GPGrelay   
[ GPGrelay ] [ Download ] [ Localisation ] [ Setup ] [ Development ]


Page-Navigation
A  General
B  Credits
C  Questions
C.1  What do I need to encrypt my communications?
C.2  What is GPGrelay?
C.3  What does GPGrelay do?
C.4  How do I install GPGrelay?
C.5  How does GPGrelay work?
C.6  How do I configure GPGrelay?
C.7  How do I configure the relays?
C.8  What's the protocol-transformation-option for a relay?
C.9  What are Keyrules? Why Profiles?
C.10  Why does GPGrelay not work?
C.11  How do I specify Keyrules / Profiles?
C.12  How do I associate a key with a Profile?
C.13  How do I edit Keyrules?
C.14  How do I delete Keyrules?
C.15  Why are there some greyed out icons below the keyrule-icons?
C.16  Which Keyrule is used to sign outgoing mail?
C.17  The key is associated with a Keyrule which tells GPGrelay to encrypt mails. But it doesn't...
C.18  What about BCC recipients?
C.19  What are Aliases?
C.20  Why should I use Aliases rather than adding another UserID?
C.21  What happens if a key has the same email-addr. as an alias?
C.22  How do I create Aliases?
C.23  What does "Learn from POP3" mean?
C.24  Is there something to be aware of when using "Learn from POP3"?
C.25  I don't have a keypair...
C.26  Can GPGrelay be started as a NT-Service?
C.27  Can GPGrelay be used together with Email-Client XXX?
C.28  Can GPGrelay be used together with Virus-Check/Spam-Filter/...?
C.29  After a crash (unfortunately this still happens) all changes I do to the settings are lost. Is this a bug?
C.30  After customizing GPGrelay, setting up relays, adding keyrules, profiles, etc., I'd like to know what's the easiest way to make a full backup of this setup?
C.31  Is it possible to specify in each profile which key I want to use to sign or to sign+encrypt(to self)?
C.32  After GPGrelay verified the signature, the signature is lost, isn't GPGrelay broken then?
D  
E  History


A : General
The latest version of this document can be obtained at:
http://gpgrelay.sourceforge.net

This document refers to GPG only. PGP will not be mentioned.

Everyone is welcome to contribute to this document.

Comments and improvements should be sent to the GPGrelay-List hosted on SourceForge:
gpgrelay-talk@lists.sourceforge.net


B : Credits
Thanks to dynaCore//.tSCc. a.k.a Andreas John for the program which lead to this FAQ.
This FAQ was initially created by Daniel Barié.
Currently it has no maintainer and isn't updated frequently...


C : Questions
Here, we'll deal with the questions and appropriate answers.


C.1 : What do I need to encrypt my communications?
To encrypt your communications via email, only GPG is needed. Several utilities exist to ease the handling of encrypted communications. One of those utilities is GPGrelay.


C.2 : What is GPGrelay?
GPGrelay is a program which latches into the communication between mailserver and mailclient.
See next question for further details.


C.3 : What does GPGrelay do?
GPGrelay handles the usage of GPG. Outgoing email can be encrypted, incoming email may be decrypted automatically using GPG.


C.4 : How do I install GPGrelay?
Go to http://gpgrelay.sourceforge.net to get a description with screenshots.


C.5 : How does GPGrelay work?
Normally, GPGrelay is, as implied by the name, a relay. It takes email from the user's client, forwards it to the mailserver and vice versa.
Additionally, emails may be encrypted using GnuPG.


C.6 : How do I configure GPGrelay?
After installation, GPGrelay looks for an installation of GPG. If none is found, the user will be prompted for the path of GPG. Existing keys will be imported automatically and can be used at once. After that, the most important thing to do is configuring the mailservers.
Next, keyrules and aliases should be created.
If no private keys are found in the keyring imported from GPG, GPGrelay will prompt the user for generation of a new keypair (private and public).


C.7 : How do I configure the relays?
Normally, there should be two mailservers in the "Relays" tab.
One for POP3, which is used for fetching mail from a mailserver, and another one for "SMTP", whose job is sending email.

New mailservers must be created when running GPGrelay for the first time.
Normally two new entries will be needed, one for sending (SMTP), the other one for receiving mail (POP3). But you can have more, depending on your "real" mailservers.

First, we'll configure the relay for sending mail:
Click the "Add" button ; this will open a new window. Within this window, you may wish to enter a name. I recommend entering the name of your mailserver, e. g. "mailserver.domain.com". You won't have to change something in the textbox labeled "Local Port" for now (the specified port should be free on your computer), so continue with "Remote Server".
Enter the mailserver of your provider, if in doubt about the name, contact the helpdesk of your provider. "Remote port" can be left as is, so just click the radio button "SMTP" in the lower left corner and you're done with the first server after clicking "OK".

