File: gpg.texi

package info (click to toggle)
gnupg 1.4.18-6
  • links: PTS, VCS
  • area: main
  • in suites: jessie-kfreebsd
  • size: 32,044 kB
  • sloc: ansic: 126,932; sh: 7,535; asm: 4,610; makefile: 1,186; yacc: 291; perl: 196; pascal: 72; sed: 16
file content (3323 lines) | stat: -rw-r--r-- 128,203 bytes parent folder | download | duplicates (3)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
 @c Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
@c               2008, 2009, 2010 Free Software Foundation, Inc.
@c This is part of the GnuPG manual.
@c For copying conditions, see the file gnupg.texi.

@node Invoking GPG
@chapter Invoking GPG
@cindex GPG command options
@cindex command options
@cindex options, GPG command

@c Begin algorithm defaults

@set DEFSYMENCALGO CAST5

@c End algorithm defaults


@macro gpgname
gpg
@end macro
@manpage gpg.1
@ifset manverb
.B gpg
\- OpenPGP encryption and signing tool
@end ifset

@mansect synopsis
@ifset manverb
.B  gpg
.RB [ \-\-homedir
.IR dir ]
.RB [ \-\-options
.IR file ]
.RI [ options ]
.I command
.RI [ args ]
@end ifset

@mansect description
@command{@gpgname} is the OpenPGP only version of the GNU Privacy
Guard (GnuPG). It is a tool to provide digital encryption and signing
services using the OpenPGP standard. @command{@gpgname} features
complete key management and all bells and whistles you can expect from
a decent OpenPGP implementation.

This is the standalone version of @command{gpg}.  For desktop use you
should consider using @command{gpg2} from the GnuPG-2 package
@footnote{On some platforms gpg2 is installed under the name
@command{gpg}}.

@manpause

@xref{Option Index}, for an index to @command{@gpgname}'s commands and options.
@mancont

@menu
* GPG Commands::            List of all commands.
* GPG Options::             List of all options.
* GPG Configuration::       Configuration files.
* GPG Examples::            Some usage examples.

Developer information:
* Unattended Usage of GPG:: Using @command{gpg} from other programs.
@end menu

@c * GPG Protocol::        The protocol the server mode uses.


@c *******************************************
@c ***************            ****************
@c ***************  COMMANDS  ****************
@c ***************            ****************
@c *******************************************
@mansect commands
@node GPG Commands
@section Commands

Commands are not distinguished from options except for the fact that
only one command is allowed.

@command{@gpgname} may be run with no commands, in which case it will
perform a reasonable action depending on the type of file it is given
as input (an encrypted message is decrypted, a signature is verified,
a file containing keys is listed).

Please remember that option as well as command parsing stops as soon as
a non-option is encountered, you can explicitly stop parsing by
using the special option @option{--}.


@menu
* General GPG Commands::        Commands not specific to the functionality.
* Operational GPG Commands::    Commands to select the type of operation.
* OpenPGP Key Management::      How to manage your keys.
@end menu


@c *******************************************
@c **********  GENERAL COMMANDS  *************
@c *******************************************
@node General GPG Commands
@subsection Commands not specific to the function

@table @gnupgtabopt
@item --version
@opindex version
Print the program version and licensing information.  Note that you
cannot abbreviate this command.

@item --help
@itemx -h
@opindex help
Print a usage message summarizing the most useful command line options.
Note that you cannot abbreviate this command.

@item --warranty
@opindex warranty
Print warranty information.

@item --dump-options
@opindex dump-options
Print a list of all available options and commands.  Note that you cannot
abbreviate this command.
@end table


@c *******************************************
@c ********  OPERATIONAL COMMANDS  ***********
@c *******************************************
@node Operational GPG Commands
@subsection Commands to select the type of operation


@table @gnupgtabopt

@item --sign
@itemx -s
@opindex sign
Make a signature. This command may be combined with @option{--encrypt}
(for a signed and encrypted message), @option{--symmetric} (for a
signed and symmetrically encrypted message), or @option{--encrypt} and
@option{--symmetric} together (for a signed message that may be
decrypted via a secret key or a passphrase).  The key to be used for
signing is chosen by default or can be set with the
@option{--local-user} and @option{--default-key} options.

@item --clearsign
@opindex clearsign
Make a clear text signature.  The content in a clear text signature is
readable without any special software. OpenPGP software is only needed
to verify the signature.  Clear text signatures may modify end-of-line
whitespace for platform independence and are not intended to be
reversible.  The key to be used for signing is chosen by default or
can be set with the @option{--local-user} and @option{--default-key}
options.


@item --detach-sign
@itemx -b
@opindex detach-sign
Make a detached signature.

@item --encrypt
@itemx -e
@opindex encrypt
Encrypt data. This option may be combined with @option{--sign} (for a
signed and encrypted message), @option{--symmetric} (for a message that
may be decrypted via a secret key or a passphrase), or @option{--sign}
and @option{--symmetric} together (for a signed message that may be
decrypted via a secret key or a passphrase).

@item --symmetric
@itemx -c
@opindex symmetric
Encrypt with a symmetric cipher using a passphrase. The default
symmetric cipher used is @value{DEFSYMENCALGO}, but may be chosen with the
@option{--cipher-algo} option. This option may be combined with
@option{--sign} (for a signed and symmetrically encrypted message),
@option{--encrypt} (for a message that may be decrypted via a secret key
or a passphrase), or @option{--sign} and @option{--encrypt} together
(for a signed message that may be decrypted via a secret key or a
passphrase).

@item --store
@opindex store
Store only (make a simple RFC1991 literal data packet).

@item --decrypt
@itemx -d
@opindex decrypt
Decrypt the file given on the command line (or STDIN if no file
is specified) and write it to STDOUT (or the file specified with
@option{--output}). If the decrypted file is signed, the signature is also
verified. This command differs from the default operation, as it never
writes to the filename which is included in the file and it rejects
files which don't begin with an encrypted message.

@item --verify
@opindex verify
Assume that the first argument is a signed file and verify it without
generating any output.  With no arguments, the signature packet is
read from STDIN.  If only a one argument is given, it is expected to
be a complete signature.

With more than 1 argument, the first should be a detached signature
and the remaining files ake up the the signed data. To read the signed
data from STDIN, use @samp{-} as the second filename.  For security
reasons a detached signature cannot read the signed material from
STDIN without denoting it in the above way.

Note: If the option @option{--batch} is not used, @command{gpg}
may assume that a single argument is a file with a detached signature
and it will try to find a matching data file by stripping certain
suffixes.  Using this historical feature to verify a detached
signature is strongly discouraged; always specify the data file too.

Note: When verifying a cleartext signature, @command{gpg} verifies
only what makes up the cleartext signed data and not any extra data
outside of the cleartext signature or header lines following directly
the dash marker line.  The option @code{--output} may be used to write
out the actual signed data; but there are other pitfalls with this
format as well.  It is suggested to avoid cleartext signatures in
favor of detached signatures.


@item --multifile
@opindex multifile
This modifies certain other commands to accept multiple files for
processing on the command line or read from STDIN with each filename on
a separate line. This allows for many files to be processed at
once. @option{--multifile} may currently be used along with
@option{--verify}, @option{--encrypt}, and @option{--decrypt}. Note that
@option{--multifile --verify} may not be used with detached signatures.

@item --verify-files
@opindex verify-files
Identical to @option{--multifile --verify}.

@item --encrypt-files
@opindex encrypt-files
Identical to @option{--multifile --encrypt}.

@item --decrypt-files
@opindex decrypt-files
Identical to @option{--multifile --decrypt}.

@item --list-keys
@itemx -k
@itemx --list-public-keys
@opindex list-keys
List all keys from the public keyrings, or just the keys given on the
command line.

@option{-k} is slightly different from @option{--list-keys} in that it
allows only for one argument and takes the second argument as the
keyring to search.  This is for command line compatibility with PGP 2
and has been removed in @command{gpg2}.

Avoid using the output of this command in scripts or other programs as
it is likely to change as GnuPG changes. See @option{--with-colons} for a
machine-parseable key listing command that is appropriate for use in
scripts and other programs.

@item --list-secret-keys
@itemx -K
@opindex list-secret-keys
List all keys from the secret keyrings, or just the ones given on the
command line. A @code{#} after the letters @code{sec} means that the
secret key is not usable (for example, if it was created via
@option{--export-secret-subkeys}).

@item --list-sigs
@opindex list-sigs
Same as @option{--list-keys}, but the signatures are listed too.

For each signature listed, there are several flags in between the "sig"
tag and keyid. These flags give additional information about each
signature. From left to right, they are the numbers 1-3 for certificate
check level (see @option{--ask-cert-level}), "L" for a local or
non-exportable signature (see @option{--lsign-key}), "R" for a
nonRevocable signature (see the @option{--edit-key} command "nrsign"),
"P" for a signature that contains a policy URL (see
@option{--cert-policy-url}), "N" for a signature that contains a
notation (see @option{--cert-notation}), "X" for an eXpired signature
(see @option{--ask-cert-expire}), and the numbers 1-9 or "T" for 10 and
above to indicate trust signature levels (see the @option{--edit-key}
command "tsign").

@item --check-sigs
@opindex check-sigs
Same as @option{--list-sigs}, but the signatures are verified.  Note
that for performance reasons the revocation status of a signing key is
not shown.

The status of the verification is indicated by a flag directly following
the "sig" tag (and thus before the flags described above for
@option{--list-sigs}).  A "!" indicates that the signature has been
successfully verified, a "-" denotes a bad signature and a "%" is used
if an error occurred while checking the signature (e.g. a non supported
algorithm).


@item --fingerprint
@opindex fingerprint
List all keys (or the specified ones) along with their
fingerprints. This is the same output as @option{--list-keys} but with
the additional output of a line with the fingerprint. May also be
combined with @option{--list-sigs} or @option{--check-sigs}.  If this
command is given twice, the fingerprints of all secondary keys are
listed too.

@item --list-packets
@opindex list-packets
List only the sequence of packets. This is mainly
useful for debugging.


@item --card-edit
@opindex card-edit
Present a menu to work with a smartcard. The subcommand "help" provides
an overview on available commands. For a detailed description, please
see the Card HOWTO at
http://www.gnupg.org/documentation/howtos.html#GnuPG-cardHOWTO .

@item --card-status
@opindex card-status
Show the content of the smart card.

@item --change-pin
@opindex change-pin
Present a menu to allow changing the PIN of a smartcard. This
functionality is also available as the subcommand "passwd" with the
@option{--card-edit} command.

@item --delete-key @code{name}
@opindex delete-key
Remove key from the public keyring. In batch mode either @option{--yes} is
required or the key must be specified by fingerprint. This is a
safeguard against accidental deletion of multiple keys.

@item --delete-secret-key @code{name}
@opindex delete-secret-key
Remove key from the secret keyring. In batch mode the key
must be specified by fingerprint.

@item --delete-secret-and-public-key @code{name}
@opindex delete-secret-and-public-key
Same as @option{--delete-key}, but if a secret key exists, it will be
removed first. In batch mode the key must be specified by fingerprint.

@item --export
@opindex export
Either export all keys from all keyrings (default keyrings and those
registered via option @option{--keyring}), or if at least one name is given,
those of the given name. The exported keys are written to STDOUT or to the
file given with option @option{--output}.  Use together with
@option{--armor} to mail those keys.

@item --send-keys @code{key IDs}
@opindex send-keys
Similar to @option{--export} but sends the keys to a keyserver.
Fingerprints may be used instead of key IDs. Option @option{--keyserver}
must be used to give the name of this keyserver. Don't send your
complete keyring to a keyserver --- select only those keys which are new
or changed by you.  If no key IDs are given, @command{gpg} does nothing.

@item --export-secret-keys
@itemx --export-secret-subkeys
@opindex export-secret-keys
@opindex export-secret-subkeys
Same as @option{--export}, but exports the secret keys instead.  The
exported keys are written to STDOUT or to the file given with option
@option{--output}.  This command is often used along with the option
@option{--armor} to allow easy printing of the key for paper backup;
however the external tool @command{paperkey} does a better job for
creating backups on paper.  Note that exporting a secret key can be a
security risk if the exported keys are send over an insecure channel.

The second form of the command has the special property to render the
secret part of the primary key useless; this is a GNU extension to
OpenPGP and other implementations can not be expected to successfully
import such a key.  Its intended use is to generated a full key with
an additional signing subkey on a dedicated machine and then using
this command to export the key without the primary key to the main
machine.

See the option @option{--simple-sk-checksum} if you want to import an
exported secret key into ancient OpenPGP implementations.

@item --import
@itemx --fast-import
@opindex import
Import/merge keys. This adds the given keys to the
keyring. The fast version is currently just a synonym.

There are a few other options which control how this command works.
Most notable here is the @option{--import-options merge-only} option
which does not insert new keys but does only the merging of new
signatures, user-IDs and subkeys.

@item --recv-keys @code{key IDs}
@opindex recv-keys
Import the keys with the given key IDs from a keyserver. Option
@option{--keyserver} must be used to give the name of this keyserver.

@item --refresh-keys
@opindex refresh-keys
Request updates from a keyserver for keys that already exist on the
local keyring. This is useful for updating a key with the latest
signatures, user IDs, etc. Calling this with no arguments will refresh
the entire keyring. Option @option{--keyserver} must be used to give the
name of the keyserver for all keys that do not have preferred keyservers
set (see @option{--keyserver-options honor-keyserver-url}).

@item --search-keys @code{names}
@opindex search-keys
Search the keyserver for the given names. Multiple names given here will
be joined together to create the search string for the keyserver.
Option @option{--keyserver} must be used to give the name of this
keyserver.  Keyservers that support different search methods allow using
the syntax specified in "How to specify a user ID" below. Note that
different keyserver types support different search methods. Currently
only LDAP supports them all.

@item --fetch-keys @code{URIs}
@opindex fetch-keys
Retrieve keys located at the specified URIs. Note that different
installations of GnuPG may support different protocols (HTTP, FTP,
LDAP, etc.)

