this method to license PGP Command Line. You must have your license number and the appropriate proxy server information.

License Recovery

When you first enter your PGP Command Line license, one option is --license-email, which takes a valid email address.

You are not required to use --license-email to license your copy of PGP Command Line, but it is required if you want to take advantage of the license recovery feature.

The license recovery feature provides an automated mechanism for retrieving your original licensing information for those occasions when you need to enter it again.

Here is how the license recovery feature works: When you first license your copy of PGP Command Line, you enter a License Name, License Organization, your License Number, and a License Email. The license authorizes, and you begin using PGP Command Line.

Several months pass. The hardware hosting PGP Command Line fails and it is no longer usable. You need to reinstall PGP Command Line on a new system. You still have your PGP Command Line license number, but you enter your company name differently in License Organization; you didn’t remember exactly how you entered it several months ago, and this time you picked a slightly different form (or maybe you even mis-typed it by mistake).

Not a big deal, you think; what difference could it make? But when you attempt to authorize the license, it does not work.

What happened is that when you re-license PGP Command Line, you must enter the same information exactly as you did the first time or it will not license correctly.

At this point the license recovery feature kicks in. When you attempt to re-license PGP Command Line, and you enter a valid re-license, but the License Name or License Organization you enter is different, the license recovery feature sends an email message to the License Email you entered the first time you licensed PGP Command Line.

The email message includes the License Name and License Organization you used when you first licensed PGP Command Line. You can now license PGP Command Line on the new system using the information in the message.

(41)

27

The key to the license recovery feature is entering a valid email address when you first license PGP Command Line. The license recovery feature will only use the email address you enter when you first license a specific PGP Command Line license. You cannot add or change the email address at a later time; if you don’t enter it the first time you license, the license recovery feature will not work for that particular PGP Command Line license.

If the license recovery feature is not available for a PGP Command Line license, but you need your original License Name or License Organization, contact PGP Support at www.pgp.com/support/ http://www.pgp.com/support\n.

Using a License Number

If you have a license number and a working Internet connection, you can license your copy of PGP Command Line.

Use --license-authorize to license PGP Command Line. The following options are required:

--license-name <Name>

Where <Name> is your name or a descriptive name.

--license-organization <Org> Where <Org> is the name of your company.

--license-number <Number> Where <Number> is a valid license number.

The following option is not required but is recommended: --license-email <EmailAddress>

Where <EmailAddress> is a valid email address, generally the email address of the PGP Command Line administrator.

Before deciding not to enter a license email, be sure to refer to License

Recovery (on page 26). Not entering a license email when you first license your

copy of PGP Command Line negates the license recovery feature for your PGP Command Line license. If you decide not to enter a license email, you will see a warning message but your license will authorize.

For example:

pgp --license-authorize --license-name "Alice Cameron" --license-organization "Example Corporation"

--license-number "aaaaa-bbbbb-ccccc-ddddd-eeeee-fff" --license-email "[email protected]"

(42)

28

Using a License Authorization

If you have both a license number and a license authorization (a text file) from PGP Corporation instead of just a license number, you need to enter the name of the license authorization file in the command.

You may need a license authorization if you are having problems authorizing your license number or if the system hosting PGP Command Line is not connected to the Internet.

Use --license-authorize to license PGP Command Line using a license authorization.

The following options are required: --license-name <Name>

The following option is not required but is recommended: --license-email <EmailAddress>

For example:

--license-number "aaaaa-bbbbb-ccccc-ddddd-eeeee-fff"

license-auth.txt --license-email "[email protected]" (When entering this text, it all goes on a single line.)

In this example, the text file "license-auth.txt" is shown after the license number.

(43)

29

Re-Licensing

If you have already licensed your copy of PGP Command Line on a system, but you need to re-license it on the same system (if you have purchased a new license with additional capabilities, for example), you must use the <force> option to override the existing license.

You can use a license number or a license authorization when you are re-licensing.

Use --license-authorize to re-license PGP Command Line. The following options are required:

--force The following option is not required but is recommended: --license-email <EmailAddress>

The following option is optional: <LicenseAuthFilename>

Where <LicenseAuthFilename> is the name of the text file from PGP Corporation that includes license authorization information.

For example:

--license-number "aaaaa-bbbbb-ccccc-ddddd-eeeee-fff" --license-email "[email protected]" --force

(44)

30

Through a Proxy Server

If the Internet access of the system hosting PGP Command Line is via an HTTP proxy connection, you can still license your copy of PGP Command Line directly; you simply need to add the necessary proxy information.

Use --license-authorize to license PGP Command Line via a proxy server. The following options are required:

--license-number <Number> Where <Number> is a valid PGP Command Line license number.

--proxy-server <Server>

Where <Server> is the IP address or fully qualified domain name of the proxy server PGP Command Line must go through to reach the Internet. The following options are not required; they are only needed when the proxy server requires authentication:

--proxy-username <Username>

Where <Username> is a valid username on the proxy server. --proxy-passphrase <Passphrase>

Where <Passphrase> is the passphrase for the username you entered. The following option is not required but is recommended:

--license-email <EmailAddress>

Recovery. Not entering a license email when you first license your copy of PGP

Command Line negates the license recovery feature for your PGP Command Line license. If you decide not to enter a license email, you will see a warning message but your license will authorize.

PGP Command Line User's Guide

PGP® Command Line 10.0

Contents

PGP Command Line Basics

1

Installation 5

Licensing 25

The Command-Line Interface

33

First Steps

49

Cryptographic Operations

59

Key Listings

79

Working with Keyservers

87

Managing Keys

95

Working with Email

145

Working with a PGP Key Management Server

151

Miscellaneous Commands

175

Options

183

Lists

237

Usage Scenarios

267

Quick Reference

271

Codes and Messages

283

Frequently Asked Questions

309

Searching for Data on a PGP KMS

315

Index

321

In This Chapter

Important Concepts

Getting Started

In This Chapter

Overview

System Requirements

Windows 7 and Vista

Windows Server 2003

Windows XP

Windows 2000

IBM AIX

HP-UX 11i

Solaris 9 and 10

Red Hat Enterprise Linux and Fedora Core

Mac OS X

Installing on AIX

Installing on AIX

Changing the Home Directory on AIX

Uninstalling on AIX

Installing on HP-UX

Installing on HP-UX

Changing the Home Directory on HP-UX

Installing to a Non-Default Directory on HP-UX

Uninstalling on HP-UX

Installing on Mac OS X

Installing on Mac OS X

Changing the Home Directory on Mac OS X

Uninstalling on Mac OS X

Installing on Red Hat Enterprise Linux or Fedora Core

Installing on Red Hat Enterprise Linux or Fedora Core

Changing the Home Directory on Linux or Fedora Core

Uninstalling on Linux or Fedora Core

Installing on Solaris

Installing on Solaris

Changing the Home Directory on Solaris

Uninstalling on Solaris

Installing on Windows

PGP Command Line for Windows and PGP Desktop on the Same System

To Install on Windows