Subject: Re: PGP & PINE solution

From: [email-masked] (J. Kelly Cunningham)
Date: 31 Oct 94 07:43:26 CST

In article <[email-masked]>,
Michael Lawless <[email-masked]> wrote:
>This was sent to me regarding PGP and Pine.  I set it up as per the 
> directions,
>and it work's like a charm.  I take no credit for this, just reposting it.
>

Here's the readme for a csh script I work on from time to time.  Send 
your public key to 
			[email-masked]
if you want it...

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<

(1) Extract and install mkpgp.

At your Unix prompt, run the command:

   uudecode NameOfTheFileYouArePresentlyReading

An executable script, mkpgp, will be extracted.  Move the
the script into a directory on your path.  One such directory is
usually "bin" in your home directory.  Examine the leading names of 
your path variable (echo $path) if you are unsure.  In the unlikely 
event that you don't have access to a directory for executables, 
see * below.

Run the Unix command:

   rehash

*or* logout and login.  Either of these will make your system
"aware" of the new command "mkpgp."

(2) Configure Pine for mkpgp.

Set the alternate editor to mkpgp:

# Editor to use in place of Pine's internal composer, Pico
editor=mkpgp

	* Or use an absolute path. E.g., editor=/yourHomeDir/mkpgp

Force Pine to put your signature at the bottom:

# Use old style forward/reply with new text and signature below included text
# Old-style-reply is obsolete, use signature-at-bottom in feature-list
old-style-reply=yes
[...]
# The feature-list that is in effect when you are running Pine
[...]
# of the features is no-, that is, off.
feature-list=old-growth,
        signature-at-bottom

(3) Set the environment variable "PGPPATH" in a login file.

Put a line like:
	setenv PGPPATH ~/.pgp
in .cshrc if you use c-shell.

(4) Run and configure mkpgp.

This part can be done from the command line or Pine.

The first time you run mkpgp it will create $PGPPATH/mkpgprc, and $PGPPATH/tmp.
You are immediately given a chance to edit $PGPPATH/mkpgprc. Set the variables
to your liking.  Clearly, the environment variable "PGPPATH" must be defined 
before you can run mkpgp.  mkpgp comes to a screeching halt if it is not set.

Default mkpgprc:

#
# Configuration file for mkpgp.
#
# Set the real alternate editor. Pine 3.9.x users, see IMPLICITALTEDIT.
#
set MKPGPEDITOR = none
#
# Does Pine use the alternate editor implicitly?  Unless you change 
# MKPGPEDITOR to something other than "none" when IMPLICITALTEDIT = yes,
# mkpgp will try to use "pico -z -t".  I can only hope that you have it...
#
set IMPLICITALTEDIT = no                  # (no/yes)
#
# When IMPLICITALTEDIT = yes and Pine is configured to include-header-in-reply,
# mkpgp can try to pick the right keyid (e-mail address) from the "From:" line.
# Whatever it finds is presented as the default recipient id instead of "none".
# Entering other keys will replace the default. Entering + will let you add to 
# the default.  Entering - will delete the default so that the message is not
# encrypted. See "Replacement lists" below.
# 
set AUTORECRYPT = no                      # (no/yes)
#
# Ask to encrypt the message. yes = ask with a default of yes, no = ask 
# with a default of no, quiet = don't ask, just run. 
#
set ASKTORUN = quiet                      # (quiet/no/yes)
#
# Show pubring before asking for encryption keys.
#
set SHOWPUBRING = yes                     # (yes/no)
#
# Secret keyring shown by mkpgp.
#
set MKPGPSECRING = $PGPPATH/secring.pgp
#
# Show secring before signing.
#
set SHOWSECRING = yes                     # (yes/no)
#
# Signature file shared by mkpgp & pine.
#
set SIGFILE = ~/.signature
#
# Number of seconds to pause.
#
set PAUSE = 5
#
# Determine if sender can read encrypted messages. 
#
set ENCRYPTTOSELF = on                    # (on/off)
#
# Circumvent version 2.6.[1] legal kluge. When set to yes, mkpgp uses the pgp2.6
# options: "+ce=0 +le" to create cyphertext readable by earlier versions.  When
# set to no, it is ignored by all versions of pgp. 
#
set LEGALKLUGE = no
#
# Warn sender about MIME attachments and signed cleartext.  Since mkpgp can
# only encrypt the message text, MIME attachments aren't encrypted.  mkpgp 
# can include attachments in the message text for encryption. 
#
set WARNUSER = yes                        # (yes/no)
#
# Shell to start when looking at attachments. 
#
set MKPGPSHELL = /bin/csh
#
# Your "make path" command. NeXT: mkdirs. HP, SCO, DG & Sun: "mkdir -p".
#
set MKDIRS = /bin/mkdirs
#
# Quote characters used by pine must be stripped before decryption, and
# replaced afterward.  There seems to be some variation, so this may need
# some tuning.
#
set QUOTECHAR = "> "
#
# Replacement lists. If IMPLICITALTEDIT = yes and AUTORECRYPT = yes, you
# can automatically replace a key (e-mail address) with other keys.
# Below is an example that replaces [email-masked]
# with [email-masked] and kelly@home.  Be sure to place such lists
# behind a "#" with the first word against the "#".  Do not include the < >.
#
[email-masked] [email-masked] kelly@home
#

(If you use Pine v3.9.x, 
 
		[X]  enable-alternate-editor-implicitly
                [X]  include-header-in-reply 
		[X]  include-text-in-reply

with

set IMPLICITALTEDIT = yes
set ASKTORUN = no
set AUTORECRYPT = yes 

in mkpgprc is pretty slick.  mkpgp runs between Pine and your editor to 
decrypt the message. On exiting the editor, mkpgp asks to run again (with 
"no" as the default) to re-encrypt the message.  It's almost seamless.)