@item --update-trustdb
@opindex update-trustdb
Do trust database maintenance. This command iterates over all keys and
builds the Web of Trust. This is an interactive command because it may
have to ask for the "ownertrust" values for keys. The user has to give
an estimation of how far she trusts the owner of the displayed key to
correctly certify (sign) other keys. GnuPG only asks for the ownertrust
value if it has not yet been assigned to a key. Using the
@option{--edit-key} menu, the assigned value can be changed at any time.

@item --check-trustdb
@opindex check-trustdb
Do trust database maintenance without user interaction. From time to
time the trust database must be updated so that expired keys or
signatures and the resulting changes in the Web of Trust can be
tracked. Normally, GnuPG will calculate when this is required and do it
automatically unless @option{--no-auto-check-trustdb} is set. This
command can be used to force a trust database check at any time. The
processing is identical to that of @option{--update-trustdb} but it
skips keys with a not yet defined "ownertrust".

For use with cron jobs, this command can be used together with
@option{--batch} in which case the trust database check is done only if
a check is needed. To force a run even in batch mode add the option
@option{--yes}.

@anchor{option --export-ownertrust}
@item --export-ownertrust
@opindex export-ownertrust
Send the ownertrust values to STDOUT. This is useful for backup purposes
as these values are the only ones which can't be re-created from a
corrupted trustdb.  Example:
@c man:.RS
@example
  @gpgname{} --export-ownertrust > otrust.txt
@end example
@c man:.RE


@item --import-ownertrust
@opindex import-ownertrust
Update the trustdb with the ownertrust values stored in @code{files} (or
STDIN if not given); existing values will be overwritten.  In case of a
severely damaged trustdb and if you have a recent backup of the
ownertrust values (e.g. in the file @file{otrust.txt}, you may re-create
the trustdb using these commands:
@c man:.RS
@example
  cd ~/.gnupg
  rm trustdb.gpg
  @gpgname{} --import-ownertrust < otrust.txt
@end example
@c man:.RE


@item --rebuild-keydb-caches
@opindex rebuild-keydb-caches
When updating from version 1.0.6 to 1.0.7 this command should be used
to create signature caches in the keyring. It might be handy in other
situations too.

@item --print-md @code{algo}
@itemx --print-mds
@opindex print-md
Print message digest of algorithm ALGO for all given files or STDIN.
With the second form (or a deprecated "*" as algo) digests for all
available algorithms are printed.

@item --gen-random @code{0|1|2} @code{count}
@opindex gen-random
Emit @var{count} random bytes of the given quality level 0, 1 or 2. If
@var{count} is not given or zero, an endless sequence of random bytes
will be emitted.  If used with @option{--armor} the output will be
base64 encoded.  PLEASE, don't use this command unless you know what
you are doing; it may remove precious entropy from the system!

@item --gen-prime @code{mode}  @code{bits}
@opindex gen-prime
Use the source, Luke :-). The output format is still subject to change.


@item --enarmor
@item --dearmor
@opindex enarmor
@opindex dearmor
Pack or unpack an arbitrary input into/from an OpenPGP ASCII armor.
This is a GnuPG extension to OpenPGP and in general not very useful.

@end table


@c *******************************************
@c *******  KEY MANGEMENT COMMANDS  **********
@c *******************************************
@node OpenPGP Key Management
@subsection How to manage your keys

This section explains the main commands for key management

@table @gnupgtabopt

@item --gen-key
@opindex gen-key
Generate a new key pair using teh current default parameters.  This is
the standard command to create a new key.

There is also a feature which allows you to create keys in batch
mode. See the the manual section ``Unattended key generation'' on how
to use this.

@item --gen-revoke @code{name}
@opindex gen-revoke
Generate a revocation certificate for the complete key. To revoke
a subkey or a signature, use the @option{--edit} command.

@item --desig-revoke @code{name}
@opindex desig-revoke
Generate a designated revocation certificate for a key. This allows a
user (with the permission of the keyholder) to revoke someone else's
key.


@item --edit-key
@opindex edit-key
Present a menu which enables you to do most of the key management
related tasks.  It expects the specification of a key on the command
line.

@c ******** Begin Edit-key Options **********
@table @asis

  @item uid @code{n}
  @opindex keyedit:uid
  Toggle selection of user ID or photographic user ID with index @code{n}.
  Use @code{*} to select all and @code{0} to deselect all.

  @item key @code{n}
  @opindex keyedit:key
  Toggle selection of subkey with index @code{n}.
  Use @code{*} to select all and @code{0} to deselect all.

  @item sign
  @opindex keyedit:sign
  Make a signature on key of user @code{name} If the key is not yet
  signed by the default user (or the users given with -u), the program
  displays the information of the key again, together with its
  fingerprint and asks whether it should be signed. This question is
  repeated for all users specified with
  -u.

  @item lsign
  @opindex keyedit:lsign
  Same as "sign" but the signature is marked as non-exportable and will
  therefore never be used by others. This may be used to make keys
  valid only in the local environment.

  @item nrsign
  @opindex keyedit:nrsign
  Same as "sign" but the signature is marked as non-revocable and can
  therefore never be revoked.

  @item tsign
  @opindex keyedit:tsign
  Make a trust signature. This is a signature that combines the notions
  of certification (like a regular signature), and trust (like the
  "trust" command). It is generally only useful in distinct communities
  or groups.
@end table

@c man:.RS
Note that "l" (for local / non-exportable), "nr" (for non-revocable,
and "t" (for trust) may be freely mixed and prefixed to "sign" to
create a signature of any type desired.
@c man:.RE

@table @asis

  @item delsig
  @opindex keyedit:delsig
  Delete a signature. Note that it is not possible to retract a signature,
  once it has been send to the public (i.e. to a keyserver).  In that case
  you better use @code{revsig}.

  @item revsig
  @opindex keyedit:revsig
  Revoke a signature. For every signature which has been generated by
  one of the secret keys, GnuPG asks whether a revocation certificate
  should be generated.

  @item check
  @opindex keyedit:check
  Check the signatures on all selected user IDs.

  @item adduid
  @opindex keyedit:adduid
  Create an additional user ID.

  @item addphoto
  @opindex keyedit:addphoto
  Create a photographic user ID. This will prompt for a JPEG file that
  will be embedded into the user ID. Note that a very large JPEG will make
  for a very large key. Also note that some programs will display your
  JPEG unchanged (GnuPG), and some programs will scale it to fit in a
  dialog box (PGP).

  @item showphoto
  @opindex keyedit:showphoto
  Display the selected photographic user ID.

  @item deluid
  @opindex keyedit:deluid
  Delete a user ID or photographic user ID.  Note that it is not
  possible to retract a user id, once it has been send to the public
  (i.e. to a keyserver).  In that case you better use @code{revuid}.

  @item revuid
  @opindex keyedit:revuid
  Revoke a user ID or photographic user ID.

  @item primary
  @opindex keyedit:primary
  Flag the current user id as the primary one, removes the primary user
  id flag from all other user ids and sets the timestamp of all affected
  self-signatures one second ahead. Note that setting a photo user ID
  as primary makes it primary over other photo user IDs, and setting a
  regular user ID as primary makes it primary over other regular user
  IDs.

  @item keyserver
  @opindex keyedit:keyserver
  Set a preferred keyserver for the specified user ID(s). This allows
  other users to know where you prefer they get your key from. See
  @option{--keyserver-options honor-keyserver-url} for more on how this
  works.  Setting a value of "none" removes an existing preferred
  keyserver.

  @item notation
  @opindex keyedit:notation
  Set a name=value notation for the specified user ID(s). See
  @option{--cert-notation} for more on how this works. Setting a value of
  "none" removes all notations, setting a notation prefixed with a minus
  sign (-) removes that notation, and setting a notation name (without the
  =value) prefixed with a minus sign removes all notations with that name.

  @item pref
  @opindex keyedit:pref
  List preferences from the selected user ID. This shows the actual
  preferences, without including any implied preferences.

  @item showpref
  @opindex keyedit:showpref
  More verbose preferences listing for the selected user ID. This shows
  the preferences in effect by including the implied preferences of 3DES
  (cipher), SHA-1 (digest), and Uncompressed (compression) if they are
  not already included in the preference list. In addition, the
  preferred keyserver and signature notations (if any) are shown.

  @item setpref @code{string}
  @opindex keyedit:setpref
  Set the list of user ID preferences to @code{string} for all (or just
  the selected) user IDs. Calling setpref with no arguments sets the
  preference list to the default (either built-in or set via
  @option{--default-preference-list}), and calling setpref with "none"
  as the argument sets an empty preference list. Use @command{@gpgname
  --version} to get a list of available algorithms. Note that while you
  can change the preferences on an attribute user ID (aka "photo ID"),
  GnuPG does not select keys via attribute user IDs so these preferences
  will not be used by GnuPG.

  When setting preferences, you should list the algorithms in the order
  which you'd like to see them used by someone else when encrypting a
  message to your key.  If you don't include 3DES, it will be
  automatically added at the end.  Note that there are many factors that
  go into choosing an algorithm (for example, your key may not be the
  only recipient), and so the remote OpenPGP application being used to
  send to you may or may not follow your exact chosen order for a given
  message.  It will, however, only choose an algorithm that is present
  on the preference list of every recipient key.  See also the
  INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS section below.

  @item addkey
  @opindex keyedit:addkey
  Add a subkey to this key.

  @item addcardkey
  @opindex keyedit:addcardkey
  Generate a subkey on a card and add it to this key.

  @item keytocard
  @opindex keyedit:keytocard
  Transfer the selected secret subkey (or the primary key if no subkey
  has been selected) to a smartcard. The secret key in the keyring will
  be replaced by a stub if the key could be stored successfully on the
  card and you use the save command later. Only certain key types may be
  transferred to the card. A sub menu allows you to select on what card
  to store the key. Note that it is not possible to get that key back
  from the card - if the card gets broken your secret key will be lost
  unless you have a backup somewhere.

  @item bkuptocard @code{file}
  @opindex keyedit:bkuptocard
  Restore the given file to a card. This command may be used to restore a
  backup key (as generated during card initialization) to a new card. In
  almost all cases this will be the encryption key. You should use this
  command only with the corresponding public key and make sure that the
  file given as argument is indeed the backup to restore. You should then
  select 2 to restore as encryption key.  You will first be asked to enter
  the passphrase of the backup key and then for the Admin PIN of the card.

  @item delkey
  @opindex keyedit:delkey
  Remove a subkey (secondart key). Note that it is not possible to retract
  a subkey, once it has been send to the public (i.e. to a keyserver).  In
  that case you better use @code{revkey}.

  @item revkey
  @opindex keyedit:revkey
  Revoke a subkey.

  @item expire
  @opindex keyedit:expire
  Change the key or subkey expiration time. If a subkey is selected, the
  expiration time of this subkey will be changed. With no selection, the
  key expiration of the primary key is changed.

  @item trust
  @opindex keyedit:trust
  Change the owner trust value for the key. This updates the trust-db
  immediately and no save is required.

  @item disable
  @itemx enable
  @opindex keyedit:disable
  @opindex keyedit:enable
  Disable or enable an entire key. A disabled key can not normally be
  used for encryption.

  @item addrevoker
  @opindex keyedit:addrevoker
  Add a designated revoker to the key. This takes one optional argument:
  "sensitive". If a designated revoker is marked as sensitive, it will
  not be exported by default (see export-options).

  @item passwd
  @opindex keyedit:passwd
  Change the passphrase of the secret key.

  @item toggle
  @opindex keyedit:toggle
  Toggle between public and secret key listing.

  @item clean
  @opindex keyedit:clean
  Compact (by removing all signatures except the selfsig) any user ID
  that is no longer usable (e.g. revoked, or expired). Then, remove any
  signatures that are not usable by the trust calculations.
  Specifically, this removes any signature that does not validate, any
  signature that is superseded by a later signature, revoked signatures,
  and signatures issued by keys that are not present on the keyring.

  @item minimize
  @opindex keyedit:minimize
  Make the key as small as possible. This removes all signatures from
  each user ID except for the most recent self-signature.

  @item cross-certify
  @opindex keyedit:cross-certify
  Add cross-certification signatures to signing subkeys that may not
  currently have them. Cross-certification signatures protect against a
  subtle attack against signing subkeys. See
  @option{--require-cross-certification}.  All new keys generated have
  this signature by default, so this option is only useful to bring
  older keys up to date.

  @item save
  @opindex keyedit:save
  Save all changes to the key rings and quit.

  @item quit
  @opindex keyedit:quit
  Quit the program without updating the
  key rings.
@end table

@c man:.RS
The listing shows you the key with its secondary keys and all user
ids.  The primary user id is indicated by a dot, and selected keys or
user ids are indicated by an asterisk.  The trust
value is displayed with the primary key: the first is the assigned owner
trust and the second is the calculated trust value. Letters are used for
the values:
@c man:.RE

@table @asis

  @item -
  No ownertrust assigned / not yet calculated.

  @item e
  Trust
  calculation has failed; probably due to an expired key.

  @item q
  Not enough information for calculation.

  @item n
  Never trust this key.

  @item m
  Marginally trusted.

  @item f
  Fully trusted.

  @item u
  Ultimately trusted.

@end table
@c ******** End Edit-key Options **********

@item --sign-key @code{name}
@opindex sign-key
Signs a public key with your secret key. This is a shortcut version of
the subcommand "sign" from @option{--edit}.

@item --lsign-key @code{name}
@opindex lsign-key
Signs a public key with your secret key but marks it as
non-exportable. This is a shortcut version of the subcommand "lsign"
from @option{--edit-key}.

@end table


@c *******************************************
@c ***************            ****************
@c ***************  OPTIONS   ****************
@c ***************            ****************
@c *******************************************
@mansect options
@node GPG Options
@section Option Summary

@command{@gpgname} features a bunch of options to control the exact
behaviour and to change the default configuration.

