SYNOPSIS

       gpg  [--homedir name]  [--options file]  [options]  command  [args]


DESCRIPTION

       gpg is the main program for the GnuPG system.


       This  man  page only lists the commands and options avail­
       able.  For more verbose documentation get the GNU  Privacy
       Handbook   (GPH)   or   one  of  the  other  documents  at
       http://www.gnupg.org/docs.html .

       Please remember that option parsing stops as soon as a non
       option  is  encountered,  you  can  explicitly stop option
       parsing by using the special option "--".


COMMANDS

       gpg recognizes these commands:

       -s, --sign
                 Make a signature. This command may  be  combined
                 with --encrypt.

       --clearsign
                 Make a clear text signature.

       -b, --detach-sign
                 Make a detached signature.

       -e, --encrypt
                 Encrypt  data.  This option may be combined with
                 --sign.

       -c, --symmetric
                 Encrypt with symmetric cipher only.   This  com­
                 mand asks for a passphrase.

       --store   Store only (make a simple RFC1991 packet).

       --decrypt [file]
                 Decrypt  file (or stdin if no file is specified)
                 and write it to stdout (or  the  file  specified
                 with --output). If the decrypted file is signed,
                 the signature is  also  verified.  This  command
                 differs  from the default operation, as it never
                 writes to the filename which is included in  the
                 file and it rejects files which don't begin with
                 an encrypted message.

       --verify [[sigfile]  [signed-files]]
                 Assume that sigfile is a signature and verify it
                 without  generating  any output.   With no argu­
                 This  is  a special version of the --verify com­
                 mand which does not work  with  detached  signa­
                 tures.  The command expects the files to be ver­
                 ified either on the command line  or  reads  the
                 filenames from stdin;  each name must be on sep­
                 arate line. The command is  intended  for  quick
                 checking of many files.

       --encrypt-files [files]
                 This  is a special version of the --encrypt com­
                 mand.  The  command  expects  the  files  to  be
                 encrypted  either  on  the command line or reads
                 the filenames from stdin; each name must  be  on
                 separate  line.  The  command  is intended for a
                 quick encryption of multiple files.

       --decrypt-files [files]
                 The same as --encrypt-files with the  difference
                 that  files will be decrypted. The syntax or the
                 filenames is the same.

       --list-keys [names]

       --list-public-keys [names]
                 List all keys from the public keyrings, or  just
                 the ones given on the command line.

       --list-secret-keys [names]
                 List  all keys from the secret keyrings, or just
                 the ones given on the command line.  A '#' after
                 the  letters  'sec' means that the secret key is
                 not usable (for example, if it was  created  via
                 --export-secret-subkeys).

       --list-sigs [names]
                 Same  as  --list-keys,  but  the  signatures are
                 listed too.

       --check-sigs [names]
                 Same as --list-sigs, but the signatures are ver­
                 ified.

       --fingerprint [names]
                 List  all  keys with their fingerprints. This is
                 the same output  as  --list-keys  but  with  the
                 additional  output  of  a  line with the finger­
                 print. May also be combined with --list-sigs  or
                 --check-sigs.   If  this command is given twice,
                 the  fingerprints  of  all  secondary  keys  are
                 listed too.

       --list-packets

                 sign      Make  a  signature on key of user name
                           If the key is not yet  signed  by  the
                           default  user (or the users given with
                           -u), the program displays the informa­
                           tion  of  the key again, together with
                           its fingerprint and  asks  whether  it
                           should  be  signed.  This  question is
                           repeated for all users specified  with
                           -u.

                 lsign     Same  as  --sign  but the signature is
                           marked  as  non-exportable  and   will
                           therefore  never  be  used  by others.
                           This may be used to  make  keys  valid
                           only in the local environment.

                 nrsign    Same  as  --sign  but the signature is
                           marked as non-revocable and can there­
                           fore never be revoked.

                 nrlsign   Combines  the  functionality of nrsign
                           and lsign to make a signature that  is
                           both non-revocable and non-exportable.

                 revsig    Revoke a signature.  For every  signa­
                           ture  which  has been generated by one
                           of the secret keys, GnuPG asks whether
                           a  revocation  certificate  should  be
                           generated.

                 trust     Change the  owner  trust  value.  This
                           updates  the  trust-db immediately and
                           no save is required.

                 disable

                 enable    Disable or enable  an  entire  key.  A
                           disabled  key can normally not be used
                           for encryption.

                 adduid    Create an alternate user id.

                 addphoto  Create a photographic user id.

                 deluid    Delete a user id.

                 addkey    Add a subkey to this key.

                 delkey    Remove a subkey.

                 addrevoker
                 passwd    Change the passphrase  of  the  secret
                           key.

                 primary   Flag  the  current user id as the pri­
                           mary one, removes the primary user  id
                           flag  from all other user ids and sets
                           the timestamp of  all  affected  self-
                           signatures  one  second  ahead.   Note
                           that setting a photo user ID  as  pri­
                           mary makes it primary over other photo
                           user IDs, and setting a  regular  user
                           ID  as  primary  makes it primary over
                           other regular user IDs.

                 uid n     Toggle selection of user id with index
                           n.  Use 0 to deselect all.

                 key n     Toggle  selection of subkey with index
                           n.  Use 0 to deselect all.

                 check     Check all selected user ids.

                 showphoto Display the selected photographic user
                           id.

                 pref      List  preferences  from  the  selected
                           user ID.  This shows the actual  pref­
                           erences, without including any implied
                           preferences.

                 showpref  More verbose preferences  listing  for
                           the  selected user ID.  This shows the
                           preferences in effect by including the
                           implied  preferences of 3DES (cipher),
                           SHA-1 (digest), and Uncompressed (com­
                           pression)  if  they  are  not  already
                           included in the preference list.

                 setpref string
                           Set the list of user ID preferences to
                           string,  this should be a string simi­
                           lar to  the  one  printed  by  "pref".
                           Using  an  empty  string  will set the
                           default   preference   string,   using
                           "none"  will  set  the  preferences to
                           nil.  Use "gpg -v --version" to get  a
                           list  of  available  algorithms.  This
                           command just initializes  an  internal
                           list  and  does  not  change  anything
                           unless  another   command   (such   as
                           "updpref") which changes the self-sig­
                           natures is used.
                           listing.

                 save      Save  all changes to the key rings and
                           quit.

                 quit      Quit the program without updating  the
                           key rings.

