-----BEGIN PGP SIGNED MESSAGE-----


      Hints for newcomers to PGP, and new users of the RISC OS version
      ================================================================



I.   What's in this distribution?
II.  How do I install it?
III. How do I use it?
IV.  I'm confused. Help!
V.   How do I change it?



I. What's in this distribution?
   ----------------------------

Here's a brief "roadmap" of this distribution. You probably just want to
skim it for the moment.

  !Changes
  !Hints
  !ReadMe
    information files added by me, specifically describing this version
    of PGP. Read this (!Hints) and !ReadMe first. !Changes is a list
    of every change I made to the usual 2.6.2i distribution.

  asc.keys
    a load of public keys of various people. This (or something like it)
    is distributed with every version of PGP. I haven't changed it.

  config/txt
    a configuration file. This is somewhere between a default one and a
    sample one. You should certainly edit it to suit you, once you know
    where it should go and what to put in it.

  contrib
    a directory containing other programs. I *haven't* ported these.

  doc
    a directory containing documentation. Here's information about some,
    but not all, of it:

      doc.!ReadMe
        explains that I've munged the filenames a bit

      doc.pgpdoc1/t
      doc.pgpdoc2/t
        contain the main documentation for PGP. You should read pgpdoc1
        soon, and pgpdoc2 when you feel like it.

  en/hlp
  es/hlp
  fr/hlp
  no/hlp
    are language-specific help files for English, Espaol, Franais, Norsk.
    Actually the Spanish one is Castilian Spanish (Castellano). I don't know
    how different from "normal" Spanish this is.

  key/asc
    is my PGP public key.

  lang/txt
    is a file that lets PGP translate almost all its messages into other
    languages. In this case, the ones mentioned above.

  pgp/asc
    is a signature for the PGP executable. If you already have a version
    of PGP and you trust my key, you can use this to check that it hasn't
    been fiddled with or corrupted during transfer.

  pgp/hlp
    is the usual help message that PGP displays if you invoke it as "pgp -h".

  readme/1st
    describes PGP 2.6.2i (but not the RISC OS version).

  setup/doc
    explains how to install PGP 2.6.2i on MS-DOS or Unix. Ignore it.

  src
    contains all the source code. If this is any use to you, I probably
    don't need to say anything more about it.



II. How do I install it?
    --------------------

1. (For the paranoid who already have a copy of PGP.)
    - Satisfy yourself that the key in key/asc is really mine.
    - Check the signatures on !Changes, !Hints and !ReadMe.
    - Check the detached signature in pgp/asc (it's for src.pgp).

2. Move the executable src.pgp to be somewhere on your run$path, unless
   you don't usually want to be able to use it.

3. Move or copy the following files to somewhere handy (or leave them
   where they are and remember where that is):
    - All the .../hlp files.
    - lang/txt.
    - The doc directory.

4. If you already have a PGP config file, compare it with config/txt in case
   there are incompatible changes or new things you want to do, and make
   any suitable edits. Make sure your config file is in the same place as
   the files you just copied.

5. If you don't already have a PGP config file, copy config/txt to the same
   place as those other files you just copied. When you know a bit more about
   PGP you'll want to change it; for now, don't bother.

6. Before using PGP you will need the system variable PGPPATH to contain
   the name of the directory in which you put all those files. (The text
   files, not the executable). Note: no trailing dot. I suggest you put
   this in your boot sequence.

You should now be ready to go, unless I've forgotten something.

If you have AMU, you can replace steps 2 and 3 by

2&3. Go into directory "src", and edit the Makefile so that
      - BINDIR is the directory in which to put the executable
      - LIBDIR is the directory in which to put those other files.
     Now type "amu install".



III. How do I use it?
     ----------------

Read the manual, in doc.pgpdoc1/t and (if you feel like it) doc.pgpdoc2/t.
It really is a good idea to read the manual before doing anything.

Done that? OK, now here are some hints on using this version.

1. Because of RISC OS's 10-character filename limit, you should really use
   only filenamess that are no longer than 6 characters without the extension,
   because PGP is likely to stick "/asc" or similar on.
   You *can* use longer names, but you may find PGP overwriting the input
   with the output (say) if the input and output filenames have the same
   first 10 characters. (It seems to do this without warning on encryption
   but warn on decryption. Strange.)

2. You might want to use something faster than your HD for temporary files.
   To do this, either set the system variable TMP to the name of a directory
   for them (say, on a RAM disc), or put a line like "TMP = RAM:$" in your
   config/txt. The value of the system variable overrides the config/txt
   setting.

3. There's a program called PGPwimp which gives a Wimp front end for PGP,
   so if you can't cope with command lines you might like to get that. It's
   on HENSA; if you can't get at that try mailing me and I can probably
   send you a copy.

4. Generating a 1024-bit key takes between 1 and 2 minutes on my machine,
   including the time it takes getting entropy from my keystrokes. The
   time varies according to how lucky it is when trying to find prime
   numbers. My machine's a Risc PC, so you should expect longer times
   on older machines.

5. You can usually get PGP to stop whatever it's doing by pressing Escape.
   It occasionally leaves temporary files around; look for things called
   (e.g.) foo/_01 . I think it's very careful not to leave things around
   that might compromise security.

6. If you run PGP in a task window, you might find its insistence on
   sending output through a pagewaiter annoying. If so, put a line
   pager = "type" in config/txt.



IV. I'm confused. Help!
    -------------------

Here are some attempts to clarify things that aren't made as clear as they
might be in the documentation. I don't guarantee that they actually help.

1. Signing people's keys.

     Signing someone's key means "I give my word that this key belongs to
     the person it claims to belong to".

     It does NOT mean "I think this person is reliable". They may be an
     axe-murderer, a paedophile and a terrorist; all you're saying is
     that the name/address in the key are really those of the person
     whose key it is.

     You should not rely on e-mail contact (person X mails you saying
     "Here's my key; please sign it" etc) for this. See them face to
     face, or talk to them on the phone if you know their voice well,
     and get them to tell you the fingerprint of their key. If this is
     right then you can be reasonably confident.

2. Trusting people.

     Telling PGP that you trust someone means "If this person declares
     that key X came from person Y, then I believe it". Again, it doesn't
     say anything about their moral character as such (though obviously
     that's of more relevance here).

     What you tell PGP about trusting people doesn't get exported. It
     won't give away your opinions.

... Anything else that ought to go in here?



V. How do I change it?
   -------------------

0. Make sure you can't get the effect you want by simply fiddling with
   the config file.

1. Read !Changes, so that you know what I've done already.

2. Hack around to your heart's content.

3. Change the function signon_msg() in src.c.pgp so that it's clear
   that this is not the same as the version I distribute. I suggest
   adding a line below the one that mentions my name, saying briefly
   what you've done.

4. Test the new version carefully.

5. If you think your changes are improvements, mail me and suggest that
   I incorporate them into future releases.



    -- Gareth McCaughan
       gjm11@pmms.cam.ac.uk


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAgUBL9b8HJDvH+iElM3dAQFLhQP9F7gu4Tq6B+dbGvmpfnWRU5kr90DJ2XTE
ptiXU3EI1vpSGmNIo3S+SCPWclg275D7sjHPjlLHAsSZ46Pa88YzV4e3BmC2ec9q
qbAnd97x/lD/nfriLaVSyi8WNnuf1uUeLuE4pKBrGQTRDUMzGzZvo6ebXrlQChhi
T2n9ycVpL8w=
=c6L/
-----END PGP SIGNATURE-----
