On Saturday 12 November 2005 11:19 am, Daniel Widenfalk wrote: > I have, and use, PGP 8.1 from PGP Corporation and have a key(s) > there which I use to encrypt and/or sign email with. Can I use > this key in the debian project, or do I have to create a new > GPG key? 1. Create a temporary gnupg key (don't send the temporary one to keyservers) and try to sign your PGP key. (You can delete the signature later as long as you don't send your PGP key to a keyserver in the meantime.) This tests whether other DD's can sign your key using gnupg. 2. Does your key already meet the requirement of being signed by a DD? If it doesn't and test 1 fails, you would be better off with a new key - a gnupg key. If test 1 does fail but you have a signature already, ask on gnupg-users about what is wrong in your PGP key and how to fix it. > I saw somewhere that PGP keys are depreciated as PGP uses > algorithms that are not DSFG-free. Specifically, IDEA. I can't help without the keyID and some of your questions may be better answered on the gnupg-users mailing list. There's no problem with having more than one key - as long as the one you use for Debian work is signed by a current DD. (e.g. I have two gnupg keys.) > However, are not the keys > themselves just a private/public key-pairs which should be > usable together with GPG? You may have to remove encrypting / signing subkeys that use IDEA. A simple way to find this out is to import your PGP public and private key into GnuPG. Then create a test message in PGP that is encrypted to your own key (only) and try to decrypt that in GnuPG. It may just be a case of changing the algorithm preferences in your PGP setup and re-exporting the key. Then repeat the process encrypting using GnuPG and decrypting in PGP. > I would really like to be able to > reuse my PGP key in the debian project. Can I use some sort > of conversion tool to create a GPG-keyfile from my PGP-key? GnuPG, by default, is DSFG compliant because it supports the OpenPGP standard without using IDEA. If GnuPG can use the key without the non-DSFG compliant IDEA plugin, then you shouldn't have problems. Many PGP keys can be used in gnupg, it comes down to whether you need to retain support for the non-free IDEA. > I know that I can decrypt/verify files encrypted/signed with > GPG using my installed PGP, is the inverse is true? You'll have to try it and find out. "GnuPG and newer PGP releases should be implementing the OpenPGP standard. But there are some interoperability problems" http://www.gnupg.org/(en)/documentation/faqs.html#q1.2 The same FAQ has plenty of solutions for those interoperability problems. -- Neil Williams ============= http://www.data-freedom.org/ http://www.nosoftwarepatents.com/ http://www.linux.codehelp.co.uk/
Attachment:
pgpAWrUyHUYyG.pgp
Description: PGP signature