                 The listing shows you the key with its secondary
                 keys and all user ids. Selected keys or user ids
                 are indicated by an asterisk. The trust value is
                 displayed with the primary key: the first is the
                 assigned  owner trust and the second is the cal­
                 culated trust value.  Letters are used  for  the
                 values:

                 -         No  ownertrust assigned / not yet cal­
                           culated.

                 e         Trust calculation has failed; probably
                           due to an expired key.

                 q         Not  enough  information  for calcula­
                           tion.

                 n         Never trust this key.

                 m         Marginally trusted.

                 f         Fully trusted.

                 u         Ultimately trusted.

       --sign-key name
                 Signs a public key with your secret key. This is
                 a shortcut version of the subcommand "sign" from
                 --edit.

       --lsign-key name
                 Signs a public key  with  your  secret  key  but
                 marks  it as non-exportable.  This is a shortcut
                 version of the subcommand "lsign" from --edit.

       --nrsign-key name
                 Signs a public key  with  your  secret  key  but
                 marks  it  as non-revocable.  This is a shortcut
                 version of the subcommand "nrsign" from  --edit.

       --delete-key name
                 Remove  key  from  the public keyring.  In batch
                 mode either --yes is required or the key must be
                 specified  by  fingerprint.  This is a safeguard
                 plete  key.  To  revoke a subkey or a signature,
                 use the --edit command.

       --desig-revoke
                 Generate a designated revocation certificate for
                 a  key.  This allows a user (with the permission
                 of the keyholder) to revoke someone elses key.

       --export [names]
                 Either  export  all  keys  from   all   keyrings
                 (default   keyrings  and  those  registered  via
                 option --keyring), or if at least  one  name  is
                 given,  those of the given name. The new keyring
                 is written to stdout or to the file  given  with
                 option  "output".   Use together with --armor to
                 mail those keys.

       --send-keys [names]
                 Same as --export but sends the keys  to  a  key­
                 server.  Option --keyserver must be used to give
                 the name of this keyserver. Don't send your com­
                 plete keyring to a keyserver - select only those
                 keys which are new or changed by you.

       --export-all [names]
                 Same as --export, but also  exports  keys  which
                 are not compatible with OpenPGP.

       --export-secret-keys [names]

       --export-secret-subkeys [names]
                 Same  as  --export,  but exports the secret keys
                 instead.  This is normally not very useful and a
                 security  risk.   The second form of the command
                 has the special property to  render  the  secret
                 part  of  the primary key useless; this is a GNU
                 extension to OpenPGP and  other  implementations
                 can  not be expected to successfully import such
                 a key.

                 See the option --simple-sk-checksum if you  want
                 to  import  such  an  exported key with an older
                 OpenPGP implementation.

       --import [files]

       --fast-import [files]
                 Import/merge keys. This adds the given  keys  to
                 the keyring.  The fast version is currently just
                 a synonym.

                 There are a few other options which control  how
                 tures,  user  IDs, etc.  Option --keyserver must
                 be used to give the name of this keyserver.

       --search-keys [names]
                 Search the keyserver for the given names.   Mul­
                 tiple  names  given here will be joined together
                 to create the search string for  the  keyserver.
                 Option --keyserver must be used to give the name
                 of this keyserver.

       --update-trustdb
                 Do trust DB maintenance.  This command goes over
                 all keys and builds the Web-of-Trust. This is an
                 interactive command because it may  has  to  ask
                 for  the  "ownertrust" values of keys.  The user
                 has to give an estimation in how far she  trusts
                 the owner of the displayed key to correctly cer­
                 tify (sign) other keys.  It does  only  ask  for
                 that  value if it has not yet been assigned to a
                 key.  Using the edit menu,  that  value  can  be
                 changed at any time later.

       --check-trustdb
                 Do  trust  DB  maintenance without user interac­
                 tion.  Form time to time the trust database must
                 be  updated  so  that expired keys and resulting
                 changes in  the  Web-of-Trust  can  be  tracked.
                 GnuPG  tries to figure when this is required and
                 then does it implicitly;  this  command  can  be
                 used  to  force such a check.  The processing is
                 identically to that of --update-trustdb  but  it
                 skips  keys with a not yet defined "ownertrust".

                 For use with cron jobs, this command can be used
                 together with --batch in which case the check is
                 only done when it is due.  To force a  run  even
                 in batch mode add the option --yes.

       --export-ownertrust [file]
                 Store  the ownertrust values into file (or stdin
                 if not given).  This is useful for  backup  pur­
                 poses  as  these  values are the only ones which
                 can't be re-created from a corrupted trust DB.

       --import-ownertrust [files]
                 Update the trustdb with  the  ownertrust  values
                 stored  in files (or stdin if not given); exist­
                 ing values will be overwritten.

       --rebuild-keydb-caches
                 When updating from version 1.0.6 to  1.0.7  this
                 command  should  be  used  to  create  signature
                 sequence  of  random  bytes  will  be   emitted.
                 PLEASE,  don't  use this command unless you know
                 what you  are  doing;  it  may  remove  precious
                 entropy from the system!

       --gen-prime mode                  bits             [qbits]
                 Use  the  source, Luke :-). The output format is
                 still subject to change.

       --version Print version information along with a  list  of
                 supported algorithms.

       --warranty
                 Print warranty information.

       -h, --help
                 Print  usage information.  This is a really long
                 list even though it doesn't list all options.


OPTIONS

       Long options can  be  put  in  an  options  file  (default
       "~/.gnupg/gpg.conf").   Short option names will not work -
       for example, "armor" is a valid  option  for  the  options
       file,  while  "a"  is not.  Do not write the 2 dashes, but
       simply the name of the option and any required  arguments.
       Lines with a hash ('#') as the first non-white-space char­
       acter are ignored.  Commands may be put in this file  too,
       but that does not make sense.

       gpg recognizes these options:

       -a, --armor
                 Create ASCII armored output.