@menu
* GPG Configuration Options::   How to change the configuration.
* GPG Key related Options::     Key related options.
* GPG Input and Output::        Input and Output.
* OpenPGP Options::             OpenPGP protocol specific options.
* Compliance Options::          Compliance options.
* GPG Esoteric Options::        Doing things one usually don't want to do.
* Deprecated Options::          Deprecated options.
@end menu

Long options can be put in an options file (default
"~/.gnupg/gpg.conf"). Short option names will not work - for example,
"armor" is a valid option for the options file, while "a" is not. Do not
write the 2 dashes, but simply the name of the option and any required
arguments. Lines with a hash ('#') as the first non-white-space
character are ignored. Commands may be put in this file too, but that is
not generally useful as the command will execute automatically with
every execution of gpg.

Please remember that option parsing stops as soon as a non-option is
encountered, you can explicitly stop parsing by using the special option
@option{--}.

@c *******************************************
@c ********  CONFIGURATION OPTIONS  **********
@c *******************************************
@node GPG Configuration Options
@subsection How to change the configuration

These options are used to change the configuration and are usually found
in the option file.

@table @gnupgtabopt

@item --default-key @var{name}
@opindex default-key
Use @var{name} as the default key to sign with. If this option is not
used, the default key is the first key found in the secret keyring.
Note that @option{-u} or @option{--local-user} overrides this option.

@item --default-recipient @var{name}
@opindex default-recipient
Use @var{name} as default recipient if option @option{--recipient} is
not used and don't ask if this is a valid one. @var{name} must be
non-empty.

@item --default-recipient-self
@opindex default-recipient-self
Use the default key as default recipient if option @option{--recipient} is not
used and don't ask if this is a valid one. The default key is the first
one from the secret keyring or the one set with @option{--default-key}.

@item --no-default-recipient
@opindex no-default-recipient
Reset @option{--default-recipient} and @option{--default-recipient-self}.

@item -v, --verbose
@opindex verbose
Give more information during processing. If used
twice, the input data is listed in detail.

@item --no-verbose
@opindex no-verbose
Reset verbose level to 0.

@item -q, --quiet
@opindex quiet
Try to be as quiet as possible.

@item --batch
@itemx --no-batch
@opindex batch
@opindex no-batch
Use batch mode.  Never ask, do not allow interactive commands.
@option{--no-batch} disables this option.  Note that even with a
filename given on the command line, gpg might still need to read from
STDIN (in particular if gpg figures that the input is a
detached signature and no data file has been specified).  Thus if you
do not want to feed data via STDIN, you should connect STDIN to
@file{/dev/null}.

@item --no-tty
@opindex no-tty
Make sure that the TTY (terminal) is never used for any output.
This option is needed in some cases because GnuPG sometimes prints
warnings to the TTY even if @option{--batch} is used.

@item --yes
@opindex yes
Assume "yes" on most questions.

@item --no
@opindex no
Assume "no" on most questions.


@item --list-options @code{parameters}
@opindex list-options
This is a space or comma delimited string that gives options used when
listing keys and signatures (that is, @option{--list-keys},
@option{--list-sigs}, @option{--list-public-keys},
@option{--list-secret-keys}, and the @option{--edit-key} functions).
Options can be prepended with a @option{no-} (after the two dashes) to
give the opposite meaning.  The options are:

@table @asis

  @item show-photos
  @opindex list-options:show-photos
  Causes @option{--list-keys}, @option{--list-sigs},
  @option{--list-public-keys}, and @option{--list-secret-keys} to
  display any photo IDs attached to the key.  Defaults to no. See also
  @option{--photo-viewer}.  Does not work with @option{--with-colons}:
  see @option{--attribute-fd} for the appropriate way to get photo data
  for scripts and other frontends.

  @item show-usage
  @opindex list-options:show-usage
  Show usage information for keys and subkeys in the standard key
  listing.  This is a list of letters indicating the allowed usage for a
  key (@code{E}=encryption, @code{S}=signing, @code{C}=certification,
  @code{A}=authentication).  Defaults to no.

  @item show-policy-urls
  @opindex list-options:show-policy-urls
  Show policy URLs in the @option{--list-sigs} or @option{--check-sigs}
  listings.  Defaults to no.

  @item show-notations
  @itemx show-std-notations
  @itemx show-user-notations
  @opindex list-options:show-notations
  @opindex list-options:show-std-notations
  @opindex list-options:show-user-notations
  Show all, IETF standard, or user-defined signature notations in the
  @option{--list-sigs} or @option{--check-sigs} listings. Defaults to no.

  @item show-keyserver-urls
  @opindex list-options:show-keyserver-urls
  Show any preferred keyserver URL in the @option{--list-sigs} or
  @option{--check-sigs} listings. Defaults to no.

  @item show-uid-validity
  @opindex list-options:show-uid-validity
  Display the calculated validity of user IDs during key listings.
  Defaults to no.

  @item show-unusable-uids
  @opindex list-options:show-unusable-uids
  Show revoked and expired user IDs in key listings. Defaults to no.

  @item show-unusable-subkeys
  @opindex list-options:show-unusable-subkeys
  Show revoked and expired subkeys in key listings. Defaults to no.

  @item show-keyring
  @opindex list-options:show-keyring
  Display the keyring name at the head of key listings to show which
  keyring a given key resides on. Defaults to no.

  @item show-sig-expire
  @opindex list-options:show-sig-expire
  Show signature expiration dates (if any) during @option{--list-sigs} or
  @option{--check-sigs} listings. Defaults to no.

  @item show-sig-subpackets
  @opindex list-options:show-sig-subpackets
  Include signature subpackets in the key listing. This option can take an
  optional argument list of the subpackets to list. If no argument is
  passed, list all subpackets. Defaults to no. This option is only
  meaningful when using @option{--with-colons} along with
  @option{--list-sigs} or @option{--check-sigs}.

@end table

@item --verify-options @code{parameters}
@opindex verify-options
This is a space or comma delimited string that gives options used when
verifying signatures. Options can be prepended with a `no-' to give
the opposite meaning. The options are:

@table @asis

  @item show-photos
  @opindex verify-options:show-photos
  Display any photo IDs present on the key that issued the signature.
  Defaults to no. See also @option{--photo-viewer}.

  @item show-policy-urls
  @opindex verify-options:show-policy-urls
  Show policy URLs in the signature being verified. Defaults to no.

  @item show-notations
  @itemx show-std-notations
  @itemx show-user-notations
  @opindex verify-options:show-notations
  @opindex verify-options:show-std-notations
  @opindex verify-options:show-user-notations
  Show all, IETF standard, or user-defined signature notations in the
  signature being verified. Defaults to IETF standard.

  @item show-keyserver-urls
  @opindex verify-options:show-keyserver-urls
  Show any preferred keyserver URL in the signature being verified.
  Defaults to no.

  @item show-uid-validity
  @opindex verify-options:show-uid-validity
  Display the calculated validity of the user IDs on the key that issued
  the signature. Defaults to no.

  @item show-unusable-uids
  @opindex verify-options:show-unusable-uids
  Show revoked and expired user IDs during signature verification.
  Defaults to no.

  @item show-primary-uid-only
  @opindex verify-options:show-primary-uid-only
  Show only the primary user ID during signature verification.  That is
  all the AKA lines as well as photo Ids are not shown with the signature
  verification status.

  @item pka-lookups
  @opindex verify-options:pka-lookups
  Enable PKA lookups to verify sender addresses. Note that PKA is based
  on DNS, and so enabling this option may disclose information on when
  and what signatures are verified or to whom data is encrypted. This
  is similar to the "web bug" described for the auto-key-retrieve
  feature.

  @item pka-trust-increase
  @opindex verify-options:pka-trust-increase
  Raise the trust in a signature to full if the signature passes PKA
  validation. This option is only meaningful if pka-lookups is set.
@end table

@item --enable-large-rsa
@itemx --disable-large-rsa
@opindex enable-large-rsa
@opindex disable-large-rsa
With --gen-key and --batch, enable the creation of larger RSA secret
keys than is generally recommended (up to 8192 bits).  These large
keys are more expensive to use, and their signatures and
certifications are also larger.

@item --enable-dsa2
@itemx --disable-dsa2
@opindex enable-dsa2
@opindex disable-dsa2
Enable hash truncation for all DSA keys even for old DSA Keys up to
1024 bit.  This is also the default with @option{--openpgp}.  Note
that older versions of GnuPG also required this flag to allow the
generation of DSA larger than 1024 bit.

@item --photo-viewer @code{string}
@opindex photo-viewer
This is the command line that should be run to view a photo ID. "%i"
will be expanded to a filename containing the photo. "%I" does the
same, except the file will not be deleted once the viewer exits.
Other flags are "%k" for the key ID, "%K" for the long key ID, "%f"
for the key fingerprint, "%t" for the extension of the image type
(e.g. "jpg"), "%T" for the MIME type of the image (e.g. "image/jpeg"),
"%v" for the single-character calculated validity of the image being
viewed (e.g. "f"), "%V" for the calculated validity as a string (e.g.
"full"), "%U" for a base32 encoded hash of the user ID,
and "%%" for an actual percent sign. If neither %i or %I are present,
then the photo will be supplied to the viewer on standard input.

The default viewer is "xloadimage -fork -quiet -title 'KeyID 0x%k'
STDIN". Note that if your image viewer program is not secure, then
executing it from GnuPG does not make it secure.

@item --exec-path @code{string}
@opindex exec-path
Sets a list of directories to search for photo viewers and keyserver
helpers. If not provided, keyserver helpers use the compiled-in
default directory, and photo viewers use the $PATH environment
variable.
Note, that on W32 system this value is ignored when searching for
keyserver helpers.

@item --keyring @code{file}
@opindex keyring
Add @code{file} to the current list of keyrings. If @code{file} begins
with a tilde and a slash, these are replaced by the $HOME directory. If
the filename does not contain a slash, it is assumed to be in the GnuPG
home directory ("~/.gnupg" if @option{--homedir} or $GNUPGHOME is not
used).

Note that this adds a keyring to the current list. If the intent is to
use the specified keyring alone, use @option{--keyring} along with
@option{--no-default-keyring}.

@item --secret-keyring @code{file}
@opindex secret-keyring
Same as @option{--keyring} but for the secret keyrings.

@item --primary-keyring @code{file}
@opindex primary-keyring
Designate @code{file} as the primary public keyring. This means that
newly imported keys (via @option{--import} or keyserver
@option{--recv-from}) will go to this keyring.

@item --trustdb-name @code{file}
@opindex trustdb-name
Use @code{file} instead of the default trustdb. If @code{file} begins
with a tilde and a slash, these are replaced by the $HOME directory. If
the filename does not contain a slash, it is assumed to be in the GnuPG
home directory (@file{~/.gnupg} if @option{--homedir} or $GNUPGHOME is
not used).

@anchor{option --homedir}
@include opt-homedir.texi


@item --pcsc-driver @code{file}
@opindex pcsc-driver
Use @code{file} to access the smartcard reader. The current default is
`libpcsclite.so.1' for GLIBC based systems,
`/System/Library/Frameworks/PCSC.framework/PCSC' for MAC OS X,
`winscard.dll' for Windows and `libpcsclite.so' for other systems.

@item --disable-ccid
@opindex disable-ccid
Disable the integrated support for CCID compliant readers. This
allows to fall back to one of the other drivers even if the internal
CCID driver can handle the reader. Note, that CCID support is only
available if libusb was available at build time.

@item --reader-port @code{number_or_string}
@opindex reader-port
This option may be used to specify the port of the card terminal. A
value of 0 refers to the first serial device; add 32768 to access USB
devices. The default is 32768 (first USB device). PC/SC or CCID
readers might need a string here; run the program in verbose mode to get
a list of available readers. The default is then the first reader
found.

@item --display-charset @code{name}
@opindex display-charset
Set the name of the native character set. This is used to convert
some informational strings like user IDs to the proper UTF-8 encoding.
Note that this has nothing to do with the character set of data to be
encrypted or signed; GnuPG does not recode user-supplied data. If
this option is not used, the default character set is determined from
the current locale. A verbosity level of 3 shows the chosen set.
Valid values for @code{name} are:

@table @asis

  @item iso-8859-1
  @opindex display-charset:iso-8859-1
  This is the Latin 1 set.

  @item iso-8859-2
  @opindex display-charset:iso-8859-2
  The Latin 2 set.

  @item iso-8859-15
  @opindex display-charset:iso-8859-15
  This is currently an alias for
  the Latin 1 set.

  @item koi8-r
  @opindex display-charset:koi8-r
  The usual Russian set (rfc1489).

  @item utf-8
  @opindex display-charset:utf-8
  Bypass all translations and assume
  that the OS uses native UTF-8 encoding.
@end table

@item --utf8-strings
@itemx --no-utf8-strings
@opindex utf8-strings
Assume that command line arguments are given as UTF8 strings. The
default (@option{--no-utf8-strings}) is to assume that arguments are
encoded in the character set as specified by
@option{--display-charset}. These options affect all following
arguments. Both options may be used multiple times.

@anchor{gpg-option --options}
@item --options @code{file}
@opindex options
Read options from @code{file} and do not try to read them from the
default options file in the homedir (see @option{--homedir}). This
option is ignored if used in an options file.

@item --no-options
@opindex no-options
Shortcut for @option{--options /dev/null}. This option is detected
before an attempt to open an option file.  Using this option will also
prevent the creation of a @file{~/.gnupg} homedir.

@item -z @code{n}
@itemx --compress-level @code{n}
@itemx --bzip2-compress-level @code{n}
@opindex compress-level
@opindex bzip2-compress-level
Set compression level to @code{n} for the ZIP and ZLIB compression
algorithms. The default is to use the default compression level of zlib
(normally 6). @option{--bzip2-compress-level} sets the compression level
for the BZIP2 compression algorithm (defaulting to 6 as well). This is a
different option from @option{--compress-level} since BZIP2 uses a
significant amount of memory for each additional compression level.
@option{-z} sets both. A value of 0 for @code{n} disables compression.

