Hi Russ,

> Subject: 3. PGP-Signing Control Messages
>
> What all this means is that you have a few hard choices when it comes to
> choosing a PGP implementation and generating your initial key pair. You
> can use GnuPG <http://www.gnupg.org/>, which is probably the best
> available PGP implementation, and not bother with a RSA key at all. This
> will mean, unfortunately, that only sites that are also using GnuPG or
> another current PGP implementation will be able to verify your control
> messages. Or you can go to <http://www.pgpi.org/>, download an older
> version of PGP (something of the 2.6 vintage), and use it to sign your
> control messages, which will work with all versions of PGP but may be more
> of a pain. (You can also use an old version of PGP only to generate the
> initial key, and then import it into GnuPG and use GnuPG to sign control
> messages, but this is complex and not recommended for people who have
> never touched PGP before. There are some instructions on the GnuPG web
> site, though.)

The suggestion about using PGP 2.6 to sign control messages may now be
dropped. Let's just recommend a modern version of GnuPG, and generate
an RSA key (for interoperability reasons) of at least 3072 bits.

--
Julien ÉLIE

« Et maintenant nous sommes roulés. » (Astérix)