Using PGP with mutt

Mutt has integrated support for PGP. Using PGP under mutt is therefore extremely easy.

Make sure you're using the international version of mutt, not the US version. The international versions end with an "i" - for example, 0.95.6i is an internation version with PGP support, whereas 0.95.6 is not.

If you have more than one version of cryptographic software installed, you may wish to tell mutt which one of them to use. In your  /.muttrc file, you can place a line like this:

  set pgp_default_version=pgp5

Please consult the mutt manual for the details.

When you're about to send a message, you should see a menu that looks something like this:

  y:Send  q:Abort  t:To  c:CC  s:Subj  a:Attach file  d:Descrip  ?:Help
      From: "John Q . Smith" <smith@company.com>
        To: Greg Wooledge <wooledge@kellnet.com>
        Cc:
       Bcc:
   Subject: test
  Reply-To:
       Fcc: =sent-mail
       PGP: Clear

The PGP options are accessed by pressing p. This brings up a menu at the bottom of the screen:

  (e)ncrypt, (s)ign, sign (a)s, (b)oth, select (m)ic algorithm, or (f)orget it? _

If you want to sign the message, just press s. If you want to encrypt it, press e. To both sign and encrypt, press b.

If you are signing the message, you will be prompted for your passphrase.

When you read encrypted e-mail with mutt, you will also be prompted for your passphrase. After entering it, you will be able to read the message:

  [-- PGP output follows (current time: Fri Oct  1 09:00:33 1999) --]
  Cannot open configuration file /home/username/.pgp/pgp.cfg
  No files specified.  Using stdin.

  Message is encrypted.
  Opening file "stdout" type text.
  [-- End of PGP output --]

  [-- The following data is PGP/MIME encrypted --]

  I'd like to buy one of your Widgets, model number W-1092.

  My Visa number is 1234 5678 9012 3456, expiration date 01/02.

  [-- End of PGP/MIME encrypted data --]

When you read digitally signed e-mail with mutt, you do not need to type your passphrase, since you are only verifying a digital signature. The result will look something like this:

  [-- PGP output follows (current time: Fri Oct  1 09:09:24 1999) --]
  Good signature made 1999-10-01 13:06 GMT by key:
    1024 bits, Key ID B2811AF9, Created 1997-08-11
       "Greg Wooledge <wooledge@kellnet.com>"
  Cannot open configuration file /home/username/.pgp/pgp.cfg
  This signature applies to another message

  WARNING: The signing key is not trusted to belong to:
  Greg Wooledge <wooledge@kellnet.com> 

  Opening file "/dev/null" type text.
  [-- End of PGP output --]

  [-- The following data is PGP/MIME signed --]

  I've received your order for two Doodads, and will be shipping them
  by UPS today at 3:00 PM.

  [-- End of PGP/MIME signed data --]

If you don't see the words "Good signature" then you know that something went wrong. (Unfortunately, PGP's output isn't always useful; you may not be able to tell whether the signature is invalid, or whether it was produced with a GPG key that PGP can't read.)