@item --bzip2-decompress-lowmem
@opindex bzip2-decompress-lowmem
Use a different decompression method for BZIP2 compressed files. This
alternate method uses a bit more than half the memory, but also runs
at half the speed. This is useful under extreme low memory
circumstances when the file was originally compressed at a high
@option{--bzip2-compress-level}.


@item --mangle-dos-filenames
@itemx --no-mangle-dos-filenames
@opindex mangle-dos-filenames
@opindex no-mangle-dos-filenames
Older version of Windows cannot handle filenames with more than one
dot. @option{--mangle-dos-filenames} causes GnuPG to replace (rather
than add to) the extension of an output filename to avoid this
problem. This option is off by default and has no effect on non-Windows
platforms.

@item --ask-cert-level
@itemx --no-ask-cert-level
@opindex ask-cert-level
When making a key signature, prompt for a certification level. If this
option is not specified, the certification level used is set via
@option{--default-cert-level}. See @option{--default-cert-level} for
information on the specific levels and how they are
used. @option{--no-ask-cert-level} disables this option. This option
defaults to no.

@item --default-cert-level @code{n}
@opindex default-cert-level
The default to use for the check level when signing a key.

0 means you make no particular claim as to how carefully you verified
the key.

1 means you believe the key is owned by the person who claims to own
it but you could not, or did not verify the key at all. This is
useful for a "persona" verification, where you sign the key of a
pseudonymous user.

2 means you did casual verification of the key. For example, this
could mean that you verified the key fingerprint and checked the
user ID on the key against a photo ID.

3 means you did extensive verification of the key. For example, this
could mean that you verified the key fingerprint with the owner of the
key in person, and that you checked, by means of a hard to forge
document with a photo ID (such as a passport) that the name of the key
owner matches the name in the user ID on the key, and finally that you
verified (by exchange of email) that the email address on the key
belongs to the key owner.

Note that the examples given above for levels 2 and 3 are just that:
examples. In the end, it is up to you to decide just what "casual"
and "extensive" mean to you.

This option defaults to 0 (no particular claim).

@item --min-cert-level
@opindex min-cert-level
When building the trust database, treat any signatures with a
certification level below this as invalid. Defaults to 2, which
disregards level 1 signatures. Note that level 0 "no particular
claim" signatures are always accepted.

@item --trusted-key @code{long key ID}
@opindex trusted-key
Assume that the specified key (which must be given
as a full 8 byte key ID) is as trustworthy as one of
your own secret keys. This option is useful if you
don't want to keep your secret keys (or one of them)
online but still want to be able to check the validity of a given
recipient's or signator's key.

@item --trust-model @code{pgp|classic|direct|always|auto}
@opindex trust-model
Set what trust model GnuPG should follow. The models are:

@table @asis

  @item pgp
  @opindex trust-mode:pgp
  This is the Web of Trust combined with trust signatures as used in PGP
  5.x and later. This is the default trust model when creating a new
  trust database.

  @item classic
  @opindex trust-mode:classic
  This is the standard Web of Trust as introduced by PGP 2.

  @item direct
  @opindex trust-mode:direct
  Key validity is set directly by the user and not calculated via the
  Web of Trust.

  @item always
  @opindex trust-mode:always
  Skip key validation and assume that used keys are always fully
  valid. You generally won't use this unless you are using some
  external validation scheme. This option also suppresses the
  "[uncertain]" tag printed with signature checks when there is no
  evidence that the user ID is bound to the key.  Note that this
  trust model still does not allow the use of expired, revoked, or
  disabled keys.

  @item auto
  @opindex trust-mode:auto
  Select the trust model depending on whatever the internal trust
  database says. This is the default model if such a database already
  exists.
@end table

@item --auto-key-locate @code{parameters}
@itemx --no-auto-key-locate
@opindex auto-key-locate
GnuPG can automatically locate and retrieve keys as needed using this
option. This happens when encrypting to an email address (in the
"user@@example.com" form), and there are no user@@example.com keys on
the local keyring.  This option takes any number of the following
mechanisms, in the order they are to be tried:

@table @asis

  @item cert
  Locate a key using DNS CERT, as specified in rfc4398.

  @item pka
  Locate a key using DNS PKA.

  @item ldap
  Using DNS Service Discovery, check the domain in question for any LDAP
  keyservers to use.  If this fails, attempt to locate the key using the
  PGP Universal method of checking @samp{ldap://keys.(thedomain)}.

  @item keyserver
  Locate a key using whatever keyserver is defined using the
  @option{--keyserver} option.

  @item keyserver-URL
  In addition, a keyserver URL as used in the @option{--keyserver} option
  may be used here to query that particular keyserver.

  @item local
  Locate the key using the local keyrings.  This mechanism allows to
  select the order a local key lookup is done.  Thus using
  @samp{--auto-key-locate local} is identical to
  @option{--no-auto-key-locate}.

  @item nodefault
  This flag disables the standard local key lookup, done before any of the
  mechanisms defined by the @option{--auto-key-locate} are tried.  The
  position of this mechanism in the list does not matter.  It is not
  required if @code{local} is also used.

  @item clear
  Clear all defined mechanisms.  This is useful to override
  mechanisms given in a config file.

@end table

@item --keyid-format @code{short|0xshort|long|0xlong}
@opindex keyid-format
Select how to display key IDs. "short" is the traditional 8-character
key ID. "long" is the more accurate (but less convenient)
16-character key ID. Add an "0x" to either to include an "0x" at the
beginning of the key ID, as in 0x99242560.  Note that this option is
ignored if the option --with-colons is used.

@item --keyserver @code{name}
@opindex keyserver
Use @code{name} as your keyserver. This is the server that
@option{--recv-keys}, @option{--send-keys}, and @option{--search-keys}
will communicate with to receive keys from, send keys to, and search for
keys on. The format of the @code{name} is a URI:
`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
keyservers, or "mailto" for the Graff email keyserver. Note that your
particular installation of GnuPG may have other keyserver types
available as well. Keyserver schemes are case-insensitive. After the
keyserver name, optional keyserver configuration options may be
provided. These are the same as the global @option{--keyserver-options}
from below, but apply only to this particular keyserver.

Most keyservers synchronize with each other, so there is generally no
need to send keys to more than one server. The keyserver
@code{hkp://keys.gnupg.net} uses round robin DNS to give a different
keyserver each time you use it.

@item --keyserver-options @code{name=value1 }
@opindex keyserver-options
This is a space or comma delimited string that gives options for the
keyserver. Options can be prefixed with a `no-' to give the opposite
meaning. Valid import-options or export-options may be used here as
well to apply to importing (@option{--recv-key}) or exporting
(@option{--send-key}) a key from a keyserver. While not all options
are available for all keyserver types, some common options are:

@table @asis

  @item include-revoked
  When searching for a key with @option{--search-keys}, include keys that
  are marked on the keyserver as revoked. Note that not all keyservers
  differentiate between revoked and unrevoked keys, and for such
  keyservers this option is meaningless. Note also that most keyservers do
  not have cryptographic verification of key revocations, and so turning
  this option off may result in skipping keys that are incorrectly marked
  as revoked.

  @item include-disabled
  When searching for a key with @option{--search-keys}, include keys that
  are marked on the keyserver as disabled. Note that this option is not
  used with HKP keyservers.

  @item auto-key-retrieve
  This option enables the automatic retrieving of keys from a keyserver
  when verifying signatures made by keys that are not on the local
  keyring.

  Note that this option makes a "web bug" like behavior possible.
  Keyserver operators can see which keys you request, so by sending you
  a message signed by a brand new key (which you naturally will not have
  on your local keyring), the operator can tell both your IP address and
  the time when you verified the signature.

  @item honor-keyserver-url
  When using @option{--refresh-keys}, if the key in question has a preferred
  keyserver URL, then use that preferred keyserver to refresh the key
  from. In addition, if auto-key-retrieve is set, and the signature
  being verified has a preferred keyserver URL, then use that preferred
  keyserver to fetch the key from. Defaults to yes.

  @item honor-pka-record
  If auto-key-retrieve is set, and the signature being verified has a
  PKA record, then use the PKA information to fetch the key. Defaults
  to yes.

  @item include-subkeys
  When receiving a key, include subkeys as potential targets. Note that
  this option is not used with HKP keyservers, as they do not support
  retrieving keys by subkey id.

  @item use-temp-files
  On most Unix-like platforms, GnuPG communicates with the keyserver
  helper program via pipes, which is the most efficient method. This
  option forces GnuPG to use temporary files to communicate. On some
  platforms (such as Win32 and RISC OS), this option is always enabled.

  @item keep-temp-files
  If using `use-temp-files', do not delete the temp files after using
  them. This option is useful to learn the keyserver communication
  protocol by reading the temporary files.

  @item verbose
  Tell the keyserver helper program to be more verbose. This option can
  be repeated multiple times to increase the verbosity level.

  @item timeout
  Tell the keyserver helper program how long (in seconds) to try and
  perform a keyserver action before giving up. Note that performing
  multiple actions at the same time uses this timeout value per action.
  For example, when retrieving multiple keys via @option{--recv-keys}, the
  timeout applies separately to each key retrieval, and not to the
  @option{--recv-keys} command as a whole. Defaults to 30 seconds.

  @item http-proxy=@code{value}
  Set the proxy to use for HTTP and HKP keyservers.  This overrides the
  "http_proxy" environment variable, if any.


  @item max-cert-size
  When retrieving a key via DNS CERT, only accept keys up to this size.
  Defaults to 16384 bytes.

  @item debug
  Turn on debug output in the keyserver helper program.  Note that the
  details of debug output depends on which keyserver helper program is
  being used, and in turn, on any libraries that the keyserver helper
  program uses internally (libcurl, openldap, etc).

  @item check-cert
  Enable certificate checking if the keyserver presents one (for hkps or
  ldaps).  Defaults to on.

  @item ca-cert-file
  Provide a certificate store to override the system default.  Only
  necessary if check-cert is enabled, and the keyserver is using a
  certificate that is not present in a system default certificate list.

  Note that depending on the SSL library that the keyserver helper is
  built with, this may actually be a directory or a file.

@end table

@item --completes-needed @code{n}
@opindex compliant-needed
Number of completely trusted users to introduce a new
key signer (defaults to 1).

@item --marginals-needed @code{n}
@opindex marginals-needed
Number of marginally trusted users to introduce a new
key signer (defaults to 3)

@item --max-cert-depth @code{n}
@opindex max-cert-depth
Maximum depth of a certification chain (default is 5).

@item --simple-sk-checksum
@opindex simple-sk-checksum
Secret keys are integrity protected by using a SHA-1 checksum. This
method is part of the upcoming enhanced OpenPGP specification but
GnuPG already uses it as a countermeasure against certain attacks.
Old applications don't understand this new format, so this option may
be used to switch back to the old behaviour. Using this option bears
a security risk. Note that using this option only takes effect when
the secret key is encrypted - the simplest way to make this happen is
to change the passphrase on the key (even changing it to the same
value is acceptable).

@item --no-sig-cache
@opindex no-sig-cache
Do not cache the verification status of key signatures.
Caching gives a much better performance in key listings. However, if
you suspect that your public keyring is not save against write
modifications, you can use this option to disable the caching. It
probably does not make sense to disable it because all kind of damage
can be done if someone else has write access to your public keyring.

@item --no-sig-create-check
@opindex no-sig-create-check
GnuPG normally verifies each signature right after creation to protect
against bugs and hardware malfunctions which could leak out bits from
the secret key. This extra verification needs some time (about 115%
for DSA keys), and so this option can be used to disable it.
However, due to the fact that the signature creation needs manual
interaction, this performance penalty does not matter in most settings.

@item --auto-check-trustdb
@itemx --no-auto-check-trustdb
@opindex auto-check-trustdb
If GnuPG feels that its information about the Web of Trust has to be
updated, it automatically runs the @option{--check-trustdb} command
internally.  This may be a time consuming
process. @option{--no-auto-check-trustdb} disables this option.

@item --use-agent
@itemx --no-use-agent
@opindex use-agent
Try to use the GnuPG-Agent.  With this option, GnuPG first tries to
connect to the agent before it asks for a
passphrase. @option{--no-use-agent} disables this option.

@item --gpg-agent-info
@opindex gpg-agent-info
Override the value of the environment variable
@samp{GPG_AGENT_INFO}. This is only used when @option{--use-agent} has
been given.  Given that this option is not anymore used by
@command{gpg2}, it should be avoided if possible.


@item --lock-once
@opindex lock-once
Lock the databases the first time a lock is requested
and do not release the lock until the process
terminates.

@item --lock-multiple
@opindex lock-multiple
Release the locks every time a lock is no longer
needed. Use this to override a previous @option{--lock-once}
from a config file.

@item --lock-never
@opindex lock-never
Disable locking entirely. This option should be used only in very
special environments, where it can be assured that only one process
is accessing those files. A bootable floppy with a stand-alone
encryption system will probably use this. Improper usage of this
option may lead to data and key corruption.

@item --exit-on-status-write-error
@opindex exit-on-status-write-error
This option will cause write errors on the status FD to immediately
terminate the process. That should in fact be the default but it never
worked this way and thus we need an option to enable this, so that the
change won't break applications which close their end of a status fd
connected pipe too early. Using this option along with
@option{--enable-progress-filter} may be used to cleanly cancel long
running gpg operations.

@item --limit-card-insert-tries @code{n}
@opindex limit-card-insert-tries
With @code{n} greater than 0 the number of prompts asking to insert a
smartcard gets limited to N-1. Thus with a value of 1 gpg won't at
all ask to insert a card if none has been inserted at startup. This
option is useful in the configuration file in case an application does
not know about the smartcard support and waits ad infinitum for an
inserted card.

@item --no-random-seed-file
@opindex no-random-seed-file
GnuPG uses a file to store its internal random pool over invocations.
This makes random generation faster; however sometimes write operations
are not desired. This option can be used to achieve that with the cost of
slower random generation.

@item --no-greeting
@opindex no-greeting
Suppress the initial copyright message.

@item --no-secmem-warning
@opindex no-secmem-warning
Suppress the warning about "using insecure memory".

