diff options
Diffstat (limited to 'src/content/docs/guides/text-operations.md')
| -rw-r--r-- | src/content/docs/guides/text-operations.md | 200 |
1 files changed, 170 insertions, 30 deletions
diff --git a/src/content/docs/guides/text-operations.md b/src/content/docs/guides/text-operations.md index abf63b5..df3a042 100644 --- a/src/content/docs/guides/text-operations.md +++ b/src/content/docs/guides/text-operations.md @@ -24,25 +24,67 @@ So before you begin, [make your own key pair](/guides/generate-key/) and swap public keys with the people you write to. You encrypt with their public key; they decrypt with their private key. +## Find the Buttons + +Every task on this page works on the text in the current **Text Editor** tab. +You can start each task in three ways. They all do the same thing: + +| Task | Toolbar button | **Operations** menu | Shortcut | +| ------------------ | -------------------------------- | -------------------- | ------------ | +| Encrypt | **Encrypt** | **Encrypt** | Ctrl+E | +| Encrypt and sign | in the **Encrypt** button's list | **Encrypt & Sign** | Ctrl+Shift+E | +| Decrypt | **Decrypt** | **Decrypt** | Ctrl+D | +| Decrypt and verify | in the **Decrypt** button's list | **Decrypt & Verify** | Ctrl+Shift+D | +| Sign | **Sign** | **Sign** | Ctrl+Shift+I | +| Verify | **Verify** | **Verify** | Ctrl+Shift+V | + +On macOS, press Cmd instead of Ctrl. + +To see a button's list, right-click the button, or press and hold it. See +[Buttons With More Than One Action](/guides/understand-interface/#buttons-with-more-than-one-action). + +To pick a key, tick the box in front of it in the **Key ToolBox**, the key list +on the right side of the main window. + ## Encrypt Text -To hide a message so only one person can read it, encrypt it with **their public -key**. Only their private key can open it. +Encrypting hides a message so that only the person you write to can read it. +You need **their public key** in your key list. -This way: +1. **Open a text tab.** Click **File**, then **Workspace**, then + **New Text Editor** (or press Ctrl+N). A new, empty tab opens. +2. **Write your message.** Type it, or paste it in. +3. **Pick the recipient.** In the **Key ToolBox**, tick the box in front of the + person's public key. To send to several people, tick each of their keys. +4. **Click Encrypt.** Or press Ctrl+E. +5. **Answer any questions.** GpgFrontend may stop to check your recipients, for + example when a key has expired. See [Checks Before Encrypting](#checks-before-encrypting). +6. **See the result.** The text in the tab is replaced by a block that starts + with `-----BEGIN PGP MESSAGE-----`. The **Status Panel** at the bottom shows + whether it worked. +7. **Send it.** Copy the whole block, from the `BEGIN` line to the `END` line, + and paste it into your email or chat. Or save it with **File**, **Save**. -- The result is short. -- It does **not** reveal who sent it, which is good when you want to stay - anonymous. +![][img-2] + +:::caution + +If you tick **no key at all** and click **Encrypt**, GpgFrontend does not stop. +It asks you for a password instead and encrypts with that. This is called +[symmetric encryption](/guides/symmetric-encrypt-decrypt/). If you meant to +encrypt for a person, click **Cancel** and tick their key first. + +::: :::tip -Don't encrypt with your own public key unless the message is meant for you. Use -the recipient's public key, or only you will be able to read it. +Tick your **own** key too if you want to be able to read the message later. +Without it, only the recipient can open it, not you. ::: -![][img-2] +The encrypted message does not show who sent it. If you also want to prove that +it came from you, use [Encrypt and Sign](#encrypt-and-sign-at-once). ### If You Are Asked to Pick a Subkey @@ -68,45 +110,143 @@ more than one person. See [Encryption Safety](/guides/encryption-safety/). ## Decrypt Text -To read an encrypted message sent to you, paste or load the ciphertext into -GpgFrontend. The tool then: - -- Picks the correct **private key** for you. -- Tells you if it can't find a matching key. +Decrypting turns an encrypted message sent to you back into readable text. You +need **your private key**, the one that matches the public key the sender used. -You don't need to choose a key by hand. GpgFrontend matches it for you. +1. **Open a text tab.** Click **File**, then **Workspace**, then + **New Text Editor** (or press Ctrl+N). +2. **Paste the message.** Paste the whole block, including the + `-----BEGIN PGP MESSAGE-----` and `-----END PGP MESSAGE-----` lines. +3. **Click Decrypt.** Or press Ctrl+D. You do **not** need to tick any key. + GpgFrontend finds the right private key by itself. +4. **Enter your passphrase.** A window asks for the passphrase that protects + your private key. Type it and confirm. +5. **Read the message.** The block in the tab is replaced by the readable text. + The **Status Panel** shows whether it worked. ![][img-3] -## Sign Text +If it fails, the **Status Panel** turns red and says why. The most common +reasons: + +- **You don't have the right private key.** The message was encrypted for + someone else, or for a key you no longer have. +- **Part of the block is missing.** Copy the message again, from the very first + `-----BEGIN` line to the very last `-----END` line. +- **The message was changed on the way.