[[!meta title="MCabber OpenPGP support"]]

[[!toc]]

MCabber supports OpenPGP by implementing the [[!xep 0027]] protocol. When used,

status messages (presence) are signed and message bodies can be encrypted.

When a client supports OpenPGP, it signs presences (status messages). This is

the only way for a client to advertise its support of PGP. Messages are

encrypted when sent to such clients.

There is currently no indication of whether the message being sent will be

encrypted (or is there?) It is also unknown what happens when a message is

sent to a client with multiple active resources, when not all of them support

encryption or if they use different keys (please document).

MCabber supports OpenPGP since version 0.9.0. This page explains how to set it

up.

# Building mcabber with OpenPGP support

Note: You need `libgpgme` > 1.0.0 (for example, `libgpgme11` & `libgpgme11-dev`

in Debian) to build mcabber with OpenPGP support.

# Enabling OpenPGP

Once mcabber is built with PGP support, you will have to set it up.

In the configuration file, enable `pgp` and set `pgp_private_key` to your key

id.  Your key id can be found with the following command:

    gpg --list-keys --keyid-format long your_name

Example (in `$HOME/.mcabber/mcabberrc`):

    set pgp = 1

    set pgp_private_key = "E3E6A9C1A6A013D3"

# Encrypting messages

Now when you start mcabber, it should ask for your passphrase (unless you put

it in your configuration file or you use `gpg-agent`).

If you want to know if a contact is using PGP, select the contact and use

`/info`. If (s)he is, it should display something like

    PGP key id: E2C4C9A1601A5A4

    Last PGP signature: unknown

The signature is "unknown", because we don't have the contact's key. We could

get it with `gpg`, for example.

    gpg --recv-keys E2C4C9A1601A5A4

Then, wait for the next presence message.

If the contact has your key and you have their key, you should have

bidirectional encrypted messages.

# Per-contact settings

You can provide a PGP key to be used for a given Jabber user or disable PGP on

a per-account basis, using the command `/pgp`. If you provide a KeyId for a

contact, it will be compared to the key the contact uses to sign their

presence/messages and it will be used for all outgoing encrypted messages (by

default, mcabber will use the contact signature's key).

    /pgp disable foo@bar.org

    /pgp setkey bar@foo.net C9940A9BB0B92210

The command `/pgp` can be used in the configuration file (without the leading /).

Example (in `$HOME/.mcabber/mcabberrc`): 

    pgp disable foo@bar.org

    pgp setkey bar@foo.net C9940A9BB0B92210