@item --no-permission-warning
@opindex permission-warning
Suppress the warning about unsafe file and home directory (@option{--homedir})
permissions. Note that the permission checks that GnuPG performs are
not intended to be authoritative, but rather they simply warn about
certain common permission problems. Do not assume that the lack of a
warning means that your system is secure.

Note that the warning for unsafe @option{--homedir} permissions cannot be
suppressed in the gpg.conf file, as this would allow an attacker to
place an unsafe gpg.conf file in place, and use this file to suppress
warnings about itself. The @option{--homedir} permissions warning may only be
suppressed on the command line.

@item --no-mdc-warning
@opindex no-mdc-warning
Suppress the warning about missing MDC integrity protection.

@item --require-secmem
@itemx --no-require-secmem
@opindex require-secmem
Refuse to run if GnuPG cannot get secure memory. Defaults to no
(i.e. run, but give a warning).


@item --require-cross-certification
@itemx --no-require-cross-certification
@opindex require-cross-certification
When verifying a signature made from a subkey, ensure that the cross
certification "back signature" on the subkey is present and valid.  This
protects against a subtle attack against subkeys that can sign.
Defaults to @option{--require-cross-certification} for
@command{@gpgname}.

@item --expert
@itemx --no-expert
@opindex expert
Allow the user to do certain nonsensical or "silly" things like
signing an expired or revoked key, or certain potentially incompatible
things like generating unusual key types. This also disables certain
warning messages about potentially incompatible actions. As the name
implies, this option is for experts only. If you don't fully
understand the implications of what it allows you to do, leave this
off. @option{--no-expert} disables this option.

@end table


@c *******************************************
@c ********  KEY RELATED OPTIONS  ************
@c *******************************************
@node GPG Key related Options
@subsection Key related options

@table @gnupgtabopt

@item --recipient @var{name}
@itemx -r
@opindex recipient
Encrypt for user id @var{name}. If this option or
@option{--hidden-recipient} is not specified, GnuPG asks for the user-id
unless @option{--default-recipient} is given.

@item --hidden-recipient @var{name}
@itemx -R
@opindex hidden-recipient
Encrypt for user ID @var{name}, but hide the key ID of this user's
key. This option helps to hide the receiver of the message and is a
limited countermeasure against traffic analysis. If this option or
@option{--recipient} is not specified, GnuPG asks for the user ID unless
@option{--default-recipient} is given.

@item --encrypt-to @code{name}
@opindex encrypt-to
Same as @option{--recipient} but this one is intended for use in the
options file and may be used with your own user-id as an
"encrypt-to-self". These keys are only used when there are other
recipients given either by use of @option{--recipient} or by the asked
user id.  No trust checking is performed for these user ids and even
disabled keys can be used.

@item --hidden-encrypt-to @code{name}
@opindex hidden-encrypt-to
Same as @option{--hidden-recipient} but this one is intended for use in the
options file and may be used with your own user-id as a hidden
"encrypt-to-self". These keys are only used when there are other
recipients given either by use of @option{--recipient} or by the asked user id.
No trust checking is performed for these user ids and even disabled
keys can be used.

@item --no-encrypt-to
@opindex no-encrypt-to
Disable the use of all @option{--encrypt-to} and
@option{--hidden-encrypt-to} keys.

@item --group @code{name=value1 }
@opindex group
Sets up a named group, which is similar to aliases in email programs.
Any time the group name is a recipient (@option{-r} or
@option{--recipient}), it will be expanded to the values
specified. Multiple groups with the same name are automatically merged
into a single group.

The values are @code{key IDs} or fingerprints, but any key description
is accepted. Note that a value with spaces in it will be treated as
two different values. Note also there is only one level of expansion
--- you cannot make an group that points to another group. When used
from the command line, it may be necessary to quote the argument to
this option to prevent the shell from treating it as multiple
arguments.

@item --ungroup @code{name}
@opindex ungroup
Remove a given entry from the @option{--group} list.

@item --no-groups
@opindex no-groups
Remove all entries from the @option{--group} list.

@item --local-user @var{name}
@itemx -u
@opindex local-user
Use @var{name} as the key to sign with. Note that this option overrides
@option{--default-key}.

@item --try-all-secrets
@opindex try-all-secrets
Don't look at the key ID as stored in the message but try all secret
keys in turn to find the right decryption key. This option forces the
behaviour as used by anonymous recipients (created by using
@option{--throw-keyids} or @option{--hidden-recipient}) and might come
handy in case where an encrypted message contains a bogus key ID.

@item --skip-hidden-recipients
@itemx --no-skip-hidden-recipients
@opindex skip-hidden-recipients
@opindex no-skip-hidden-recipients
During decryption skip all anonymous recipients.  This option helps in
the case that people use the hidden recipients feature to hide there
own encrypt-to key from others.  If oneself has many secret keys this
may lead to a major annoyance because all keys are tried in turn to
decrypt soemthing which was not really intended for it.  The drawback
of this option is that it is currently not possible to decrypt a
message which includes real anonymous recipients.


@end table

@c *******************************************
@c ********  INPUT AND OUTPUT  ***************
@c *******************************************
@node GPG Input and Output
@subsection Input and Output

@table @gnupgtabopt

@item --armor
@itemx -a
@opindex armor
Create ASCII armored output.  The default is to create the binary
OpenPGP format.

@item --no-armor
@opindex no-armor
Assume the input data is not in ASCII armored format.

@item --output @var{file}
@itemx -o @var{file}
@opindex output
Write output to @var{file}.

@item --max-output @code{n}
@opindex max-output
This option sets a limit on the number of bytes that will be generated
when processing a file. Since OpenPGP supports various levels of
compression, it is possible that the plaintext of a given message may be
significantly larger than the original OpenPGP message. While GnuPG
works properly with such messages, there is often a desire to set a
maximum file size that will be generated before processing is forced to
stop by the OS limits. Defaults to 0, which means "no limit".

@item --import-options @code{parameters}
@opindex import-options
This is a space or comma delimited string that gives options for
importing keys. Options can be prepended with a `no-' to give the
opposite meaning. The options are:

@table @asis

  @item import-local-sigs
  Allow importing key signatures marked as "local". This is not
  generally useful unless a shared keyring scheme is being used.
  Defaults to no.

  @item repair-pks-subkey-bug
  During import, attempt to repair the damage caused by the PKS keyserver
  bug (pre version 0.9.6) that mangles keys with multiple subkeys. Note
  that this cannot completely repair the damaged key as some crucial data
  is removed by the keyserver, but it does at least give you back one
  subkey. Defaults to no for regular @option{--import} and to yes for
  keyserver @option{--recv-keys}.

  @item merge-only
  During import, allow key updates to existing keys, but do not allow
  any new keys to be imported. Defaults to no.

  @item import-clean
  After import, compact (remove all signatures except the
  self-signature) any user IDs from the new key that are not usable.
  Then, remove any signatures from the new key that are not usable.
  This includes signatures that were issued by keys that are not present
  on the keyring. This option is the same as running the @option{--edit-key}
  command "clean" after import. Defaults to no.

  @item import-minimal
  Import the smallest key possible. This removes all signatures except
  the most recent self-signature on each user ID. This option is the
  same as running the @option{--edit-key} command "minimize" after import.
  Defaults to no.
@end table

@item --export-options @code{parameters}
@opindex export-options
This is a space or comma delimited string that gives options for
exporting keys. Options can be prepended with a `no-' to give the
opposite meaning. The options are:

@table @asis

  @item export-local-sigs
  Allow exporting key signatures marked as "local". This is not
  generally useful unless a shared keyring scheme is being used.
  Defaults to no.

  @item export-attributes
  Include attribute user IDs (photo IDs) while exporting. This is
  useful to export keys if they are going to be used by an OpenPGP
  program that does not accept attribute user IDs. Defaults to yes.

  @item export-sensitive-revkeys
  Include designated revoker information that was marked as
  "sensitive". Defaults to no.

  @item export-reset-subkey-passwd
  When using the @option{--export-secret-subkeys} command, this option resets
  the passphrases for all exported subkeys to empty. This is useful
  when the exported subkey is to be used on an unattended machine where
  a passphrase doesn't necessarily make sense. Defaults to no.

  @item export-clean
  Compact (remove all signatures from) user IDs on the key being
  exported if the user IDs are not usable. Also, do not export any
  signatures that are not usable. This includes signatures that were
  issued by keys that are not present on the keyring. This option is
  the same as running the @option{--edit-key} command "clean" before export
  except that the local copy of the key is not modified. Defaults to
  no.

  @item export-minimal
  Export the smallest key possible. This removes all signatures except the
  most recent self-signature on each user ID. This option is the same as
  running the @option{--edit-key} command "minimize" before export except
  that the local copy of the key is not modified. Defaults to no.
@end table

@item --with-colons
@opindex with-colons
Print key listings delimited by colons. Note that the output will be
encoded in UTF-8 regardless of any @option{--display-charset} setting. This
format is useful when GnuPG is called from scripts and other programs
as it is easily machine parsed. The details of this format are
documented in the file @file{doc/DETAILS}, which is included in the GnuPG
source distribution.

@item --fixed-list-mode
@opindex fixed-list-mode
Do not merge primary user ID and primary key in @option{--with-colon}
listing mode and print all timestamps as seconds since 1970-01-01.

@item --with-fingerprint
@opindex with-fingerprint
Same as the command @option{--fingerprint} but changes only the format
of the output and may be used together with another command.

@end table

@c *******************************************
@c ********  OPENPGP OPTIONS  ****************
@c *******************************************
@node OpenPGP Options
@subsection OpenPGP protocol specific options.

@table @gnupgtabopt

@item -t, --textmode
@itemx --no-textmode
@opindex textmode
Treat input files as text and store them in the OpenPGP canonical text
form with standard "CRLF" line endings. This also sets the necessary
flags to inform the recipient that the encrypted or signed data is text
and may need its line endings converted back to whatever the local
system uses. This option is useful when communicating between two
platforms that have different line ending conventions (UNIX-like to Mac,
Mac to Windows, etc). @option{--no-textmode} disables this option, and
is the default.

If @option{-t} (but not @option{--textmode}) is used together with
armoring and signing, this enables clearsigned messages. This kludge is
needed for command-line compatibility with command-line versions of PGP;
normally you would use @option{--sign} or @option{--clearsign} to select
the type of the signature.

@item --force-v3-sigs
@itemx --no-force-v3-sigs
@opindex force-v3-sigs
OpenPGP states that an implementation should generate v4 signatures
but PGP versions 5 through 7 only recognize v4 signatures on key
material. This option forces v3 signatures for signatures on data.
Note that this option implies @option{--no-ask-sig-expire}, and unsets
@option{--sig-policy-url}, @option{--sig-notation}, and
@option{--sig-keyserver-url}, as these features cannot be used with v3
signatures.  @option{--no-force-v3-sigs} disables this option.
Defaults to no.

@item --force-v4-certs
@itemx --no-force-v4-certs
@opindex force-v4-certs
Always use v4 key signatures even on v3 keys. This option also
changes the default hash algorithm for v3 RSA keys from MD5 to SHA-1.
@option{--no-force-v4-certs} disables this option.

@item --force-mdc
@opindex force-mdc
Force the use of encryption with a modification detection code. This
is always used with the newer ciphers (those with a blocksize greater
than 64 bits), or if all of the recipient keys indicate MDC support in
their feature flags.

@item --disable-mdc
@opindex disable-mdc
Disable the use of the modification detection code. Note that by
using this option, the encrypted message becomes vulnerable to a
message modification attack.

@item --personal-cipher-preferences @code{string}
@opindex personal-cipher-preferences
Set the list of personal cipher preferences to @code{string}.  Use
@command{@gpgname --version} to get a list of available algorithms,
and use @code{none} to set no preference at all.  This allows the user
to safely override the algorithm chosen by the recipient key
preferences, as GPG will only select an algorithm that is usable by
all recipients.  The most highly ranked cipher in this list is also
used for the @option{--symmetric} encryption command.

@item --personal-digest-preferences @code{string}
@opindex personal-digest-preferences
Set the list of personal digest preferences to @code{string}.  Use
@command{@gpgname --version} to get a list of available algorithms,
and use @code{none} to set no preference at all.  This allows the user
to safely override the algorithm chosen by the recipient key
preferences, as GPG will only select an algorithm that is usable by
all recipients.  The most highly ranked digest algorithm in this list
is also used when signing without encryption
(e.g. @option{--clearsign} or @option{--sign}).

@item --personal-compress-preferences @code{string}
@opindex personal-compress-preferences
Set the list of personal compression preferences to @code{string}.
Use @command{@gpgname --version} to get a list of available
algorithms, and use @code{none} to set no preference at all.  This
allows the user to safely override the algorithm chosen by the
recipient key preferences, as GPG will only select an algorithm that
is usable by all recipients.  The most highly ranked compression
algorithm in this list is also used when there are no recipient keys
to consider (e.g. @option{--symmetric}).

@item --s2k-cipher-algo @code{name}
@opindex s2k-cipher-algo
Use @code{name} as the cipher algorithm used to protect secret keys.
The default cipher is @value{DEFSYMENCALGO}. This cipher is also used for
conventional encryption if @option{--personal-cipher-preferences} and
@option{--cipher-algo} is not given.

@item --s2k-digest-algo @code{name}
@opindex s2k-digest-algo
Use @code{name} as the digest algorithm used to mangle the passphrases.
The default algorithm is SHA-1.

@item --s2k-mode @code{n}
@opindex s2k-mode
Selects how passphrases are mangled. If @code{n} is 0 a plain
passphrase (which is not recommended) will be used, a 1 adds a salt to
the passphrase and a 3 (the default) iterates the whole process a
number of times (see --s2k-count).  Unless @option{--rfc1991} is used,
this mode is also used for conventional encryption.

@item --s2k-count @code{n}
@opindex s2k-count
Specify how many times the passphrase mangling is repeated.  This
value may range between 1024 and 65011712 inclusive.  The default is
inquired from gpg-agent.  Note that not all values in the
1024-65011712 range are legal and if an illegal value is selected,
GnuPG will round up to the nearest legal value.  This option is only
meaningful if @option{--s2k-mode} is 3.