       -o, --output file
                 Write output to file.

       --no-mangle-dos-filenames

       --mangle-dos-filenames
                 The  Windows  version of GPG replaces the exten­
                 sion of an output  filename  to  avoid  problems
                 with  filenames  containing  more  than one dot.
                 This is not necessary for newer Windows  version
                 and  such  --no-mangle-dos-filenames can be used
                 to switch this feature off and have  GPG  append
                 the new extension.   This otion has no effect on
                 non-windows platforms.

       -u, --local-user name
                 Use name as the user ID to sign.  This option is
                 silently  ignored for the list commands, so that
                 Use name as default recipient if option --recip­
                 ient  is  not  used  and  don't ask if this is a
                 valid one. name must be non-empty.

       --default-recipient-self
                 Use the default  key  as  default  recipient  if
                 option  --recipient is not used and don't ask if
                 this is a valid one.  The  default  key  is  the
                 first one from the secret keyring or the one set
                 with --default-key.

       --no-default-recipient
                 Reset --default-recipient and  --default-recipi­
                 ent-self.

       --encrypt-to name
                 Same as --recipient but this one is intended for
                 use in the options file and  may  be  used  with
                 your own user-id as an "encrypt-to-self".  These
                 keys are only used when there are other  recipi­
                 ents  given  either  by use of --recipient or by
                 the asked user id.  No trust  checking  is  per­
                 formed for these user ids and even disabled keys
                 can be used.

       --no-encrypt-to
                 Disable the use of all --encrypt-to keys.

       -v, --verbose
                 Give more information during processing. If used
                 twice, the input data is listed in detail.

       -q, --quiet
                 Try to be as quiet as possible.

       -z n, --compress n
                 Set  compression  level to n. A value of 0 for n
                 disables compression.  Default  is  to  use  the
                 default  compression level of zlib (normally 6).

       -t, --textmode
                 Use  canonical  text  mode.   If  -t  (but   not
                 --textmode)  is  used together with armoring and
                 signing,  this  enables  clearsigned   messages.
                 This  kludge  is  needed  for PGP compatibility;
                 normally you would use --sign or --clearsign  to
                 selected the type of the signature.

       -n, --dry-run
                 Don't  make  any changes (this is not completely
                 implemented).


       --yes     Assume "yes" on most questions.

       --no      Assume "no" on most questions.

       --default-cert-check-level n
                 The  default  to  use  for  the check level when
                 signing a key.

                 0 means you make no particular claim as  to  how
                 carefully you verified the key.

                 1 means you believe the key is owned by the per­
                 son who claims to own it but you could  not,  or
                 did  not  verify the key at all.  This is useful
                 for a "persona" verification, where you sign the
                 key of a pseudonymous user.

                 2  means you did casual verification of the key.
                 For example, this could mean that  you  verified
                 that the key fingerprint and checked the user ID
                 on the key against a photo ID.

                 3 means you did extensive  verification  of  the
                 key.  For example, this could mean that you ver­
                 ified the key fingerprint with the owner of  the
                 key in person, and that you checked, by means of
                 a hard to forge document with a photo  ID  (such
                 as  a  passport)  that the name of the key owner
                 matches the name in the user ID on the key,  and
                 finally that you verified (by exchange of email)
                 that the email address on the key belongs to the
                 key owner.

                 Note  that the examples given above for levels 2
                 and 3 are just that: examples.  In the  end,  it
                 is  up  to  you to decide just what "casual" and
                 "extensive" mean to you.

                 This option defaults to 0.

       --trusted-key long key ID
                 Assume that the specified  key  (which  must  be
                 given  as a  full 8 byte key ID) is as trustwor­
                 thy as one of your own secret keys. This  option
                 is  useful if you don't want to keep your secret
                 keys (or one of them) online but still  want  to
                 be able to check the validity of a given recipi­
                 ent's or signator's key.

       --trust-model classic|always
                 Set what trust model GnuPG should  follow.   The
                           key.

       --always-trust
                 Identical to `--trust-model always'

       --keyserver name
                 Use name as your keyserver.  This is the  server
                 that --recv-keys, --send-keys, and --search-keys
                 will communicate with to receive keys from, send
                 keys  to, and search for keys on.  The format of
                 the  name  is  a   URI:   `scheme:[//]keyserver­
                 name[:port]'  The  scheme  is  the  type of key­
                 server: "hkp" for the Horowitz  (or  compatible)
                 keyservers,  "ldap"  for the NAI LDAP keyserver,
                 or "mailto" for the  Horowitz  email  keyserver.
                 Note  that your particular installation of GnuPG
                 may have  other  keyserver  types  available  as
                 well.  Keyserver schemes are case-insensitive.

                 Most  keyservers synchronize with each other, so
                 there is generally no need to send keys to  more
                 than  one  server.   Using  the command "host -l
                 pgp.net | grep wwwkeys" gives you a list of  HKP
                 keyservers.   When  using  one  of  the  wwwkeys
                 servers, due to load balancing using round-robin
                 DNS  you may notice that you get a different key
                 server each time.