Now for the second relay, which will be used to receive mail: Again, clicking the "Add" button will open a new window, just like before.
Enter a name for the relay. Careful now: "Local port" should be changed to "32110" (if you create a new relay, clicking the "POP3"-Checkbox at the bottom will also change this automatically).
"Remote Server" will be the name of your providers' mailserver. This relay may, but does not necessarily have to be the same as the one specified above. Don't change "Remote Port". Click the radio button "POP3" and "Remote Port" will be changed to "110" automatically. Click "OK".

The last thing to do is controling the checkboxes "SMTP" and "POP3". If they are not active, click "Restart Threads" and the checkboxes will be marked active.

Done.

Remark: Don't change the checkboxes during a running operation, e.g. fetching mail. This could result in erratic behaviour.


C.8 : What's the protocol-transformation-option for a relay?
SMTP- and POP3-Protocol have very basic authentification-method (SMTP has in fact none, but with ESMTP it introduces an option to support authentification).
This is more or less plaintext-login, so anyone can grab the password by passively listening on the wire.
So better try if the transformation is successfully working with your privider as this increases the security of your mailbox! (But first try WITHOUT to check if GPGrelay is configured correctly and working with your provider -- if it later fails with protocol-transformation, you know that you need to uncheck it)


C.9 : What are Keyrules? Why Profiles?
Keyrules tell GPGrelay what to do with your mail. This refers to "nothing", "sign", "sign and encrypt" or "encrypt".
This must be set for any possible Email-Address available through UserIDs of GPG-Keys.
To allow kind of "Mass-Update", Keyrules are placed below Profiles, so instead of changing the keyrule itself, you tell to which profile a keyrule belongs.


C.10 : Why does GPGrelay not work?
Hint: Did you specify Keyrules?
If it wasn't about Keyrules: Did you specify mailservers?
Or: Did you send mail to an unknown recipient? (Enter Aliases!)
Does your email-client connect to GPGrelay (127.0.0.1:32025 or similar) and does not bypass it with a direct connection to your mailserver?
Did you tell your email-client to connect to your local IP instead of the loopback (127.0.0.1)?


C.11 : How do I specify Keyrules / Profiles?
During the installation process, GPGrelay will create new keyrules for all keys with valid looking email-address imported from your GPG keyring and associate them with the "<Default Profile>".
To sign or encrypt mail, new Profiles will have to be specified. We will use the example "always encrypt" to show the creation of a new Profile. As implied by the name, mail for recipients within this profile should be encrypted all the time.

On the Keyrules-Tab click the "Add" button and enter a name for the new profile, in this example enter "always encrypt". After that, click the radio button "Encrypt". Clicking "OK" will close the window and save the profile.
Other options, instead of "Encrypt" are:
"Email-Subject" : First letters of the subject of the mail will control behaviour
"Sign" : Mail will be signed
"Encrypt & Sign" : Mail will be encrypted and signed
"Pass-Through" : Mail will be passed through without changes


C.12 : How do I associate a key with a Profile?
Just Drag and Drop the email-addresses associated with a key to the proper profile. You might consider using the context-menu ("Select all UserIDs of this key") on a email-address to select all UserID-Emails of a key.

Another possibility is clicking the key and afterwards "Edit Key". Choose the profile from the dropdown list.
Third: Double-click the key (which also leads to "Edit Key").


C.13 : How do I edit Keyrules?
Go to the tab "Keyrules". Mark the keyrule (single click) and click the "Edit" button.
Or just doubleclick the keyrule.

Keyrules offer to select which (sub)key to use for encrypting outgoing mails.
For secret keys it also offers to select the (sub)key that should be used for signing, as well as how to handle passphrases.

You can also select which profile should be used for the keyrule.


C.14 : How do I delete Keyrules?
If not already there, go to the tab "Keyrules". Mark the Keyrule and click the "Remove" button. All associated keys will be moved to the standard profile.


C.15 : Why are there some greyed out icons below the keyrule-icons?
If you have multiple keys which have the same email-address, GPGrelay only uses one of the available KeyIDs for encryption and another one for signing (if secret key is available).
The grey icons are simply there to show that one email-address actually has more than one key. Edit the keyrule to select the KeyID you prefer (you would normally select the one with the longest period before it expires).