@end table

@c ***************************
@c ******* Compliance ********
@c ***************************
@node Compliance Options
@subsection Compliance options

These options control what GnuPG is compliant to. Only one of these
options may be active at a time. Note that the default setting of
this is nearly always the correct one. See the INTEROPERABILITY WITH
OTHER OPENPGP PROGRAMS section below before using one of these
options.

@table @gnupgtabopt

@item --gnupg
@opindex gnupg
Use standard GnuPG behavior. This is essentially OpenPGP behavior
(see @option{--openpgp}), but with some additional workarounds for common
compatibility problems in different versions of PGP. This is the
default option, so it is not generally needed, but it may be useful to
override a different compliance option in the gpg.conf file.

@item --openpgp
@opindex openpgp
Reset all packet, cipher and digest options to strict OpenPGP
behavior. Use this option to reset all previous options like
@option{--s2k-*}, @option{--cipher-algo}, @option{--digest-algo} and
@option{--compress-algo} to OpenPGP compliant values. All PGP
workarounds are disabled.

@item --rfc4880
@opindex rfc4880
Reset all packet, cipher and digest options to strict RFC-4880
behavior. Note that this is currently the same thing as
@option{--openpgp}.

@item --rfc2440
@opindex rfc2440
Reset all packet, cipher and digest options to strict RFC-2440
behavior.

@ifclear gpgtowone
@item --rfc1991
@opindex rfc1991
Try to be more RFC-1991 (PGP 2.x) compliant.  This option is
deprecated will be removed in GnuPG 2.1.

@item --pgp2
@opindex pgp2
Set up all options to be as PGP 2.x compliant as possible, and warn if
an action is taken (e.g. encrypting to a non-RSA key) that will create
a message that PGP 2.x will not be able to handle. Note that `PGP
2.x' here means `MIT PGP 2.6.2'. There are other versions of PGP 2.x
available, but the MIT release is a good common baseline.

This option implies
@option{--rfc1991 --disable-mdc --no-force-v4-certs
 --escape-from-lines  --force-v3-sigs
 --cipher-algo IDEA --digest-algo MD5 --compress-algo ZIP}.
It also disables @option{--textmode} when encrypting.

This option is deprecated will be removed in GnuPG 2.1.  The reason
for dropping PGP-2 support is that the PGP 2 format is not anymore
considered safe (for example due to the use of the broken MD5 algorithm).
Note that the decryption of PGP-2 created messages will continue to work.
@end ifclear

@item --pgp6
@opindex pgp6
Set up all options to be as PGP 6 compliant as possible. This
restricts you to the ciphers IDEA (if the IDEA plugin is installed),
3DES, and CAST5, the hashes MD5, SHA1 and RIPEMD160, and the
compression algorithms none and ZIP. This also disables
--throw-keyids, and making signatures with signing subkeys as PGP 6
does not understand signatures made by signing subkeys.

This option implies @option{--disable-mdc --escape-from-lines
--force-v3-sigs}.

@item --pgp7
@opindex pgp7
Set up all options to be as PGP 7 compliant as possible. This is
identical to @option{--pgp6} except that MDCs are not disabled, and the
list of allowable ciphers is expanded to add AES128, AES192, AES256, and
TWOFISH.

@item --pgp8
@opindex pgp8
Set up all options to be as PGP 8 compliant as possible. PGP 8 is a lot
closer to the OpenPGP standard than previous versions of PGP, so all
this does is disable @option{--throw-keyids} and set
@option{--escape-from-lines}.  All algorithms are allowed except for the
SHA224, SHA384, and SHA512 digests.

@end table


@c *******************************************
@c ********  ESOTERIC OPTIONS  ***************
@c *******************************************
@node GPG Esoteric Options
@subsection Doing things one usually doesn't want to do.

@table @gnupgtabopt

@item -n
@itemx --dry-run
@opindex dry-run
Don't make any changes (this is not completely implemented).

@item --list-only
@opindex list-only
Changes the behaviour of some commands. This is like @option{--dry-run} but
different in some cases. The semantic of this command may be extended in
the future. Currently it only skips the actual decryption pass and
therefore enables a fast listing of the encryption keys.

@item -i
@itemx --interactive
@opindex interactive
Prompt before overwriting any files.

@item --debug-level @var{level}
@opindex debug-level
Select the debug level for investigating problems. @var{level} may be
a numeric value or by a keyword:

@table @code
  @item none
  No debugging at all.  A value of less than 1 may be used instead of
  the keyword.
  @item basic
  Some basic debug messages.  A value between 1 and 2 may be used
  instead of the keyword.
  @item advanced
  More verbose debug messages.  A value between 3 and 5 may be used
  instead of the keyword.
  @item expert
  Even more detailed messages.  A value between 6 and 8 may be used
  instead of the keyword.
  @item guru
  All of the debug messages you can get. A value greater than 8 may be
  used instead of the keyword.  The creation of hash tracing files is
  only enabled if the keyword is used.
@end table

How these messages are mapped to the actual debugging flags is not
specified and may change with newer releases of this program. They are
however carefully selected to best aid in debugging.

@item --debug @var{flags}
@opindex debug
Set debugging flags. All flags are or-ed and @var{flags} may
be given in C syntax (e.g. 0x0042).

@item --debug-all
@opindex debug-all
Set all useful debugging flags.

@item --debug-ccid-driver
@opindex debug-ccid-driver
Enable debug output from the included CCID driver for smartcards.
Note that this option is only available on some system.

@item --faked-system-time @var{epoch}
@opindex faked-system-time
This option is only useful for testing; it sets the system time back or
forth to @var{epoch} which is the number of seconds elapsed since the year
1970.  Alternatively @var{epoch} may be given as a full ISO time string
(e.g. "20070924T154812").

@item --enable-progress-filter
@opindex enable-progress-filter
Enable certain PROGRESS status outputs. This option allows frontends
to display a progress indicator while gpg is processing larger files.
There is a slight performance overhead using it.

@item --status-fd @code{n}
@opindex status-fd
Write special status strings to the file descriptor @code{n}.
See the file DETAILS in the documentation for a listing of them.

@item --status-file @code{file}
@opindex status-file
Same as @option{--status-fd}, except the status data is written to file
@code{file}.

@item --logger-fd @code{n}
@opindex logger-fd
Write log output to file descriptor @code{n} and not to STDERR.

@item --log-file @code{file}
@itemx --logger-file @code{file}
@opindex log-file
Same as @option{--logger-fd}, except the logger data is written to file
@code{file}.  Note that @option{--log-file} is only implemented for
GnuPG-2.

@item --attribute-fd @code{n}
@opindex attribute-fd
Write attribute subpackets to the file descriptor @code{n}. This is most
useful for use with @option{--status-fd}, since the status messages are
needed to separate out the various subpackets from the stream delivered
to the file descriptor.

@item --attribute-file @code{file}
@opindex attribute-file
Same as @option{--attribute-fd}, except the attribute data is written to
file @code{file}.

@item --comment @code{string}
@itemx --no-comments
@opindex comment
Use @code{string} as a comment string in clear text signatures and ASCII
armored messages or keys (see @option{--armor}). The default behavior is
not to use a comment string. @option{--comment} may be repeated multiple
times to get multiple comment strings. @option{--no-comments} removes
all comments.  It is a good idea to keep the length of a single comment
below 60 characters to avoid problems with mail programs wrapping such
lines.  Note that comment lines, like all other header lines, are not
protected by the signature.

@item --emit-version
@itemx --no-emit-version
@opindex emit-version
Force inclusion of the version string in ASCII armored output.  If
given once only the name of the program and the major number is
emitted (default), given twice the minor is also emitted, given triple
the micro is added, and given quad an operating system identification
is also emitted.  @option{--no-emit-version} disables the version
line.

@item --sig-notation @code{name=value}
@itemx --cert-notation @code{name=value}
@itemx -N, --set-notation @code{name=value}
@opindex sig-notation
@opindex cert-notation
@opindex set-notation
Put the name value pair into the signature as notation data.
@code{name} must consist only of printable characters or spaces, and
must contain a '@@' character in the form keyname@@domain.example.com
(substituting the appropriate keyname and domain name, of course).  This
is to help prevent pollution of the IETF reserved notation
namespace. The @option{--expert} flag overrides the '@@'
check. @code{value} may be any printable string; it will be encoded in
UTF8, so you should check that your @option{--display-charset} is set
correctly. If you prefix @code{name} with an exclamation mark (!), the
notation data will be flagged as critical
(rfc4880:5.2.3.16). @option{--sig-notation} sets a notation for data
signatures. @option{--cert-notation} sets a notation for key signatures
(certifications). @option{--set-notation} sets both.

There are special codes that may be used in notation names. "%k" will
be expanded into the key ID of the key being signed, "%K" into the
long key ID of the key being signed, "%f" into the fingerprint of the
key being signed, "%s" into the key ID of the key making the
signature, "%S" into the long key ID of the key making the signature,
"%g" into the fingerprint of the key making the signature (which might
be a subkey), "%p" into the fingerprint of the primary key of the key
making the signature, "%c" into the signature count from the OpenPGP
smartcard, and "%%" results in a single "%". %k, %K, and %f are only
meaningful when making a key signature (certification), and %c is only
meaningful when using the OpenPGP smartcard.

@item --sig-policy-url @code{string}
@itemx --cert-policy-url @code{string}
@itemx --set-policy-url @code{string}
@opindex sig-policy-url
@opindex cert-policy-url
@opindex set-policy-url
Use @code{string} as a Policy URL for signatures (rfc4880:5.2.3.20).  If
you prefix it with an exclamation mark (!), the policy URL packet will
be flagged as critical. @option{--sig-policy-url} sets a policy url for
data signatures. @option{--cert-policy-url} sets a policy url for key
signatures (certifications). @option{--set-policy-url} sets both.

The same %-expandos used for notation data are available here as well.

@item --sig-keyserver-url @code{string}
@opindex sig-keyserver-url
Use @code{string} as a preferred keyserver URL for data signatures. If
you prefix it with an exclamation mark (!), the keyserver URL packet
will be flagged as critical.

The same %-expandos used for notation data are available here as well.

@item --set-filename @code{string}
@opindex set-filename
Use @code{string} as the filename which is stored inside messages.
This overrides the default, which is to use the actual filename of the
file being encrypted.

@item --for-your-eyes-only
@itemx --no-for-your-eyes-only
@opindex for-your-eyes-only
Set the `for your eyes only' flag in the message. This causes GnuPG to
refuse to save the file unless the @option{--output} option is given,
and PGP to use a "secure viewer" with a claimed Tempest-resistant font
to display the message. This option overrides @option{--set-filename}.
@option{--no-for-your-eyes-only} disables this option.

@item --use-embedded-filename
@itemx --no-use-embedded-filename
@opindex use-embedded-filename
Try to create a file with a name as embedded in the data. This can be
a dangerous option as it allows to overwrite files. Defaults to no.

@item --cipher-algo @code{name}
@opindex cipher-algo
Use @code{name} as cipher algorithm. Running the program with the
command @option{--version} yields a list of supported algorithms. If
this is not used the cipher algorithm is selected from the preferences
stored with the key. In general, you do not want to use this option as
it allows you to violate the OpenPGP standard.
@option{--personal-cipher-preferences} is the safe way to accomplish the
same thing.

@item --digest-algo @code{name}
@opindex digest-algo
Use @code{name} as the message digest algorithm. Running the program
with the command @option{--version} yields a list of supported algorithms. In
general, you do not want to use this option as it allows you to
violate the OpenPGP standard. @option{--personal-digest-preferences} is the
safe way to accomplish the same thing.

@item --compress-algo @code{name}
@opindex compress-algo
Use compression algorithm @code{name}. "zlib" is RFC-1950 ZLIB
compression. "zip" is RFC-1951 ZIP compression which is used by PGP.
"bzip2" is a more modern compression scheme that can compress some
things better than zip or zlib, but at the cost of more memory used
during compression and decompression. "uncompressed" or "none"
disables compression. If this option is not used, the default
behavior is to examine the recipient key preferences to see which
algorithms the recipient supports. If all else fails, ZIP is used for
maximum compatibility.

ZLIB may give better compression results than ZIP, as the compression
window size is not limited to 8k. BZIP2 may give even better
compression results than that, but will use a significantly larger
amount of memory while compressing and decompressing. This may be
significant in low memory situations. Note, however, that PGP (all
versions) only supports ZIP compression. Using any algorithm other
than ZIP or "none" will make the message unreadable with PGP. In
general, you do not want to use this option as it allows you to
violate the OpenPGP standard. @option{--personal-compress-preferences} is the
safe way to accomplish the same thing.

@item --cert-digest-algo @code{name}
@opindex cert-digest-algo
Use @code{name} as the message digest algorithm used when signing a
key. Running the program with the command @option{--version} yields a
list of supported algorithms. Be aware that if you choose an algorithm
that GnuPG supports but other OpenPGP implementations do not, then some
users will not be able to use the key signatures you make, or quite
possibly your entire key.

@item --disable-cipher-algo @code{name}
@opindex disable-cipher-algo
Never allow the use of @code{name} as cipher algorithm.
The given name will not be checked so that a later loaded algorithm
will still get disabled.

@item --disable-pubkey-algo @code{name}
@opindex disable-pubkey-algo
Never allow the use of @code{name} as public key algorithm.
The given name will not be checked so that a later loaded algorithm
will still get disabled.

@item --throw-keyids
@itemx --no-throw-keyids
@opindex throw-keyids
Do not put the recipient key IDs into encrypted messages. This helps to
hide the receivers of the message and is a limited countermeasure
against traffic analysis.@footnote{Using a little social engineering
anyone who is able to decrypt the message can check whether one of the
other recipients is the one he suspects.}  On the receiving side, it may
slow down the decryption process because all available secret keys must
be tried.  @option{--no-throw-keyids} disables this option. This option
is essentially the same as using @option{--hidden-recipient} for all
recipients.