(4) Usage.

My first axiom: I detest pecking on keyboards...

==========
Encryption
==========

If you use the defaults:

Compose a message then invoke the alternate editor. mkpgp will ask:

	Include encrypted attachment(s)? [n]
	
At every prompt, simply hit the <return> key if you want what's in [].  
(This can be important; don't give mkpgp needless input. Remember my first
axiom.)

Enter y and hit <return> if you want to include attachments in the message
text (thereby encrypting them).  A primitive browser will let you navigate
the file system to attach files and dirs.  You select attachments by number.  
Hit <return> on a blank line to move up one directory.  Selecting a
single directory is ambiguous (since you are navigating the directories
with the same browser), so you are further prompted to
"Enter or Attach? [e]" it.  Hit <return> to enter, enter "a" and hit 
<return> to attach it. If a directory is a member of a list, mkpgp attaches 
it is.  After collecting all the attachments, enter f and hit <return>. 
$PGPPATH/tmp/mkpgpAttach is listed and you are  a given a chance change it.
If you elect to do so, mkpgp will cd to $PGPPATH/tmp/mkpgpAttach and start a
shell. Do what you will, and use "exit" or <control> d to exit and return to
mkpgp.

mkpgp copies attachments into $PGPPATH/tmp/mkpgpAttach.  When you exit the 
browser, $PGPPATH/tmp/mkpgpAttach is tar'ed, compress, uuencoded and 
appended to the message text as ascii. $PGPPATH/tmp/mkpgpAttach is then 
removed (*not* wiped and deleted).

Next, pgp will show a public key ring and mkpgp will ask:

	Enter recipient key id(s) [none].

List the recipient key id(s) separated by blanks, or hit <return> if you 
don't want to encrypt the message.

Next, pgp will show $PGPPATH/secring.pgp secret key ring and mkpgp will ask:

	Sign the message with which secret key? [n]

y <return> selects the key defined by MyName in $PGPPATH/config.txt.  You can 
select an alternate by giving a keyid (If you enter n, mkpgp will look for a 
key with n in it. Bad news...  Remember my first axiom.  Also, beware of the 
ENCRYPTTOSELF option if you select an alternate key.)

If you elect to sign the message, pgp will request a pass phrase. pgp goes
to work on the message. There is a 5 second delay when pgp is finished so you can 
see what happened.  After that you should be looking at the message in the Pine 
window. Send it.  If ENCRYPTTOSELF=on, you can decrypt the copy of the message in 
sent-mail.  If ENCRYPTTOSELF=off and you didn't include yourself as a recipient,
you might as well delete it.

The actual pgp command options used by mkpgp are:

pgp -setw $LEGALKLUGE +encrypttoself=$ENCRYPTTOSELF +armor=on +keepbinary=off\
+armorlines=0 +tmp=$PGPPATH/tmp $1 $keys $sign

pgp -satw $LEGALKLUGE +clearsig=on +keepbinary=off +tmp=$PGPPATH/tmp $1 $sign

pgp -etw $LEGALKLUGE +pubring=$MKPGPPUBRING +encrypttoself=$ENCRYPTTOSELF\ 
+armor=on +keepbinary=off +armorlines=0 +tmp=$PGPPATH/tmp $1 $keys

$1 is /tmp/pico.xxxx, $keys is the list of keys, $sign is the key id used 
to sign the message.  If  LEGALKLUGE = yes in $PGPPATH/mkpgprc then LEGALKLUGE 
is reset  to "+ce=0 +le" and mkpgp exploits a bug in pgp2.6[.1] that creates 
cyphertext readable by 2.3a.  If LEGALKLUGE = no in $PGPPATH/mkpgprc, then
LEGALKLUGE is reset to " " (thus ignored).  There are several other calls to 
pgp to wipe and delete temporary files.

==========
Decryption
==========

The only way to decrypt using mkpgp is in a reply or forward since that is your
only access to the alternate editor.

If mkpgp finds a line beginning with one of the the strings:

                    -----BEGIN PGP MESSAGE-----
                    > -----BEGIN PGP MESSAGE-----
                    -----BEGIN PGP SIGNED MESSAGE-----
                    > -----BEGIN PGP SIGNED MESSAGE----- 
                    -----BEGIN PGP PUBLIC KEY BLOCK-----
                    > -----BEGIN PGP PUBLIC KEY BLOCK-----

it will strip the leading "> " and run the command:

	pgp +force +interactive=on +keepbinary=off 

attempting to mimic the forward/reply behavior of Pine.  

If, along the way, a line beginning with:

                  begin 600 mkpgpAttach.tar.Z

is found in the message text, mkpgp will list the attachments and 
ask to unpack them.  You you choose to do so,  the mkpgpAttach directory 
is moved into $PGPPATH (renaming if needed).  The mkpgpAttach.tar.Z file 
is wiped & deleted. You are given a chance to examine/delete the attachments
(exit as before).

-- kc