       --keyserver-options parameters
                 This is a space or comma delimited  string  that
                 gives options for the keyserver.  Options can be
                 prepended with a  `no-'  to  give  the  opposite
                 meaning.  Valid import-options or export-options
                 may be used here as well to apply  to  importing
                 (--recv-key)  or  exporting  (--send-key)  a key
                 from a keyserver.  While  not  all  options  are
                 available  for  all keyserver types, some common
                 options are:

                 include-revoked
                           When  searching   for   a   key   with
                           --search-keys,  include  keys that are
                           marked on the  keyserver  as  revoked.
                           Note  that  this  option is always set
                           when using the NAI HKP  keyserver,  as
                           this  keyserver does not differentiate
                           between revoked and unrevoked keys.

                 include-disabled
                           When  searching   for   a   key   with
                           --search-keys,  include  keys that are
                           marked on the keyserver  as  disabled.
                           efficient  method.  This option forces
                           GnuPG to use temporary files to commu­
                           nicate.   On  some  platforms (such as
                           Win32 and RISC  OS),  this  option  is
                           always enabled.

                 keep-temp-files
                           If   using  `use-temp-files',  do  not
                           delete  the  temp  files  after  using
                           them.   This option is useful to learn
                           the keyserver  communication  protocol
                           by reading the temporary files.

                 verbose   Tell  the  keyserver helper program to
                           be more verbose.  This option  can  be
                           repeated  multiple  times  to increase
                           the verbosity level.

                 honor-http-proxy
                           For keyserver schemes  that  use  HTTP
                           (such  as HKP), try to access the key­
                           server over the  proxy  set  with  the
                           environment variable "http_proxy".

                 auto-key-retrieve
                           This   option  enables  the  automatic
                           retrieving of keys  from  a  keyserver
                           when verifying signatures made by keys
                           that are not on the local keyring.

       --import-options parameters
                 This is a space or comma delimited  string  that
                 gives  options  for importing keys.  Options can
                 be prepended with a `no-' to give  the  opposite
                 meaning.  The options are:

                 allow-local-sigs
                           Allow  importing key signatures marked
                           as "local".   This  is  not  generally
                           useful  unless a shared keyring scheme
                           is being used.  Defaults to no.

                 repair-hkp-subkey-bug
                           During import, attempt to  repair  the
                           HKP  keyserver  mangling multiple sub­
                           keys bug.  Note that this cannot  com­
                           pletely repair the damaged key as some
                           crucial data is removed  by  the  key­
                           server,  but it does at least give you
                           back one subkey.  Defaults to  no  for
                           regular  --import  and to yes for key­
                           server --recv-keys.
                           useful unless a shared keyring  scheme
                           is being used.  Defaults to no.

                 include-attributes
                           Include attribute user IDs (photo IDs)
                           while exporting.  This  is  useful  to
                           export  keys  if  they are going to be
                           used by an OpenPGP program  that  does
                           not   accept   attribute   user   IDs.
                           Defaults to yes.

                 include-sensitive-revkeys
                           Include designated revoker information
                           that   was   marked   as  "sensitive".
                           Defaults to no.

       --show-photos
                 Causes --list-keys, --list-sigs,  --list-public-
                 keys, --list-secret-keys, and verifying a signa­
                 ture to also display the photo  ID  attached  to
                 the key, if any.  See also --photo-viewer.

       --no-show-photos
                 Resets the --show-photos flag.

       --photo-viewer string
                 This  is  the command line that should be run to
                 view a photo ID.  "%i" will  be  expanded  to  a
                 filename  containing  the  photo.  "%I" does the
                 same, except the file will not be  deleted  once
                 the  viewer exits.  Other flags are "%k" for the
                 key ID, "%K" for the long key ID, "%f"  for  the
                 key  fingerprint,  "%t" for the extension of the
                 image type (e.g. "jpg"), "%T" for the MIME  type
                 of  the  image (e.g. "image/jpeg"), and "%%" for
                 an actual percent sign.  If neither %i or %I are
                 present,  then the photo will be supplied to the
                 viewer on standard input.

                 The default viewer is "xloadimage  -fork  -quiet
                 -title 'KeyID 0x%k' stdin"

       --exec-path string
                 Sets  a  list of directories to search for photo
                 viewers and keyserver helpers.  If not provided,
                 keyserver  helpers  use  the compiled-in default
                 directory, and photo viewers use the $PATH envi­
                 ronment variable.

       --show-keyring
                 Causes   --list-keys,   --list-public-keys,  and
                 --list-secret-keys to display the  name  of  the

                 It might make sense  to  use  it  together  with
                 --no-default-keyring.

       --secret-keyring file
                 Same as --keyring but for the secret keyrings.

       --homedir directory
                 Set  the name of the home directory to directory
                 If this  option  is  not  used  it  defaults  to
                 "~/.gnupg".  It  does not make sense to use this
                 in a options file. This also overrides the envi­
                 ronment variable "GNUPGHOME".

       --charset name
                 Set  the name of the native character set.  This
                 is used to convert some strings to proper  UTF-8
                 encoding.  If  this  option  is  not  used,  the
                 default character set  is  determined  from  the
                 current  locale.   A  verbosity level of 3 shows
                 the used one.  Valid values for name are:

                 iso-8859-1
                           This is the Latin 1 set.

                 iso-8859-2
                           The Latin 2 set.

                 iso-8859-15
                           This is currently  an  alias  for  the
                           Latin 1 set.

                 koi8-r    The usual Russian set (rfc1489).

                 utf-8     Bypass  all  translations  and  assume
                           that the OS uses native  UTF-8  encod­
                           ing.

       --utf8-strings

       --no-utf8-strings
                 Assume  that  the arguments are already given as
                 UTF8 strings.  The  default  (--no-utf8-strings)
                 is  to  assume that arguments are encoded in the
                 character set as specified by  --charset.  These
                 options  affect  all  following arguments.  Both
                 options may be used multiple times.

       --options file
                 Read options from file and do not  try  to  read
                 them  from the default options file in the home­
                 dir (see --homedir). This option is  ignored  if
                 option is deprecated.

       --debug flags
                 Set  debugging  flags.  All  flags are or-ed and
                 flags may be given in C syntax (e.g. 0x0042).

       --debug-all
                 Set all useful debugging flags.

       --status-fd n
                 Write  special  status  strings  to   the   file
                 descriptor n.  See the file DETAILS in the docu­
                 mentation for a listing of them.

       --logger-fd n
                 Write log output to file descriptor n and not to
                 stderr.

       --attribute-fd n
                 Write  attribute subpackets to the file descrip­
                 tor n.  This is most useful for use with  --sta­
                 tus-fd,  since the status messages are needed to
                 separate out the  various  subpackets  from  the
                 stream delivered to the file descriptor.

       --sk-comments
                 Include  secret key comment packets when export­
                 ing secret keys.  This is a GnuPG  extension  to
                 the  OpenPGP  standard,  and  is off by default.
                 Please note that this has nothing to do with the
                 comments in clear text signatures or armor head­
                 ers.