@item --not-dash-escaped
@opindex not-dash-escaped
This option changes the behavior of cleartext signatures
so that they can be used for patch files. You should not
send such an armored file via email because all spaces
and line endings are hashed too. You can not use this
option for data which has 5 dashes at the beginning of a
line, patch files don't have this. A special armor header
line tells GnuPG about this cleartext signature option.

@item --escape-from-lines
@itemx --no-escape-from-lines
@opindex escape-from-lines
Because some mailers change lines starting with "From " to ">From " it
is good to handle such lines in a special way when creating cleartext
signatures to prevent the mail system from breaking the signature. Note
that all other PGP versions do it this way too.  Enabled by
default. @option{--no-escape-from-lines} disables this option.

@item --passphrase-repeat @code{n}
@opindex passphrase-repeat
Specify how many times @command{@gpgname} will request a new
passphrase be repeated.  This is useful for helping memorize a
passphrase.  Defaults to 1 repetition.

@item --passphrase-fd @code{n}
@opindex passphrase-fd
Read the passphrase from file descriptor @code{n}. Only the first line
will be read from file descriptor @code{n}. If you use 0 for @code{n},
the passphrase will be read from STDIN. This can only be used if only
one passphrase is supplied.

@item --passphrase-file @code{file}
@opindex passphrase-file
Read the passphrase from file @code{file}. Only the first line will
be read from file @code{file}. This can only be used if only one
passphrase is supplied. Obviously, a passphrase stored in a file is
of questionable security if other users can read this file. Don't use
this option if you can avoid it.

@item --passphrase @code{string}
@opindex passphrase
Use @code{string} as the passphrase. This can only be used if only one
passphrase is supplied. Obviously, this is of very questionable
security on a multi-user system. Don't use this option if you can
avoid it.

@item --command-fd @code{n}
@opindex command-fd
This is a replacement for the deprecated shared-memory IPC mode.
If this option is enabled, user input on questions is not expected
from the TTY but from the given file descriptor. It should be used
together with @option{--status-fd}. See the file doc/DETAILS in the source
distribution for details on how to use it.

@item --command-file @code{file}
@opindex command-file
Same as @option{--command-fd}, except the commands are read out of file
@code{file}

@item --allow-non-selfsigned-uid
@itemx --no-allow-non-selfsigned-uid
@opindex allow-non-selfsigned-uid
Allow the import and use of keys with user IDs which are not
self-signed. This is not recommended, as a non self-signed user ID is
trivial to forge. @option{--no-allow-non-selfsigned-uid} disables.

@item --allow-freeform-uid
@opindex allow-freeform-uid
Disable all checks on the form of the user ID while generating a new
one. This option should only be used in very special environments as
it does not ensure the de-facto standard format of user IDs.

@item --ignore-time-conflict
@opindex ignore-time-conflict
GnuPG normally checks that the timestamps associated with keys and
signatures have plausible values. However, sometimes a signature
seems to be older than the key due to clock problems. This option
makes these checks just a warning. See also @option{--ignore-valid-from} for
timestamp issues on subkeys.

@item --ignore-valid-from
@opindex ignore-valid-from
GnuPG normally does not select and use subkeys created in the future.
This option allows the use of such keys and thus exhibits the
pre-1.0.7 behaviour. You should not use this option unless there
is some clock problem. See also @option{--ignore-time-conflict} for timestamp
issues with signatures.

@item --ignore-crc-error
@opindex ignore-crc-error
The ASCII armor used by OpenPGP is protected by a CRC checksum against
transmission errors. Occasionally the CRC gets mangled somewhere on
the transmission channel but the actual content (which is protected by
the OpenPGP protocol anyway) is still okay. This option allows GnuPG
to ignore CRC errors.

@item --ignore-mdc-error
@opindex ignore-mdc-error
This option changes a MDC integrity protection failure into a warning.
This can be useful if a message is partially corrupt, but it is
necessary to get as much data as possible out of the corrupt message.
However, be aware that a MDC protection failure may also mean that the
message was tampered with intentionally by an attacker.

@item --no-default-keyring
@opindex no-default-keyring
Do not add the default keyrings to the list of keyrings. Note that
GnuPG will not operate without any keyrings, so if you use this option
and do not provide alternate keyrings via @option{--keyring} or
@option{--secret-keyring}, then GnuPG will still use the default public or
secret keyrings.

@item --skip-verify
@opindex skip-verify
Skip the signature verification step. This may be
used to make the decryption faster if the signature
verification is not needed.

@item --with-key-data
@opindex with-key-data
Print key listings delimited by colons (like @option{--with-colons}) and
print the public key data.

@item --fast-list-mode
@opindex fast-list-mode
Changes the output of the list commands to work faster; this is achieved
by leaving some parts empty. Some applications don't need the user ID
and the trust information given in the listings. By using this options
they can get a faster listing. The exact behaviour of this option may
change in future versions.  If you are missing some information, don't
use this option.

@item --no-literal
@opindex no-literal
This is not for normal use. Use the source to see for what it might be useful.

@item --set-filesize
@opindex set-filesize
This is not for normal use. Use the source to see for what it might be useful.

@item --show-session-key
@opindex show-session-key
Display the session key used for one message. See
@option{--override-session-key} for the counterpart of this option.

We think that Key Escrow is a Bad Thing; however the user should have
the freedom to decide whether to go to prison or to reveal the content
of one specific message without compromising all messages ever
encrypted for one secret key. DON'T USE IT UNLESS YOU ARE REALLY
FORCED TO DO SO.

@item --override-session-key @code{string}
@opindex override-session-key
Don't use the public key but the session key @code{string}. The format
of this string is the same as the one printed by
@option{--show-session-key}. This option is normally not used but comes
handy in case someone forces you to reveal the content of an encrypted
message; using this option you can do this without handing out the
secret key.

@item --ask-sig-expire
@itemx --no-ask-sig-expire
@opindex ask-sig-expire
When making a data signature, prompt for an expiration time. If this
option is not specified, the expiration time set via
@option{--default-sig-expire} is used. @option{--no-ask-sig-expire}
disables this option.

@item --default-sig-expire
@opindex default-sig-expire
The default expiration time to use for signature expiration. Valid
values are "0" for no expiration, a number followed by the letter d
(for days), w (for weeks), m (for months), or y (for years) (for
example "2m" for two months, or "5y" for five years), or an absolute
date in the form YYYY-MM-DD. Defaults to "0".

@item --ask-cert-expire
@itemx --no-ask-cert-expire
@opindex ask-cert-expire
When making a key signature, prompt for an expiration time. If this
option is not specified, the expiration time set via
@option{--default-cert-expire} is used. @option{--no-ask-cert-expire}
disables this option.

@item --default-cert-expire
@opindex default-cert-expire
The default expiration time to use for key signature expiration.
Valid values are "0" for no expiration, a number followed by the
letter d (for days), w (for weeks), m (for months), or y (for years)
(for example "2m" for two months, or "5y" for five years), or an
absolute date in the form YYYY-MM-DD. Defaults to "0".

@item --allow-secret-key-import
@opindex allow-secret-key-import
This is an obsolete option and is not used anywhere.

@item --allow-multiple-messages
@item --no-allow-multiple-messages
@opindex allow-multiple-messages
Allow processing of multiple OpenPGP messages contained in a single file
or stream.  Some programs that call GPG are not prepared to deal with
multiple messages being processed together, so this option defaults to
no.  Note that versions of GPG prior to 1.4.7 always allowed multiple
messages.

Warning: Do not use this option unless you need it as a temporary
workaround!


@item --enable-special-filenames
@opindex enable-special-filenames
This options enables a mode in which filenames of the form
@file{-&n}, where n is a non-negative decimal number,
refer to the file descriptor n and not to a file with that name.

@item --no-expensive-trust-checks
@opindex no-expensive-trust-checks
Experimental use only.

@item --preserve-permissions
@opindex preserve-permissions
Don't change the permissions of a secret keyring back to user
read/write only. Use this option only if you really know what you are doing.

@item --default-preference-list @code{string}
@opindex default-preference-list
Set the list of default preferences to @code{string}. This preference
list is used for new keys and becomes the default for "setpref" in the
edit menu.

@item --default-keyserver-url @code{name}
@opindex default-keyserver-url
Set the default keyserver URL to @code{name}. This keyserver will be
used as the keyserver URL when writing a new self-signature on a key,
which includes key generation and changing preferences.

@item --list-config
@opindex list-config
Display various internal configuration parameters of GnuPG. This option
is intended for external programs that call GnuPG to perform tasks, and
is thus not generally useful. See the file @file{doc/DETAILS} in the
source distribution for the details of which configuration items may be
listed. @option{--list-config} is only usable with
@option{--with-colons} set.

@item --gpgconf-list
@opindex gpgconf-list
This command is similar to @option{--list-config} but in general only
internally used by the @command{gpgconf} tool.

@item --gpgconf-test
@opindex gpgconf-test
This is more or less dummy action.  However it parses the configuration
file and returns with failure if the configuration file would prevent
@command{gpg} from startup.  Thus it may be used to run a syntax check
on the configuration file.

@end table

@c *******************************
@c ******* Deprecated ************
@c *******************************
@node Deprecated Options
@subsection Deprecated options

@table @gnupgtabopt

@item --load-extension @code{name}
@opindex load-extension
Load an extension module. If @code{name} does not contain a slash it is
searched for in the directory configured when GnuPG was built
(generally "/usr/local/lib/gnupg"). Extensions are not generally
useful anymore, and the use of this option is deprecated.

@item --show-photos
@itemx --no-show-photos
@opindex show-photos
Causes @option{--list-keys}, @option{--list-sigs},
@option{--list-public-keys}, @option{--list-secret-keys}, and verifying
a signature to also display the photo ID attached to the key, if
any. See also @option{--photo-viewer}. These options are deprecated. Use
@option{--list-options [no-]show-photos} and/or @option{--verify-options
[no-]show-photos} instead.

@item --show-keyring
@opindex show-keyring
Display the keyring name at the head of key listings to show which
keyring a given key resides on. This option is deprecated: use
@option{--list-options [no-]show-keyring} instead.

@item --ctapi-driver @code{file}
@opindex ctapi-driver
Use @code{file} to access the smartcard reader. The current default
is `libtowitoko.so'. Note that the use of this interface is
deprecated; it may be removed in future releases.

@item --always-trust
@opindex always-trust
Identical to @option{--trust-model always}. This option is deprecated.

@item --show-notation
@itemx --no-show-notation
@opindex show-notation
Show signature notations in the @option{--list-sigs} or @option{--check-sigs} listings
as well as when verifying a signature with a notation in it. These
options are deprecated. Use @option{--list-options [no-]show-notation}
and/or @option{--verify-options [no-]show-notation} instead.

@item --show-policy-url
@itemx --no-show-policy-url
@opindex show-policy-url
Show policy URLs in the @option{--list-sigs} or @option{--check-sigs}
listings as well as when verifying a signature with a policy URL in
it. These options are deprecated. Use @option{--list-options
[no-]show-policy-url} and/or @option{--verify-options
[no-]show-policy-url} instead.


@end table


@c *******************************************
@c ***************            ****************
@c ***************   FILES    ****************
@c ***************            ****************
@c *******************************************
@mansect files
@node GPG Configuration
@section Configuration files

There are a few configuration files to control certain aspects of
@command{@gpgname}'s operation. Unless noted, they are expected in the
current home directory (@pxref{option --homedir}).

@table @file

  @item gpg.conf
  @cindex gpg.conf
  This is the standard configuration file read by @command{@gpgname} on
  startup.  It may contain any valid long option; the leading two dashes
  may not be entered and the option may not be abbreviated.  This default
  name may be changed on the command line (@pxref{gpg-option --options}).
  You should backup this file.

@end table

@c man:.RE
Note that on larger installations, it is useful to put predefined files
into the directory @file{/etc/skel/.gnupg/} so that newly created users
start up with a working configuration.

For internal purposes @command{@gpgname} creates and maintains a few other
files; They all live in in the current home directory (@pxref{option
--homedir}).  Only the @command{@gpgname} may modify these files.


@table @file
  @item ~/.gnupg/pubring.gpg
  The public keyring.  You should backup this file.

  @item ~/.gnupg/pubring.gpg.lock
  The lock file for the public keyring.

  @item ~/.gnupg/pubring.kbx
  @itemx ~/.gnupg/pubring.kbx.lock
  A public keyring and its lock file used by GnuPG versions >= 2.
  It is ignored by GnuPG 1.x

  @item ~/.gnupg/secring.gpg
  The secret keyring.  You should backup this file.

  @item ~/.gnupg/trustdb.gpg
  The trust database.  There is no need to backup this file; it is better
  to backup the ownertrust values (@pxref{option --export-ownertrust}).

  @item ~/.gnupg/trustdb.gpg.lock
  The lock file for the trust database.

  @item ~/.gnupg/random_seed
  A file used to preserve the state of the internal random pool.

  @item ~/.gnupg/secring.gpg.lock
  The lock file for the secret keyring.

  @item ~/.gnupg/openpgp-revocs.d/
  This is the directory where gpg stores pre-generated revocation
  certificates.  The file name corresponds to the OpenPGP fingerprint of
  the respective key.  It is suggested to backup those certificates and
  if the primary private key is not stored on the disk to move them to
  an external storage device.  Anyone who can access theses files is
  able to revoke the corresponding key.  You may want to print them out.
  You should backup all files in this directory and take care to keep
  this backup closed away.

  @item /usr[/local]/share/gnupg/options.skel
  The skeleton options file.

  @item /usr[/local]/lib/gnupg/
  Default location for extensions.

@end table

@c man:.RE
Operation is further controlled by a few environment variables:

@table @asis

  @item HOME
  Used to locate the default home directory.

  @item GNUPGHOME
  If set directory used instead of "~/.gnupg".

  @item GPG_AGENT_INFO
  Used to locate the gpg-agent.
  This is only honored when @option{--use-agent} is set.