C.16 : Which Keyrule is used to sign outgoing mail?
The keyrule that matches the recipient-email-address only specifies if the outgoing mail should be signed or not.
The key used to sign depends on the email-address found in the "From:"-Field of the mail.
If the from-email-addr. doesn't lead to a private key, GPGrelay can't sign and the mail is then sent unsigned.


C.17 : The key is associated with a Keyrule which tells GPGrelay to encrypt mails. But it doesn't...
Perhaps you wanted to send the mail to more than just one recipient and a keyrule says to don't encrypt to a certain recipient (e.g. <Default-Profile>).
You might go to the "Global Control" tab and look for a checkbox labeled "With multiple recipients prefer:". Activate "encrypted/signed" for higher security; this will also mean that one recipient won't be able to read the mail (except you also have a public key of him).


C.18 : What about BCC recipients?
KeyIDs of BCC-recipients will be removed from the encrypted OpenPGP-block. The recipient will be aware of the fact that there were a specific number of BCC-recipients, but he won't be able to tell "who"; though he will still know "how many bcc-recipients". If you think this is too much information leaked, don't use BCC with GPGrelay!

And also take note that BCC-recipients will not be considered when chosing keyrule-action.


C.19 : What are Aliases?
Aliases are used to associate additional mailaddresses with existing keys. Perhaps an example: A friend has a key which is valid for the mailaddress "joe@domain.com". But he also has another mailaddress which is not listed in the UserIDs of the key, "joe@joesworld.com".
If you want to send a mail to "joe@joesworld.com", GPGrelay normally does not know about the key of your friend and will send the mail unencrpyted (depending on the <Default-Profile> it might become signed though).

With an Alias, you may tell GPGrelay to handle mail for "joe@joesworld.com" with the key for "joe@domain.com".


C.20 : Why should I use Aliases rather than adding another UserID?
Aliases offer Wildcard-Matching, so maybe you have a whole domain and just want to have all your mail-accounts associated with one key.
Or maybe you have some short-living email-addresses which you don't want to create a UserID for and revoke them later on.

Or, and this should be the case most of the time, your correspondence-partner from which you only have the public key, has a email-address that is not part of a UserID of his key, so you need to assoc. another Email-Address to this key and you can't add another UserID because you don't have the private key.


C.21 : What happens if a key has the same email-addr. as an alias?
GPGrelay first looks at the key-email-addresses.
Then it checks all Non-Wildcard-Aliases, and if still no keyrule is found, it expands all Wildcard-Aliases.


C.22 : How do I create Aliases?
Go to the tab "Aliases". Mark the key you want to create an Alias for and click "Add".
Enter the new address in the upper textbox (according to the above example, this would be "joe@joesworld.com"). The dropdown list should now already show the key belonging to "joe@domain.com". If not, just choose the appropiate key. Click "OK".
Done.
The "percent"-sign may be used as a wildcard.


C.23 : What does "Learn from POP3" mean?
This option tells GPGrelay to associate unknown incoming mail-addresses ("From") automatically to a KeyID by creating a new alias automatically, if no Keyrule or Alias is already specified for the mail-address.
This works because if a signed mail arrives, this mail usually contains the KeyID of the sender.
Autolearning Aliases implies, that the "From" field of the mailheader contains a new Alias for the key of the person who has signed the mail.


C.24 : Is there something to be aware of when using "Learn from POP3"?
If eg. your correspondence-partner replies your inlined signed mail as a whole, GPGrelay will see the signature and will think the "From"-Email-Address is a new alias for that sender, although it's just a reply with your text!

So always check email-addr. and key before accepting an autolearned-alias!


C.25 : I don't have a keypair...
No problem. GPGrelay will contain an option to generate keys (Keyrules, Context-Menu -> Generate Key).
But you can also very easily use GPG itself to create a keypair, just open a command prompt, type "gpg --gen-key" and follow the instructions.


C.26 : Can GPGrelay be started as a NT-Service?
Michael Disabato <cmd@dellamente.com> made it! Just read his explainations!

It is possible, but you need to fiddle a bit. I used FireDaemon to assist with this, as SRVANY did not work.

You'll need to install GPGrelay and get it working the way you want it to. I set it up under the administrator's account, but you can use whichever you choose.

Once you install FireDaemon, follow the instructions to set up GPGrelay. You'll need to specify the working directory, and that should be the same as where you put GPGrelay. The box "console application" should not be checked. Click on "Install" and the service will start. You will notice that none of your relays or keyrules are correct. This is normal at this point. Go to the FireDaemon screen and stop the service.