       --no-sk-comments
                 Resets the --sk-comments option.

       --no-comment
                 See --sk-comments.  This  option  is  deprecated
                 and may be removed soon.

       --comment string
                 Use  string as comment string in clear text sig­
                 natures.  The default is not do write a  comment
                 string.

       --default-comment
                 Force  to  write  the standard comment string in
                 clear text signatures.  Use this to overwrite  a
                 --comment  from  a  config file.  This option is
                 now obsolete because there is no default comment
                 string anymore.

                 Put the name value pair into  the  signature  as
                 notation data.  name must consist only of print­
                 able characters or spaces, and  must  contain  a
                 '@'  character.   This is to help prevent pollu­
                 tion of the IETF  reserved  notation  namespace.
                 The --expert flag overrides the encoded in UTF8,
                 so you should check that your --charset  is  set
                 correctly.   If you prefix name with an exclama­
                 tion mark, the notation data will be flagged  as
                 critical   (rfc2440:5.2.3.15).    --sig-notation
                 sets a notation for  data  signatures.   --cert-
                 notation  sets  a  notation  for  key signatures
                 (certifications).  --notation-data sets both.

                 There are special codes  that  may  be  used  in
                 notation  names.  "%k" will be expanded into the
                 key ID of the key being  signed,  "%K"  for  the
                 long  key  ID  of the key being signed, "%f" for
                 the key fingerprint of  the  key  being  signed,
                 "%s" for the key ID of the key making the signa­
                 ture, "%S" for the long key ID of the key making
                 the signature, and "%%" results in a single "%".
                 %k, %K, and %f are only meaningful when making a
                 key signature (certification).

       --show-notation
                 Show  signature  notations in the --list-sigs or
                 --check-sigs listings as well as when  verifying
                 a signature with a notation in it.

       --no-show-notation
                 Do not show signature notations.

       --sig-policy-url string

       --cert-policy-url string

       --set-policy-url string
                 Use   string   as   Policy  URL  for  signatures
                 (rfc2440:5.2.3.19).  If you prefix  it  with  an
                 exclamation  mark, the policy URL packet will be
                 flagged as critical.  --sig-policy-url sets a  a
                 policy  url for data signatures.  --cert-policy-
                 url sets a policy url for key signatures (certi­
                 fications).  -set-policy-url sets both.

                 The  same  %-expandos used for notation data are
                 available here as well.

       --show-policy-url
                 Show policy URLs in the --list-sigs or  --check-
                 sigs listings as well as when verifying a signa­
                 resistant  font  to  display  the message.  This
                 option overrides --set-filename.

       --no-for-your-eyes-only
                 Resets the --for-your-eyes-only flag.

       --use-embedded-filename
                 Try to create a file with a name as embedded  in
                 the  data.  This can be a dangerous option as it
                 allows to overwrite files.

       --completes-needed n
                 Number of completely trusted users to  introduce
                 a new key signer (defaults to 1).

       --marginals-needed n
                 Number  of marginally trusted users to introduce
                 a new key signer (defaults to 3)

       --max-cert-depth n
                 Maximum depth of a certification chain  (default
                 is 5).

       --cipher-algo name
                 Use   name as cipher algorithm. Running the pro­
                 gram with the command --version yields a list of
                 supported  algorithms.  If  this is not used the
                 cipher algorithm is selected  from  the  prefer­
                 ences stored with the key.

       --digest-algo name
                 Use  name  as the message digest algorithm. Run­
                 ning the  program  with  the  command  --version
                 yields a list of supported algorithms.

       --cert-digest-algo name
                 Use  name  as  the message digest algorithm used
                 when signing a key.  Running  the  program  with
                 the command --version yields a list of supported
                 algorithms.  Be aware  that  if  you  choose  an
                 algorithm  that GnuPG supports but other OpenPGP
                 implementations do not, then some users will not
                 be  able  to use the key signatures you make, or
                 quite possibly your entire key.

       --s2k-cipher-algo name
                 Use name as the cipher algorithm used to protect
                 secret keys.  The default cipher is CAST5.  This
                 cipher is also used for conventional  encryption
                 if --cipher-algo is not given.

       --s2k-digest-algo name
       --simple-sk-checksum
                 Secret keys are integrity protected by  using  a
                 SHA-1  checksum.  This method will be part of an
                 enhanced OpenPGP specification but GnuPG already
                 uses  it  as  a  countermeasure  against certain
                 attacks.  Old applications don't understand this
                 new format, so this option may be used to switch
                 back to the  old  behaviour.   Using  this  this
                 option  bears  a security risk.  Note that using
                 this option only takes effect  when  the  secret
                 key is encrypted - the simplest way to make this
                 happen is to change the passphrase  on  the  key
                 (even  changing  it to the same value is accept­
                 able).

       --compress-algo n
                 Use compression algorithm n.   The  value  2  is
                 RFC1950   ZLIB  compression.   The  value  1  is
                 RFC-1951 ZIP compression which is used  by  PGP.
                 0  disables  compression.  If this option is not
                 used, the default behavior  is  to  examine  the
                 recipient  key  preferences  to  see which algo­
                 rithms the  recipient  supports.   If  all  else
                 fails,  ZIP  is  used for maximum compatibility.
                 Note, however, that ZLIB may  give  better  com­
                 pression  results  if that is more important, as
                 the compression window size is  not  limited  to
                 8k.

       --disable-cipher-algo name
                 Never allow the use of name as cipher algorithm.
                 The given name will not be  checked  so  that  a
                 later  loaded algorithm will still get disabled.

       --disable-pubkey-algo name
                 Never allow the use of name as public key  algo­
                 rithm.   The  given  name will not be checked so
                 that a later loaded  algorithm  will  still  get
                 disabled.

       --no-sig-cache
                 Do not cache the verification status of key sig­
                 natures.  Caching gives a  much  better  perfor­
                 mance  in key listings.  However, if you suspect
                 that your public keyring  is  not  save  against
                 write  modifications, you can use this option to
                 disable the caching.  It probably does not  make
                 sense  to  disable it because all kind of damage
                 can be done if someone else has write access  to
                 your public keyring.