  The value consists of 3 colon delimited fields: The first is the path
  to the Unix Domain Socket, the second the PID of the gpg-agent and the
  protocol version which should be set to 1. When starting the gpg-agent
  as described in its documentation, this variable is set to the correct
  value. The option @option{--gpg-agent-info} can be used to override it.

  @item PINENTRY_USER_DATA
  This value is passed via gpg-agent to pinentry.  It is useful to convey
  extra information to a custom pinentry.

  @item COLUMNS
  @itemx LINES
  Used to size some displays to the full size of the screen.


  @item LANGUAGE
  Apart from its use by GNU, it is used in the W32 version to override the
  language selection done through the Registry.  If used and set to a
  valid and available language name (@var{langid}), the file with the
  translation is loaded from

  @code{@var{gpgdir}/gnupg.nls/@var{langid}.mo}.  Here @var{gpgdir} is the
  directory out of which the gpg binary has been loaded.  If it can't be
  loaded the Registry is tried and as last resort the native Windows
  locale system is used.

@end table


@c *******************************************
@c ***************            ****************
@c ***************  EXAMPLES  ****************
@c ***************            ****************
@c *******************************************
@mansect examples
@node GPG Examples
@section Examples

@table @asis

@item gpg -se -r @code{Bob} @code{file}
sign and encrypt for user Bob

@item gpg --clearsign @code{file}
make a clear text signature

@item gpg -sb @code{file}
make a detached signature

@item gpg -u 0x12345678 -sb @code{file}
make a detached signature with the key 0x12345678

@item gpg --list-keys @code{user_ID}
show keys

@item gpg --fingerprint @code{user_ID}
show fingerprint

@item gpg --verify @code{pgpfile}
@itemx gpg --verify @code{sigfile}
Verify the signature of the file but do not output the data. The
second form is used for detached signatures, where @code{sigfile}
is the detached signature (either ASCII armored or binary) and
are the signed data; if this is not given, the name of
the file holding the signed data is constructed by cutting off the
extension (".asc" or ".sig") of @code{sigfile} or by asking the
user for the filename.
@end table


@c *******************************************
@c ***************            ****************
@c ***************  USER ID   ****************
@c ***************            ****************
@c *******************************************
@mansect how to specify a user id
@ifset isman
@include specify-user-id.texi
@end ifset

@mansect return value
@chapheading RETURN VALUE

The program returns 0 if everything was fine, 1 if at least
a signature was bad, and other error codes for fatal errors.

@mansect warnings
@chapheading WARNINGS

Use a *good* password for your user account and a *good* passphrase
to protect your secret key. This passphrase is the weakest part of the
whole system. Programs to do dictionary attacks on your secret keyring
are very easy to write and so you should protect your "~/.gnupg/"
directory very well.

Keep in mind that, if this program is used over a network (telnet), it
is *very* easy to spy out your passphrase!

If you are going to verify detached signatures, make sure that the
program knows about it; either give both filenames on the command line
or use @samp{-} to specify STDIN.

@mansect interoperability
@chapheading INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS

GnuPG tries to be a very flexible implementation of the OpenPGP
standard. In particular, GnuPG implements many of the optional parts
of the standard, such as the SHA-512 hash, and the ZLIB and BZIP2
compression algorithms. It is important to be aware that not all
OpenPGP programs implement these optional algorithms and that by
forcing their use via the @option{--cipher-algo},
@option{--digest-algo}, @option{--cert-digest-algo}, or
@option{--compress-algo} options in GnuPG, it is possible to create a
perfectly valid OpenPGP message, but one that cannot be read by the
intended recipient.

There are dozens of variations of OpenPGP programs available, and each
supports a slightly different subset of these optional algorithms.
For example, until recently, no (unhacked) version of PGP supported
the BLOWFISH cipher algorithm. A message using BLOWFISH simply could
not be read by a PGP user. By default, GnuPG uses the standard
OpenPGP preferences system that will always do the right thing and
create messages that are usable by all recipients, regardless of which
OpenPGP program they use. Only override this safe default if you
really know what you are doing.

If you absolutely must override the safe default, or if the preferences
on a given key are invalid for some reason, you are far better off using
the @option{--pgp6}, @option{--pgp7}, or @option{--pgp8} options. These
options are safe as they do not force any particular algorithms in
violation of OpenPGP, but rather reduce the available algorithms to a
"PGP-safe" list.

@mansect bugs
@chapheading BUGS

On older systems this program should be installed as setuid(root). This
is necessary to lock memory pages. Locking memory pages prevents the
operating system from writing memory pages (which may contain
passphrases or other sensitive material) to disk. If you get no
warning message about insecure memory your operating system supports
locking without being root. The program drops root privileges as soon
as locked memory is allocated.

Note also that some systems (especially laptops) have the ability to
``suspend to disk'' (also known as ``safe sleep'' or ``hibernate'').
This writes all memory to disk before going into a low power or even
powered off mode.  Unless measures are taken in the operating system
to protect the saved memory, passphrases or other sensitive material
may be recoverable from it later.

Before you report a bug you should first search the mailing list
archives for similar problems and second check whether such a bug has
already been reported to our bug tracker at http://bugs.gnupg.org .

@c *******************************************
@c ***************              **************
@c ***************  UNATTENDED  **************
@c ***************              **************
@c *******************************************
@manpause
@node Unattended Usage of GPG
@section Unattended Usage

@command{gpg} is often used as a backend engine by other software.  To help
with this a machine interface has been defined to have an unambiguous
way to do this.  The options @option{--status-fd} and @option{--batch}
are almost always required for this.

@menu
* Unattended GPG key generation::  Unattended key generation
@end menu


@node Unattended GPG key generation
@subsection Unattended key generation

The command @option{--gen-key} may be used along with the option
@option{--batch} for unattended key generation.  The parameters are
either read from stdin or given as a file on the command line.
The format of the parameter file is as follows:

@itemize @bullet
  @item Text only, line length is limited to about 1000 characters.
  @item UTF-8 encoding must be used to specify non-ASCII characters.
  @item Empty lines are ignored.
  @item Leading and trailing while space is ignored.
  @item A hash sign as the first non white space character indicates
  a comment line.
  @item Control statements are indicated by a leading percent sign, the
  arguments are separated by white space from the keyword.
  @item Parameters are specified by a keyword, followed by a colon.  Arguments
  are separated by white space.
  @item
  The first parameter must be @samp{Key-Type}; control statements may be
  placed anywhere.
  @item
  The order of the parameters does not matter except for @samp{Key-Type}
  which must be the first parameter.  The parameters are only used for
  the generated keyblock (primary and subkeys); parameters from previous
  sets are not used.  Some syntactically checks may be performed.
  @item
  Key generation takes place when either the end of the parameter file
  is reached, the next @samp{Key-Type} parameter is encountered or at the
  control statement @samp{%commit} is encountered.
@end itemize

@noindent
Control statements:

@table @asis

@item %echo @var{text}
Print @var{text} as diagnostic.

@item %dry-run
Suppress actual key generation (useful for syntax checking).

@item %commit
Perform the key generation.  Note that an implicit commit is done at
the next @asis{Key-Type} parameter.

@item %pubring @var{filename}
@itemx %secring @var{filename}
Do not write the key to the default or commandline given keyring but
to @var{filename}.  This must be given before the first commit to take
place, duplicate specification of the same filename is ignored, the
last filename before a commit is used.  The filename is used until a
new filename is used (at commit points) and all keys are written to
that file. If a new filename is given, this file is created (and
overwrites an existing one).  For GnuPG versions prior to 2.1, both
control statements must be given. For GnuPG 2.1 and later
@samp{%secring} is a no-op.

@item %ask-passphrase
@itemx %no-ask-passphrase
Enable (or disable) a mode where the command @option{passphrase} is
ignored and instead the usual passphrase dialog is used.  This does
not make sense for batch key generation; however the unattended key
generation feature is also used by GUIs and this feature relinquishes
the GUI from implementing its own passphrase entry code.  These are
global control statements and affect all future key genrations.

@item %no-protection
Since GnuPG version 2.1 it is not anymore possible to specify a
passphrase for unattended key generation.  The passphrase command is
simply ignored and @samp{%ask-passpharse} is thus implicitly enabled.
Using this option allows the creation of keys without any passphrase
protection.  This option is mainly intended for regression tests.

@item %transient-key
If given the keys are created using a faster and a somewhat less
secure random number generator.  This option may be used for keys
which are only used for a short time and do not require full
cryptographic strength.  It takes only effect if used together with
the control statement @samp{%no-protection}.

@end table

@noindent
General Parameters:

@table @asis

@item Key-Type: @var{algo}
Starts a new parameter block by giving the type of the primary
key. The algorithm must be capable of signing.  This is a required
parameter.  @var{algo} may either be an OpenPGP algorithm number or a
string with the algorithm name.  The special value @samp{default} may
be used for @var{algo} to create the default key type; in this case a
@samp{Key-Usage} shall not be given and @samp{default} also be used
for @samp{Subkey-Type}.

@item Key-Length: @var{nbits}
The requested length of the generated key in bits.  The default is
returned by running the command @samp{gpg2 --gpgconf-list}.

@item Key-Grip: @var{hexstring}
This is optional and used to generate a CSR or certificate for an
already existing key.  Key-Length will be ignored when given.

@item Key-Usage: @var{usage-list}
Space or comma delimited list of key usages.  Allowed values are
@samp{encrypt}, @samp{sign}, and @samp{auth}.  This is used to
generate the key flags.  Please make sure that the algorithm is
capable of this usage.  Note that OpenPGP requires that all primary
keys are capable of certification, so no matter what usage is given
here, the @samp{cert} flag will be on.  If no @samp{Key-Usage} is
specified and the @samp{Key-Type} is not @samp{default}, all allowed
usages for that particular algorithm are used; if it is not given but
@samp{default} is used the usage will be @samp{sign}.

@item Subkey-Type: @var{algo}
This generates a secondary key (subkey).  Currently only one subkey
can be handled.  See also @samp{Key-Type} above.

@item Subkey-Length: @var{nbits}
Length of the secondary key (subkey) in bits.  The default is returned
by running the command @samp{gpg2 --gpgconf-list}".

@item Subkey-Usage: @var{usage-list}
Key usage lists for a subkey; similar to @samp{Key-Usage}.

@item Passphrase: @var{string}
If you want to specify a passphrase for the secret key,
enter it here.	Default is not to use any passphrase.

@item Name-Real: @var{name}
@itemx Name-Comment: @var{comment}
@itemx Name-Email: @var{email}
The three parts of a user name.  Remember to use UTF-8 encoding here.
If you don't give any of them, no user ID is created.

@item Expire-Date: @var{iso-date}|(@var{number}[d|w|m|y])
Set the expiration date for the key (and the subkey).  It may either
be entered in ISO date format (e.g. "20000815T145012") or as number of
days, weeks, month or years after the creation date.  The special
notation "seconds=N" is also allowed to specify a number of seconds
since creation.  Without a letter days are assumed.  Note that there
is no check done on the overflow of the type used by OpenPGP for
timestamps.  Thus you better make sure that the given value make
sense.  Although OpenPGP works with time intervals, GnuPG uses an
absolute value internally and thus the last year we can represent is
2105.

@item  Creation-Date: @var{iso-date}
Set the creation date of the key as stored in the key information and
which is also part of the fingerprint calculation.  Either a date like
"1986-04-26" or a full timestamp like "19860426T042640" may be used.
The time is considered to be UTC.  The special notation "seconds=N"
may be used to directly specify a the number of seconds since Epoch
(Unix time).  If it is not given the current time is used.

@item Preferences: @var{string}
Set the cipher, hash, and compression preference values for this key.
This expects the same type of string as the sub-command @samp{setpref}
in the @option{--edit-key} menu.

@item  Revoker: @var{algo}:@var{fpr} [sensitive]
Add a designated revoker to the generated key.  Algo is the public key
algorithm of the designated revoker (i.e. RSA=1, DSA=17, etc.)
@var{fpr} is the fingerprint of the designated revoker.  The optional
@samp{sensitive} flag marks the designated revoker as sensitive
information.  Only v4 keys may be designated revokers.

@item Keyserver: @var{string}
This is an optional parameter that specifies the preferred keyserver
URL for the key.

@item Handle: @var{string}
This is an optional parameter only used with the status lines
KEY_CREATED and KEY_NOT_CREATED.  @var{string} may be up to 100
characters and should not contain spaces.  It is useful for batch key
generation to associate a key parameter block with a status line.

@end table

@noindent
Here is an example on how to create a key:
@smallexample
$ cat >foo <<EOF
     %echo Generating a basic OpenPGP key
     Key-Type: DSA
     Key-Length: 1024
     Subkey-Type: ELG-E
     Subkey-Length: 1024
     Name-Real: Joe Tester
     Name-Comment: with stupid passphrase
     Name-Email: joe@@foo.bar
     Expire-Date: 0
     Passphrase: abc
     %pubring foo.pub
     %secring foo.sec
     # Do a commit here, so that we can later print "done" :-)
     %commit
     %echo done
EOF
$ gpg2 --batch --gen-key foo
 [...]
$ gpg2 --no-default-keyring --secret-keyring ./foo.sec \
       --keyring ./foo.pub --list-secret-keys
/home/wk/work/gnupg-stable/scratch/foo.sec
------------------------------------------
sec  1024D/915A878D 2000-03-09 Joe Tester (with stupid passphrase) <joe@@foo.bar>
ssb  1024g/8F70E2C0 2000-03-09
@end smallexample


@noindent
If you want to create a key with the default algorithms you would use
these parameters:
@smallexample
     %echo Generating a default key
     Key-Type: default
     Subkey-Type: default
     Name-Real: Joe Tester
     Name-Comment: with stupid passphrase
     Name-Email: joe@@foo.bar
     Expire-Date: 0
     Passphrase: abc
     %pubring foo.pub
     %secring foo.sec
     # Do a commit here, so that we can later print "done" :-)
     %commit
     %echo done
@end smallexample




@mansect see also
@ifset isman
@command{gpgv}(1),
@end ifset
@include see-also-note.texi