Now go to Control Panel/Services and look for FireDaemon: GPGrelay (or whatever you called it). Edit the service and tell it to log on to the administrator's account or the one where you installed GPGrelay. Save the changes, and start the service from the FireDaemon panel. You should see the correct setup for GPGrelay at this point. It will now start when your system boots, without requiring a log in.

Remember, I'm using this to run a mailing list. If you are using GPGrelay for mail client encryption, you won't need this to be a service.

One more thing I noticed: Once you log on, if you want to bring up the GPGrelay console, you need to stop the service using FireDaemon and then bring up the program. Make sure you terminate the program and restart the service before you log off.


C.27 : Can GPGrelay be used together with Email-Client XXX?
Well, when talking about sending emails, it is definitely possible with every email-client that can handle SMTP.
On the receiving side there are some problems concerning MIME-Capabilities of your email-client as GPGrelay outputs it's messages into the mail as an extra part of the mail; this means, if your email-client is not capable of displaying multiple text-parts, GPGrelay will be a bit annoying.


C.28 : Can GPGrelay be used together with Virus-Check/Spam-Filter/...?
As long as these tools work like GPGrelay as kind of an email-proxy (relay), it's no problem.
E.g. just let GPGrelay relay POP3 from 127.0.0.1:32110 to 127.0.0.1:110 (or whereever that tool is listening to do it's job).


C.29 : After a crash (unfortunately this still happens) all changes I do to the settings are lost. Is this a bug?
Well, there is no UNDO, but maybe you still want to revert some changes you made.
GPGrelay uses a very simple strategy and offers some "poor man's" UNDO: By clicking on the GPGrelay-Icon at the top of the window, there are two menu-items shown: "Restore last settings" and "Save settings now".
Settings are automatically saved when exiting the program, obviously in case of a crash this is not done.


C.30 : After customizing GPGrelay, setting up relays, adding keyrules, profiles, etc., I'd like to know what's the easiest way to make a full backup of this setup?
GPGrelay always saves the settings for the current user, which can be found at: HKEY_CURRENT_USER\Software\.tSCc.\GPGrelay
You simply need to start regedit and save this registry-subtree as a .reg-file.
You can also use the command-prompt to export the settings, or, if you prefer, a batch-file:
C:\>regedit /e "filename.reg" "HKEY_CURRENT_USER\Software\.tSCc.\GPGrelay"
(Change "filename.reg" to your needs!)

Import it again with:
C:\>regedit "filename.reg"


C.31 : Is it possible to specify in each profile which key I want to use to sign or to sign+encrypt(to self)?
The profile will only tell if GPGrelay should sign mails for the recipient, but GPGrelay decides depending on the sender-email-address which key is used to sign.
Encrypt-To-Self isn't supported because you normally don't have a copy of the encrypted/signed mail, so there is normally no need for it.
GPGrelay supports only one signature-(sub)-key and one encrpytion-(sub)-key per UserID, and it's therefore impossible to use different sign-keys depending on the recipient.
Note, by the way, that key-strength determined by the contents of the message, rather than the identity of the recipient leaks some information to traffic analysis. The snoop may not be able to read a given message, but she does know that the message was "important" because it used the 4096-bit subkey.


C.32 : After GPGrelay verified the signature, the signature is lost, isn't GPGrelay broken then?
Well, talking about signatures, this is true.
Use GPGrelay as a privacy tool for easy encryption, and not as a notary with full trust; also keep in mind that signatures created from mostly automated environments don't neccessarily have the meaning you would suggest!


D :
It is the right of everyone to protect his personal communications from prying eyes. Encryption gives you the possibility to do so. GPGrelay provides a childlike interface for GPG. No excuses.


E : History
Perhaps May 2002
First version for reviewing purposes (Daniel Barié)

June 05. 2002
Implemented suggested changes (Daniel Barié)

June 17. 2002
Finally found a sack of time under my table. Translation done. (Daniel Barié)

July 11. 2002
Several HDD-Disasters (and no more Windows) later: Recovered and submitted to Andreas. (Daniel Barié)

Feb 18. 2003
Decided to remove version-numbers; listing the date should be sufficient for this FAQ (Andreas John)
Added some new Questions/Answers -- still looking for new maintainer of this FAQ (Andreas John)

May 3. 2003
A few more entries


   GPGrelay   
[ GPGrelay ] [ Download ] [ Localisation ] [ Setup ] [ Development ]




Contact
.tSCc.
  tscc.atari.org
 
  
dynaCore   andreas_john@tesla.inka.de
 
andreas john
schulzenstr. 36
76771 hördt



[ Home ] [ Tesselation ] [ Others ] [ Guestbook ]