       --no-sig-create-check
                 This may be a time consuming process.

       --no-auto-check-trustdb
                 Resets the --auto-check-trustdb option.

       --throw-keyid
                 Do not put the  keyid  into  encrypted  packets.
                 This  option  hides  the receiver of the message
                 and is a countermeasure against  traffic  analy­
                 sis.   It  may  slow down the decryption process
                 because all available secret keys are tried.

       --not-dash-escaped
                 This option changes the  behavior  of  cleartext
                 signatures  so  that  they can be used for patch
                 files. You should not send such an armored  file
                 via  email  because  all spaces and line endings
                 are hashed too.  You can not use this option for
                 data  which  has  5 dashes at the beginning of a
                 line, patch files don't  have  this.  A  special
                 armor header line tells GnuPG about this cleart­
                 ext signature option.

       --escape-from-lines
                 Because some mailers change lines starting  with
                 "From  "  to  "<From " it is good to handle such
                 lines in a special way when  creating  cleartext
                 signatures.  All  other  PGP versions do it this
                 way too. This option is not enabled  by  default
                 because it would violate rfc2440.

       --passphrase-fd n
                 Read  the  passphrase from file descriptor n. If
                 you use 0 for n, the  passphrase  will  be  read
                 from  stdin.     This  can  only be used if only
                 one passphrase  is  supplied.   Don't  use  this
                 option if you can avoid it.

       --command-fd n
                 This is a replacement for the deprecated shared-
                 memory IPC mode.  If  this  option  is  enabled,
                 user input on questions is not expected from the
                 TTY but from  the  given  file  descriptor.   It
                 should  be  used  together with --status-fd. See
                 the file doc/DETAILS in the source  distribution
                 for details on how to use it.

       --use-agent
                 Try  to  use  the  GnuPG-Agent. Please note that
                 this agent is  still  under  development.   With
                 this option, GnuPG first tries to connect to the
                 agent before it asks for a passphrase.
                 but the MIT release is a good common baseline.

                 This  option  implies  `--rfc1991   --no-openpgp
                 --disable-mdc  --no-force-v4-certs  --no-comment
                 --escape-from-lines  --force-v3-sigs   --no-ask-
                 sig-expire   --no-ask-cert-expire  --cipher-algo
                 IDEA --digest-algo MD5 --compress-algo  1'.   It
                 also disables --textmode when encrypting.

       --no-pgp2 Resets the --pgp2 option.

       --pgp6    Set  up  all options to be as PGP 6 compliant as
                 possible.  This restricts  you  to  the  ciphers
                 IDEA  (if  the  IDEA plugin is installed), 3DES,
                 and CAST5, the hashes MD5, SHA1  and  RIPEMD160,
                 and  the  compression  algorithms  none and ZIP.
                 This also  disables  --throw-keyid,  and  making
                 signatures  with  signing  subkeys as PGP 6 does
                 not understand signatures made by  signing  sub­
                 keys.

                 This  option implies `--disable-mdc --no-comment
                 --escape-from-lines  --force-v3-sigs   --no-ask-
                 sig-expire --compress-algo 1'

       --no-pgp6 Resets the --pgp6 option.

       --pgp7    Set  up  all options to be as PGP 7 compliant as
                 possible.  This is identical  to  --pgp6  except
                 that  MDCs  are  not  disabled,  and the list of
                 allowable ciphers is  expanded  to  add  AES128,
                 AES192, AES256, and TWOFISH.

       --no-pgp7 Resets the --pgp7 option.

       --pgp8    Set  up  all options to be as PGP 8 compliant as
                 possible.  PGP 8 is a lot closer to the  OpenPGP
                 standard  than  previous versions of PGP, so all
                 this  does  is  disable  --throw-keyid  and  set
                 --escape-from-lines  and --compress-algo 1.  The
                 allowed algorithms list is the same as --pgp7.

       --no-pgp8 Resets the --pgp8 option.

       --openpgp Reset all packet, cipher and digest  options  to
                 OpenPGP  behavior.  Use this option to reset all
                 previous  options   like   --rfc1991,   --force-
                 v3-sigs,  --s2k-*,  --cipher-algo, --digest-algo
                 and --compress-algo to OpenPGP compliant values.
                 All PGP workarounds are also disabled.

       --force-v3-sigs
                 rithm for v3 RSA keys from MD5 to SHA-1.

       --no-force-v4-certs
                 Reset the --force-v4-certs option.

       --force-mdc
                 Force  the use of encryption with a modification
                 detection code.  This is always  used  with  the
                 newer  ciphers  (those  with a blocksize greater
                 than 64 bits), or if the recipient key  has  one
                 of those ciphers as a preference.

       --disable-mdc
                 Disable  the  use  of the modification detection
                 code.  Note  that  by  using  this  option,  the
                 encrypted  message  becomes vulnerable to a mes­
                 sage modification attack.

       --allow-non-selfsigned-uid
                 Allow the import and use of keys with  user  IDs
                 which  are  not self-signed.  This is not recom­
                 mended, as a non self-signed user ID is  trivial
                 to forge.

       --no-allow-non-selfsigned-uid
                 Reset the --allow-non-selfsigned-uid option.

       --allow-freeform-uid
                 Disable  all  checks  on the form of the user ID
                 while generating a new one.  This option  should
                 only  be used in very special environments as it
                 does not ensure the de-facto standard format  of
                 user IDs.

       --ignore-time-conflict
                 GnuPG  normally checks that the timestamps asso­
                 ciated with keys and signatures  have  plausible
                 values.  However, sometimes a signature seems to
                 be older than the key  due  to  clock  problems.
                 This option makes these checks just a warning.

       --ignore-valid-from
                 GnuPG  normally  does not select and use subkeys
                 created in the future.  This option  allows  the
                 use of such keys and thus exhibits the pre-1.0.7
                 behaviour.   You  should  not  use  this  option
                 unless you there is some clock problem.