** GpgFrontend will not show text it + cannot trust. See [Encryption Safety](/guides/encryption-safety/). + +:::note + +If the message was also signed, the plain **Decrypt** does not check the +signature. Use [Decrypt and Verify](#decrypt-and-verify-at-once) instead. -To prove a message came from you, sign it with **your private key**. The text stays -readable; signing adds proof, not secrecy. +::: + +## Sign Text -- It confirms you wrote it. -- Anyone with your public key can check it. +Signing proves that a message came from you and that nobody changed it. It does +**not** hide the message: anyone can still read it. You need **your private +key**. -Before you sign, look at the key's `Usage` column for an `S`, which means the key -can sign. +1. **Open a text tab** and write your message. +2. **Pick your key.** In the **Key ToolBox**, tick the box in front of **your + own** key. Pick a key that can sign: its **Usage** column shows an `S`. +3. **Click Sign.** Or press Ctrl+Shift+I. +4. **Choose a key, if asked.** If you ticked no key that can sign, or your key + has more than one signing subkey, a window called **Select Signing Key(s)** + opens. Tick the key or subkey to use and click **Confirm**. +5. **Enter your passphrase.** Type the passphrase of your private key. +6. **See the result.** Your text now sits between two lines: + `-----BEGIN PGP SIGNED MESSAGE-----` at the top and a + `-----BEGIN PGP SIGNATURE-----` block at the bottom. Your message stays + readable in the middle. +7. **Send it.** Copy everything, from the first `-----BEGIN` line to the last + `-----END` line, and send it. ![][img-4] +:::caution + +After signing, do not change anything in the text, not even a space or an empty +line. Any change, however small, makes the signature fail. + +::: + ## Verify a Signature -To check that a signed message is genuine, use the **sender's public key**. Paste -or load the signed message, and GpgFrontend will: +Verifying checks that a signed message really came from the person it claims, +and that nobody changed it. You need **the sender's public key** in your key +list. -- Check that the message wasn't changed. -- Report any mismatch or a missing public key. +1. **Open a text tab.** Click **File**, then **Workspace**, then + **New Text Editor** (or press Ctrl+N). +2. **Paste the signed message.** Paste all of it, from + `-----BEGIN PGP SIGNED MESSAGE-----` down to `-----END PGP SIGNATURE-----`. +3. **Click Verify.** Or press Ctrl+Shift+V. You do not need to tick any key. +4. **Read the result in the Status Panel.** + - **Green**: the signature is good. The message is unchanged and was signed + by the key shown. + - **Orange**: the signature is good, but there is something to check, for + example a key you have not marked as trusted. + - **Red**: the signature is bad. The message was changed, or it was not + signed by that key. Do not trust it. -:::note +The text in the tab is not changed when you verify. + +![][img-5] + +### If the Sender's Key Is Missing + +If you don't have the sender's public key, a window called **Missing Keys** +opens. It lists the fingerprints of the missing keys and asks whether to fetch +them from the key server. + +- Click **Yes** to search the key server for the key. +- Click **No** to stop. You can + [import the key](/guides/import-export-key-pair/) yourself and verify again. -If you don't have the sender's public key yet, GpgFrontend asks you to import it -first. +:::tip + +Check the name and fingerprint shown in the result against what you know about +the sender. A good signature only proves the message matches **that** key. It +does not prove the key belongs to the person you think. ::: -![][img-5] +## Encrypt and Sign at Once + +This makes a message that is both **secret** and **proven to be from you**. It is +the best choice for private messages. + +1. **Open a text tab** and write your message. +2. **Pick the recipient.** Tick the box in front of the recipient's public key + in the **Key ToolBox**. +3. **Start it.** Open the **Operations** menu and choose **Encrypt & Sign**, or + press Ctrl+Shift+E. On the toolbar, it is in the **Encrypt** button's list. +4. **Choose your signing key.** The **Select Signing Key(s)** window always + opens here. Tick **your own** key and click **Confirm**. +5. **Enter your passphrase.** +6. **See the result.** The text becomes a `-----BEGIN PGP MESSAGE-----` block, + just like normal encryption. The signature is hidden inside it. + +Unlike plain **Encrypt**, this one needs at least one ticked recipient key. + +## Decrypt and Verify at Once + +Use this when you receive a message that was encrypted **and** signed. + +1. **Paste the message** into a text tab. +2. **Start it.** Open the **Operations** menu and choose **Decrypt & Verify**, + or press Ctrl+Shift+D. On the toolbar, it is in the **Decrypt** button's + list. +3. **Enter your passphrase.** +4. **Read the result.** The readable text appears in the tab. The **Status + Panel** shows both results: whether decryption worked, and whether the + signature is good. + +If the sender's public key is missing, the same **Missing Keys** window opens as +when you [verify](#if-the-senders-key-is-missing). ## Your Text Is Kept Exactly as Typed |