"!" indicates that the signature has been successfully verified, a "-"
denotes a bad signature and a "%" is used if an error occurred while
checking the signature (e.g. a non supported algorithm). Signatures
-where the public key is not availabale are not listed; to see their
+where the public key is not available are not listed; to see their
keyids the command @option{--list-sigs} can be used.
For each signature listed, there are several flags in between the
particular external methods as defined by @option{--auto-key-locate} may
be used to locate a key. Only public keys are listed.
+@item --show-keys
+@opindex show-keys
+This commands takes OpenPGP keys as input and prints information about
+them in the same way the command @option{--list-keys} does for locally
+stored key. In addition the list options @code{show-unusable-uids},
+@code{show-unusable-subkeys}, @code{show-notations} and
+@code{show-policy-urls} are also enabled. As usual for automated
+processing, this command should be combined with the option
+@option{--with-colons}.
+
@item --fingerprint
@opindex fingerprint
List all keys (or the specified ones) along with their
@end table
-@c *******************************************
-@c ******* KEY MANGEMENT COMMANDS **********
-@c *******************************************
+@c ********************************************
+@c ******* KEY MANAGEMENT COMMANDS **********
+@c ********************************************
@node OpenPGP Key Management
@subsection How to manage your keys
for it. To create a key without any protection @code{--passphrase ''}
may be used.
+Note that it is possible to create a primary key and a subkey using
+non-default algorithms by using ``default'' and changing the default
+parameters using the option @option{--default-new-key-algo}.
+
@item --quick-set-expire @var{fpr} @var{expire} [*|@var{subfprs}]
@opindex quick-set-expire
With two arguments given, directly set the expiration time of the
with the default key length; a string ``rsa4096'' requests that the
key length is 4096 bits. The string ``future-default'' is an alias
for the algorithm which will likely be used as default algorithm in
-future versions of gpg.
+future versions of gpg. To list the supported ECC curves the command
+@code{gpg --with-colons --list-config curve} can be used.
Depending on the given @var{algo} the subkey may either be an
encryption subkey or a signing subkey. If an algorithm is capable of
@opindex trust-model:auto
Select the trust model depending on whatever the internal trust
database says. This is the default model if such a database already
- exists.
+ exists. Note that a tofu trust model is not considered here and
+ must be enabled explicitly.
@end table
@item --auto-key-locate @var{mechanisms}
receiving side can check for transmission errors or tampering at the
end of each chunk and does not need to delay this until all data has
been received. The used chunk size is 2^@var{n} byte. The lowest
-allowed value for @var{n} is 6 (64 byte) and the largest is 62 (4
-EiB). The default value for @var{n} is 30 which creates chunks not
-larger than 1 GiB.
+allowed value for @var{n} is 6 (64 byte) and the largest is the
+default of 27 which creates chunks not larger than 128 MiB.
@item --input-size-hint @var{n}
@opindex input-size-hint
Show a listing of the key as imported right before it is stored.
This can be combined with the option @option{--dry-run} to only look
at keys; the option @option{show-only} is a shortcut for this
- combination. Note that suffixes like '#' for "sec" and "sbb" lines
+ combination. The command @option{--show-keys} is another shortcut
+ for this. Note that suffixes like '#' for "sec" and "sbb" lines
may or may not be printed.
@item import-export
on the keyring. This option is the same as running the @option{--edit-key}
command "clean" after import. Defaults to no.
+ @item import-drop-uids
+ Do not import any user ids or their binding signatures. This option
+ can be used to update only the subkeys or other non-user id related
+ information.
+
@item repair-keys. After import, fix various problems with the
keys. For example, this reorders signatures, and strips duplicate
signatures. Defaults to yes.
Boolean indicating whether a key or subkey is a secret one.
(drop-subkey)
+ @item usage
+ A string indicating the usage flags for the subkey, from the
+ sequence ``ecsa?''. For example, a subkey capable of just signing
+ and authentication would be an exact match for ``sa''. (drop-subkey)
+
@item sig_created
@itemx sig_created_d
The first is the timestamp a signature packet was created. The
running the @option{--edit-key} command "minimize" before export except
that the local copy of the key is not modified. Defaults to no.
+ @item export-drop-uids
+ Do no export any user id or attribute packets or their associates
+ signatures. Note that due to missing user ids the resulting output is
+ not strictly RFC-4880 compliant.
+
@item export-pka
Instead of outputting the key material output PKA records suitable
to put into DNS zone files. An ORIGIN line is printed before each
@item --force-aead
@opindex force-aead
Force the use of AEAD encryption over MDC encryption. AEAD is a
-modern and faster way to do authenticated encrytion than the old MDC
+modern and faster way to do authenticated encryption than the old MDC
method. See also options @option{--aead-algo} and
@option{--chunk-size}.