       --ignore-crc-error
                 The  ASCII armor used by OpenPGP is protected by
                 a  CRC  checksum  against  transmission  errors.
                 Sometimes  it  happens that the CRC gets mangled

       --lock-once
                 Lock the databases the  first  time  a  lock  is
                 requested  and do not release the lock until the
                 process terminates.

       --lock-multiple
                 Release the locks every time a lock is no longer
                 needed.  Use this to override a previous --lock-
                 once from a config file.

       --lock-never
                 Disable locking entirely.  This option should be
                 used only in very special environments, where it
                 can be assured that only one process is  access­
                 ing  those  files.   A  bootable  floppy  with a
                 stand-alone encryption system will probably  use
                 this.  Improper usage of this option may lead to
                 data and key corruption.

       --no-random-seed-file
                 GnuPG uses a file to store its  internal  random
                 pool over invocations.  This makes random gener­
                 ation faster; however sometimes write operations
                 are  not  desired.   This  option can be used to
                 achieve that with the cost of slower random gen­
                 eration.

       --no-verbose
                 Reset verbose level to 0.

       --no-greeting
                 Suppress  the  initial  copyright message but do
                 not enter batch mode.

       --no-secmem-warning
                 Suppress the warning about "using insecure  mem­
                 ory".

       --no-permission-warning
                 Suppress  the  warning about unsafe file permis­
                 sions.  Note that  the  file  permission  checks
                 that  GnuPG does are not intended to be authori­
                 tative, rather they simply  warn  about  certain
                 common  permission problems.  Do not assume that
                 the lack of a warning means that your system  is
                 secure.

       --no-mdc-warning
                 Suppress the warning about missing MDC integrity
                 protection.

                 Print key listings delimited by  colons.   Note,
                 that the output will be encoded in UTF-8 regard­
                 less of any --charset setting.

       --with-key-data
                 Print key listings  delimited  by  colons  (like
                 --with-colons) and print the public key data.

       --with-fingerprint
                 Same  as  the  command --fingerprint but changes
                 only the format of the output and  may  be  used
                 together with another command.

       --fast-list-mode
                 Changes  the output of the list commands to work
                 faster; this is achieved by leaving  some  parts
                 empty.  Some applications don't need the user ID
                 and the trust information given in the listings.
                 By  using  this  options  they  can get a faster
                 listing.  The exact behaviour of this option may
                 change in future versions.

       --fixed-list-mode
                 Do  not merge user ID and primary key in --with-
                 colon listing mode and print all  timestamps  as
                 seconds since 1970-01-01.

       --list-only
                 Changes the behaviour of some commands.  This is
                 like --dry-run but different in some cases.  The
                 semantic  of this command may be extended in the
                 future.  Currently  it  only  skips  the  actual
                 decryption  pass  and  therefore  enables a fast
                 listing of the encryption keys.

       --no-literal
                 This is not for normal use.  Use the  source  to
                 see for what it might be useful.

       --set-filesize
                 This  is  not for normal use.  Use the source to
                 see for what it might be useful.

       --emulate-md-encode-bug
                 GnuPG versions prior to 1.0.2 had a bug  in  the
                 way  a  signature  was  encoded.   This  options
                 enables a workaround by checking  faulty  signa­
                 tures  again  with the encoding used in old ver­
                 sions.  This may only happen for ElGamal  signa­
                 tures which are not widely used.

       --show-session-key
                 string.  The format of this string is  the  same
                 as  the one printed by --show-session-key.  This
                 option is normally not used but comes  handy  in
                 case someone forces you to reveal the content of
                 an encrypted message; using this option you  can
                 do this without handing out the secret key.

       --ask-sig-expire
                 When  making  a  data  signature,  prompt for an
                 expiration time.  If this option is  not  speci­
                 fied, the expiration time is "never".

       --no-ask-sig-expire
                 Resets the --ask-sig-expire option.

       --ask-cert-expire
                 When making a key signature, prompt for an expi­
                 ration time.  If this option is  not  specified,
                 the expiration time is "never".

       --no-ask-cert-expire
                 Resets the --ask-cert-expire option.

       --expert  Allow  the  user  to  do  certain nonsensical or
                 "silly"  things  like  signing  an  expired   or
                 revoked key, or certain potentially incompatible
                 things like  generating  deprecated  key  types.
                 This  also  disables  certain  warning  messages
                 about potentially incompatible actions.  As  the
                 name  implies,  this option is for experts only.
                 If you don't fully understand  the  implications
                 of what it allows you to do, leave this off.

       --no-expert
                 Resets the --expert option.

       --merge-only
                 Don't  insert  new  keys into the keyrings while
                 doing an import.

       --allow-secret-key-import
                 This is an obsolete option and is not used  any­
                 where.

       --try-all-secrets
                 Don't  look  at the key ID as stored in the mes­
                 sage but try all secret keys in turn to find the
                 right  decryption  key.   This option forces the
                 behaviour as used by anonymous recipients  (cre­
                 ated  by  using  --throw-keyid)  and  might come
                 handy in case where an  encrypted  message  con­
                 tains a bogus key ID.
                 will be expanded to the values specified.

                 The  values are key IDs or fingerprints, but any
                 key description is accepted.  Note that a  value
                 with spaces in it will be treated as two differ­
                 ent values.  Note also there is only  one  level
                 of  expansion  -  you  cannot make an group that
                 points to another group.   When  used  from  the
                 command  line,  it may be necessary to quote the
                 argument to this option  to  prevent  the  shell
                 from treating it as multiple arguments.

       --preserve-permissions
                 Don't change the permissions of a secret keyring
                 back to user read/write only.  Use  this  option
                 only if you really know what you are doing.

       --personal-cipher-preferences string
                 Set  the  list of personal cipher preferences to
                 string, this list should be a string similar  to
                 the  one  printed  by  the command "pref" in the
                 edit menu.  This allows the user  to  factor  in
                 their  own  preferred algorithms when algorithms
                 are chosen via recipient key preferences.

       --personal-digest-preferences string
                 Set the list of personal digest  preferences  to
                 string,  this list should be a string similar to
                 the one printed by the  command  "pref"  in  the
                 edit  menu.   This  allows the user to factor in
                 their own preferred algorithms  when  algorithms
                 are chosen via recipient key preferences.

