Specifications

For a Windows server, the process is just as easy. Download the zip file, unzip it and place
gpg.exe somewhere in your PATH. (C:\Windows\ or similar will be fine). Create a directory at
C:\gnupg. Open a command prompt and type gpg.
You also need to install GPG or PGP and generate a key pair on the system that you plan to
check mail from.
On the Web server, there are very few differences between the command-line versions of GPG
and PGP, so we might as well use GPG as it is free. On the machine that you read mail from,
you might prefer to buy a commercial version of PGP in order to have a nice graphical user
interface plug-in to your mail reader.
If you do not already have one, generate a key pair on your mail reading machine. Recall that a
key pair consists of a Public Key that other people (and your PHP script) use to encrypt mail
before sending it to you, and a Private Key, which you use to either decrypt received messages
or sign outgoing mail.
It is important that the key generation is done on your mail reading machine, rather than on
your Web server, as your private key should not be stored on the Web server.
If you are using the command-line version of GPG to generate your keys, enter the following
command:
gpg --gen-key
You will be asked a number of questions. Most of them have a default answer that can be
accepted. You will be asked for a name and email address, which will be used to name the key.
My key is named ‘Luke Welling <[e-mail]>’. I am sure that you can see
the pattern.
To export the public key from your new key pair, you can use the command:
gpg --export > filename
This will give you a binary file suitable for importing into the GPG or PGP keyring on another
machine. If you want to email this key to people, so they can import it into their key rings, you
can instead create an ASCII version like this:
gpg --export -a > filename
Having extracted the public key, you can upload the file to your account on the Web server.
You can do this with FTP.
The following commands assume that you are using UNIX. The steps are the same for
Windows, but directory names and system commands will be different.
E-commerce and Security
P
ART III
340
19 7842 CH15 3/6/01 3:40 PM Page 340