As I told before, the software is downloadable at the official site but you can also find it at Simtel (3.02)

File's dimension (zip) are very limited for version 3.01, only 1962 Kb.


Once you downloaded gpgsh301.zip file, you must estract it with some tool like  7-Zip (Freeware e Open Source)  Izarc

Winzip  Powerarchiver  or some other stuff like that.








Once you downloaded it, you should extract in in a folder of your choice, f.i. C:\Programs\GnuPG or C:\GnupG.

That's all. The older GPGshell versions required a autoexec.bat file's modification but now it's not necessary.

Now you only have to install GPGshell, and at the end of this you'll be asked to insert the path of the folder where you

extracted gpg.exe.

Then it will be GPG itself to handle the system's registry in order to introduce even the modification asked by the previous

versions of GPG shell.

Here under you can see the file's content. Just in case you were wondering, .mo files are related to the language; if you want

you can delete every .mo file, except for those which interest you ( it.mo for italian and so on ).









In the next picture you can see the various choice you can have for your desktop and tray icons; it's also possible to create a

link to the really interesting GPGsfx tool (coded SFX) on Send To: I suggest this option.








If you right click on GPGshell icon you'll see a menu:











If you want to remove ( or introduce ) GPGshell from mouse menu, or if you want to associate a file extension to GPGShell you

 must click on the proper writing space until it becomes blue and then click on the push-button.

Then click on OK. Generally restart is required.












If you need to create your first key with GPGshell click on GPGKeys icon on desktop or on Start menu - Programs -

GPGshell.  - You'll see a keyring opening..

First time you launch GPGKeys you'll be asked if you are importing an existing keyring; if you choose "NO" you'll see an empty

 keyring opening.





In order to create a key you should hit CTRL+ N  or you can click on Key/i and then choose "New"





It will appear a DOS window, where you'll be asked which kind of key you want to create. You have 3 options: the default is

creating a DSA and Elgamal key ( coding and signing ). If you want this, write 1 ( one ) and hit Enter.




Now you have your last chanche to modify the data you entered ( just in case you made some mistakes or you changed your

mind ) without resetting the key's creation and start again from zero.

If everything is right, click on the O ( O like Ontario ) key to go to next step, in which you'll be asked to choose a password to

protect your key fron anauthorized use.




Here below you can see the password field: I'd like to say that a good password is made at least of 8 charachters as letters,

numbers and special characters.

I suggest to create an exclusive password, different from the ones you use for email or istant messaging.

I must say that a message encrypted with a passphrase like "Momma" is secure just like one created with something like

"d4h§3782\Y0344X@àò^".

The only difference is that  with the last passphrase takes much more time and efforts for the malicious users which try to crack

it.
If someone gets your key because he has physical access to your pc ( or gets it from Internet using a trojan or a software

vulnerability ), the choice of the passphrase can make the big difference.

You should choose a good trade off between security and easyness of use, without reaching exaggerations that bring you to

write an entire book as passphrase when you encrypt or sign a message or a file, or, and that's even worst, writing it on a note

and leave it near your pc.
.




The program suggest to type on the keyboard, move the mouse and perform actions like these ( opening folders or files )

during the key's generation process, in order to have a good entropy ( a random data generation ).

At the end of this step you'll be prompted and you can close the DOS window .

Now you can reach again the keyring (GPGkeys) and find your newly created : the yellow identifies it as a DSA key.





If you select the key you can ( mouse's right click) have access to different options.





GPGshell includes the interesting possibility to create self extracting cryptated files (something like SDA on PGP ).

This can be very useful if you must send cryptated messages and/or files to a user that doesn't have a cryptographic program

which is compatible with PGP/GnuPG or that can't use it.

We are talking about a self extracting SFX file, which requires a password to be open. Clearly, the password won't be sent

with the file, but you can communicate it to the user by phone or you two should have agree on it before.

In order to use this option, in the previous version you should have downloaded some files and extract them in specific folders,

but since 3.00 version everything's included in the installation, so you don't have to download anything else.

If you ( or the addressee ) aren't a cryptography's expert and you need to send confidential data by email ( like banking or

medical ), this SFX options can be definitely useful.

I'd like to remember that in Italy, for istance, there are laws about privacy that stat clearly that Medical Centres must "adopt

crypting tools" in order to protect confidential data.





 

Enter the password and then hit Enter again.




The document which is "inside" the SFX file will be extracted and you can hit any key to close the DOS window.


If the password you choose is "good" there is an optimal security level, so, as I told before, try to avoid trivial passwords or to

choose too short passwords.

Remember also that to encrypt an SDA you must never use as password the same passphrase you used with GnuPG. If you're

used to handle SDA files to transfer confidential documents ( particularly financial ones ),  you'd better use a new password

everytime you send a file; be sure you communicate it to the addressee, however.

Remember that every email message, while travelling from sender to addressee, pass through a large number of servers: there is
always the chanche that who has access to these servers to see these messages and their attachments and, of course, to copy

them and try to decrypt them.



If the whole digest obtained by the phone call comunications is perfectly similar to the one contained in the received file, the

Bank B operator will launch the SDA file, entering the password and decrypting it.

Why making ourselves sure that the file is the same?

There are a lot of  reasons for making it: there is the possibility to change the SDA file in attachment with another, there is the

chanche that the file can be maliciously or accidentally infectyed ( there are a lot of virus that infect .exe files ); there is also the

possibility that someone is trying to get the password: a malicious user can "catch" the SDA file and attach a backdoor to it,

which can steal the password or gain control of the addressee pc.

This last possibility is much more likely to happen than the chance to violate an encrypted file.

If all I'm saying appears paranoid to the common internet user, remember that there are people that work and gain a lot with the
 
computer, like the banks, or people that do very confidential studies or researches. For them security is crucial ($$$).

The crytical aspects in the whole operation are two: one is verifying that the file received is the same that has been sent, the

other is the password communication between the two users*.

* ( sending the password by email with the file attached is simply absurd; it's absurd either if you send it in another email, if you

don't encrypt the message )

Password exchange between users can be done by phone or, in a much more secure way, you can prepare two identical lists

of passwords, written on a paper sheet. The two users can have both the list and they can communicate by phone, telling just

what number of the list is the password chosen for that particular SDA file. It's much more easy to corrupt a phone operator

than to decrypt a file coded with a good password.