       --personal-compress-preferences string
                 Set the list of personal compression preferences
                 to string, this list should be a string  similar
                 to  the one printed by the command "pref" in the
                 edit menu.  This allows the user  to  factor  in
                 their  own  preferred algorithms when algorithms
                 are chosen via recipient key preferences.

       --default-preference-list string
                 Set the list of default preferences  to  string,
                 this  list should be a string similar to the one
                 printed by the command "pref" in the edit  menu.
                 This  affects  both key generation and "updpref"
                 in the edit menu.


How to specify a user ID

       There are different ways on how to specify a  user  ID  to
       GnuPG; here are some examples:


       0F323456784E56EAB

       01AB3FED1347A5612

       0x234AABBCC34567C4
                 Here the key ID is given in  the  long  form  as
                 used  by  OpenPGP  (you  can get the long key ID
                 using the option --with-colons).

       1234343434343434C434343434343434

       123434343434343C3434343434343734349A3434

       0E12343434343434343434EAB3484343434343434

       0xE12343434343434343434EAB3484343434343434
                 The best way to specify a key ID is by using the
                 fingerprint of the key.  This avoids any ambigu­
                 ities in case that there are duplicated key  IDs
                 (which are really rare for the long key IDs).

       =Heinrich Heine <heinrichh@uni-duesseldorf.de>
                 Using  an exact to match string.  The equal sign
                 indicates this.

       <heinrichh@uni-duesseldorf.de>
                 Using the email address part  which  must  match
                 exactly.  The  left angle bracket indicates this
                 email address mode.

       +Heinrich Heine duesseldorf
                 All words must match exactly  (not  case  sensi­
                 tive)  but  can  appear in any order in the user
                 ID.  Words are any sequences of letters, digits,
                 the  underscore  and  all  characters with bit 7
                 set.

       Heine

       *Heine    By case insensitive substring matching.  This is
                 the  default  mode  but applications may want to
                 explicitly indicate this by putting the asterisk
                 in front.

       Note that you can append an exclamation mark to key IDs or
       fingerprints.  This flag tells GnuPG to  use  exactly  the
       given  primary  or  secondary key and not to try to figure
       out which secondary or primary key to use.



RETURN VALUE


       gpg --list-keys  user_ID
                 show keys

       gpg --fingerprint  user_ID
                 show fingerprint

       gpg --verify  pgpfile

       gpg --verify  sigfile [files]
                 Verify the signature of the file but do not out­
                 put  the  data.  The  second  form  is  used for
                 detached  signatures,  where  sigfile   is   the
                 detached  signature  (either  ASCII  armored  of
                 binary) and [files] are the signed data; if this
                 is  not  given  the name of the file holding the
                 signed data is constructed by  cutting  off  the
                 extension  (".asc"  or  ".sig") of sigfile or by
                 asking the user for the filename.


ENVIRONMENT

       HOME      Used to locate the default home directory.

       GNUPGHOME If set directory used instead of "~/.gnupg".

       GPG_AGENT_INFO
                 Used to locate the gpg-agent; only honored  when
                 --use-agent  is  set.   The  value consists of 3
                 colon delimited fields: The first is the path to
                 the  Unix  Domain  Socket, the second the PID of
                 the gpg-agent and  the  protocol  version  which
                 should be set to 1.  When starting the gpg-agent
                 as described in its documentation, this variable
                 is  set to the correct value.  The option --gpg-
                 agent-info can be used to override it.

       http_proxy
                 Only honored when  the  keyserver-option  honor-
                 http-proxy is set.


FILES

       ~/.gnupg/secring.gpg
                 The secret keyring

       ~/.gnupg/secring.gpg.lock
                 and the lock file

       ~/.gnupg/pubring.gpg
                 The public keyring

       ~/.gnupg/pubring.gpg.lock
                 and the lock file
                 Old  style  configuration  file;  only used when
                 gpg.conf is not found

       /usr[/local]/share/gnupg/options.skel
                 Skeleton options file

       /usr[/local]/lib/gnupg/
                 Default location for extensions


WARNINGS

       Use a *good* password for your user account and  a  *good*
       passphrase to protect your secret key.  This passphrase is
       the weakest part of the whole system.  Programs to do dic­
       tionary  attacks  on  your secret keyring are very easy to
       write and so you should protect your "~/.gnupg/" directory
       very well.

       Keep  in mind that, if this program is used over a network
       (telnet), it is *very* easy to spy out your passphrase!

       If you are going to verify detached signatures, make  sure
       that  the  program  knows  about it; either be giving both
       filenames on the command line or using - to specify stdin.


INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS

       GnuPG  tries  to  be a very flexible implementation of the
       OpenPGP standard.  In particular, GnuPG implements many of
       the   "optional"  parts  of  the  standard,  such  as  the
       RIPEMD/160 hash, and the ZLIB compression algorithms.   It
       is  important  to  be  aware that not all OpenPGP programs
       implement these optional algorithms and  that  by  forcing
       their  use  via  the --cipher-algo, --digest-algo, --cert-
       digest-algo, or --compress-algo options in  GnuPG,  it  is
       possible  to create a perfectly valid OpenPGP message, but
       one that cannot be read by the intended recipient.

       For example, as of this writing, no  version  of  official
       PGP  supports  the  BLOWFISH cipher algorithm.  If you use
       it, no PGP user will be able to decrypt your message.  The
       same  thing applies to the ZLIB compression algorithm.  By
       default, GnuPG will do the right thing and create messages
       that  are  usable  by  any OpenPGP program.  Only override
       this safe default if you know what you are doing.

       If you absolutely must override the safe default, you  are
       far  better  off  using  the  --pgp2,  --pgp6,  or  --pgp7
       options.  These options are safe as they do not force  any
       particular  algorithms in violation of OpenPGP, but rather
       reduce the available algorithms to a "PGP-safe" list.


BUGS

       On many  systems  this  program  should  be  installed  as

Man(1) output converted with man2html