@opindex disable-mdc
These options are obsolete and have no effect since GnuPG 2.2.8. The
MDC is always used unless the keys indicate that an AEAD algorithm can
-be used in which case AEAD is used. But note: If the creation or of a
+be used in which case AEAD is used. But note: If the creation of a
legacy non-MDC message is exceptionally required, the option
@option{--rfc2440} allows for this.
@item --pgp7
@opindex pgp7
-Set up all options to be as PGP 7 compliant as possible. This allowd
+Set up all options to be as PGP 7 compliant as possible. This allowed
the ciphers IDEA, 3DES, CAST5,AES128, AES192, AES256, and TWOFISH.,
the hashes MD5, SHA1 and RIPEMD160, and the compression algorithms
none and ZIP. This option implies @option{--escape-from-lines} and
prints the current size. Note well: This is a maintainer only option
and may thus be changed or removed at any time without notice.
+@item --debug-allow-large-chunks
+@opindex debug-allow-large-chunks
+To facilitate in-memory decryption on the receiving site, the largest
+recommended chunk size is 128 MiB (@code{--chunk-size 27}). This
+option allows to specify a limit of up to 4 EiB (@code{--chunk-size
+62}) for experiments.
+
@item --faked-system-time @var{epoch}
@opindex faked-system-time
This option is only useful for testing; it sets the system time back or
meaningful when making a key signature (certification), and %c is only
meaningful when using the OpenPGP smartcard.
+@item --known-notation @var{name}
+@opindex known-notation
+Adds @var{name} to a list of known critical signature notations. The
+effect of this is that gpg will not mark a signature with a critical
+signature notation of that name as bad. Note that gpg already knows
+by default about a few critical signatures notation names.
+
@item --sig-policy-url @var{string}
@itemx --cert-policy-url @var{string}
@itemx --set-policy-url @var{string}
@opindex aead-algo
Specify that the AEAD algorithm @var{name} is to be used. This is
useful for symmetric encryption where no key preference are available
-to select the AEAD algorithm. Runing @command{@gpgname} with option
+to select the AEAD algorithm. Running @command{@gpgname} with option
@option{--version} shows the available AEAD algorithms. In general,
you do not want to use this option as it allows you to violate the
OpenPGP standard. The option @option{--personal-aead-preferences} is
@opindex override-session-key
Don't use the public key but the session key @var{string} respective
the session key taken from the first line read from file descriptor
-@var{fd}. The format of this string is the same as the one printed
-by @option{--show-session-key}. This option is normally not used but
+@var{fd}. The format of this string is the same as the one printed by
+@option{--show-session-key}. This option is normally not used but
comes handy in case someone forces you to reveal the content of an
encrypted message; using this option you can do this without handing
out the secret key. Note that using @option{--override-session-key}
may reveal the session key to all local users via the global process
-table.
+table. Often it is useful to combine this option with
+@option{--no-keyring}.
@item --ask-sig-expire
@itemx --no-ask-sig-expire
@opindex default-new-key-algo @var{string}
This option can be used to change the default algorithms for key
generation. The @var{string} is similar to the arguments required for
-the command @option{--quick-add-key} but slighly different. For
+the command @option{--quick-add-key} but slightly different. For
example the current default of @code{"rsa2048/cert,sign+rsa2048/encr"}
(or @code{"rsa3072"}) can be changed to the value of what we currently
call future default, which is @code{"ed25519/cert,sign+cv25519/encr"}.
@item --allow-multiple-messages
@item --no-allow-multiple-messages
-@opindex allow-multiple-messages
-Allow processing of multiple OpenPGP messages contained in a single file
-or stream. Some programs that call GPG are not prepared to deal with
-multiple messages being processed together, so this option defaults to
-no. Note that versions of GPG prior to 1.4.7 always allowed multiple
-messages.
-
-Warning: Do not use this option unless you need it as a temporary
-workaround!
-
+These are obsolete options; they have no more effect since GnuPG 2.2.8.
@item --enable-special-filenames
@opindex enable-special-filenames
@end table
+When calling the gpg-agent component @command{@gpgname} sends a set of
+environment variables to gpg-agent. The names of these variables can
+be listed using the command:
+
+@example
+ gpg-connect-agent 'getinfo std_env_names' /bye | awk '$1=="D" @{print $2@}'
+@end example
+
+
@c *******************************************
@c *************** ****************
projects / gnupg.git / blobdiff