IMPORTANT NOTE:

For both new and old users, it is extremely important that you set up the cleanup script to run as a schedule, run it yourself before closing Entourage or leaving your computer unattended, and/or set the preferences to show decrypted messages in a new window. Otherwise, decrypted messages are saved to the disk by Entourage, which is not a good thing.

To do this, first select Schedules from the Tools menu. Press the New button. Make as many occurrences as you'd like. Run it on quit at the very least. Next, select Run AppleScript from the list of actions. Click "Script", and find the cleanup script. It is in the EntourageGPG folder inside your Entourage Script Menu Items folder inside the Microsoft User Data folder in the documents folder. This should ensure that decrypted messages aren't made available unencrypted to anyone with access to your hard drive.

What is EntourageGPG?

EntourageGPG is a front end for GPG inside Microsoft Entourage. GPG, or GNU Privacy Guard, is an OpenPGP-compatible free public key encryption tool.

What Does All That Mean?

EntourageGPG allows encryption of your email in a way that only the person you intend to read it can, and also allows "signing" of those messages, verifying your identity. With public key encryption, it isn't required that the recipient of your message have a previously established password or secret. Instead, you encrypt a message with their freely-available public key. Signing consists of the same thing in reverse; a "hash", or fixed-sized indentifier, of your message is signed with your private key, then that hash can be decrypted by anyone with your public key and it can be verified that the message has not been modified and it is indeed yours.

What's Required for EntourageGPG?

What's New In This Version?

Before Your First Use

Before you start using EntourageGPG, it is extremely important that you install, at a bare minimum, GPG. If you don't you will have problems. You can get a copy of GPG from http://macgpg.sourceforge.net/ (listed under GNU Privacy Guard), or you can use fink (fink install gnupg). If you don't know what fink is, don't worry about it. It is also suggested that you install GPGKeys (also from http://macgpg.sourceforge.net/), unless you are comfortable with managing your keys from the command line. With GPGKeys, you can relatively easily create your public and private keys using the "Generate…" command from the Key menu. After this, it's suggested that you select your public key and select "Send to Keyserver…" from the Key menu, to ensure that others have access to your public key and can encrypt messages so that only you can read them. If you have GPGKeys 0.4.5 or later, you can search for other people's keys by selecting "Search for Keys…" from the Key menu. I did not create GPGKeys, and I will not support it. Instead, you should contact its maintainer.

Using EntourageGPG

To use EntourageGPG, select one of the following from the script menu (the one with the scroll icon):

Cleanup - reverts any decrypted messages to encrypted versions, so that they are not saved by Entourage. This should be run either standalone before leaving the computer unattended or quitting Entourage, or as a part of a schedule.

Decrypt or Verify… - decrypts, verifies, or verifies and decrypts an encrypted, signed, or encrypted and signed message respectively.

Sign… - signs a message so that anyone can read it (even if they don't have EntourageGPG) and it can be verified as being from you.

Encrypt and Sign… - encrypts a message so that only the recipient can read it and signs it, to veify that you wrote it.

Encrypt… - encrypts a message so that only the recipient can read it, but does not sign it. There's really no reason to use this unless you need to be anonymous.

Symmetric Encrypt… - encrypts a message so that one passphrase is used for both encryption and decryption.

Preferences

There are many, many preference options for EntourageGPG. For most users, these should be fine when set to the defaults. However, some users may wish to customize EntourageGPG. Here are descriptions of the various preference options.

General:

GPG Options File:

Open - opens the GPG options file for editing.

Restore - restores the GPG options file to the one generated automatically by the installer.

Show Passphrase:

As Bullets - shows passphrase as bullets as its typed.

As Clear Text - shows passphrase as plain text as its typed.

Default Character Set:

UTF-8 - the standard PGP character set. Normal users should use this.

ISO-8859-1 - the Western European character set.

ISO-8859-2 - the Eastern European character set.

Encrypting/Signing:

GPG Trust Level:

Ignore - ignores the trust level setting for a key when encrypting to it.

Check - prevents a user from encrypting to a key he or she has not set to trust in GPGKeys.

Key Selection:

Present a List of Possible Keys - tries to match keys to message recipients. If the keys can't be found, shows the user of possible keys to encrypt to.

Input Keys/Names as text - presents a dialog allowing the user to enter the keys, names, or partial names of recipients as text.

Upon Unrecognized Recipient:

Attempt to Download Key - attempts to download the key of the unrecognized recipient from a keyserver.

Do Nothing - does nothing.

When Script Finish:

Send Message - sends the message.

Do Nothing - does nothing.

Automatically Encrypt To - automatically encrypts all messages to the key selected, as well as the recipient's key.

Decrypting:

Show Decrypted Message:

In Message Window - shows the decrypted message in the message window, replacing the old text. If you select this option, make sure you have set up cleanup on a schedule, as shown above, or make sure that you run a cleanup operation manually whenever you quit Entourage.

In New Window - shows the decrypted message in a new message window.

Localizing

It's relatively easy to localize EntourageGPG. There are four things that can be localized rather easily:

EntourageGPG 1.2 Installer/Contents/Resources/[Language].lproj/MainMenu.nib

EntourageGPG 1.2 Installer/Contents/Resources/[Language].lproj/Localizable.strings

EntourageGPG Preferences/Contents/Resources/[Language].lproj/MainMenu.nib

For EntourageGPG 1.2 Installer/Contents/Installer Items/[Language]/System.osax Tester, drag the file over Script Editor and edit the strings at the top of the file.

For the EntourageGPG scripts, very soon after "on run", each script has localized strings. All scripts (excluding Cleanup) have the same section of strings after "EntourageGPG Common", everything but Decrypt/Verify and Cleanup have the same strings after "EntourageGPG Encrypt", and Decrypt/Verify only has the strings after "EntourageGPG Decrypt".

What If I Get an Error Where I Shouldn't?

If you have followed all these directions and still have problems, contact me below. Otherwise, please read the directions and try to fix what you have done!

Credits/Contact

Developer:

Simon Kornblith <simon@simonster.com>

Beta Testers:

This Version:
Charly Avital
Ralf Krause
David M. Cotter
Edwin Metselaar

Older Versions:
Josh Little
Marc Weil
Gary Kornblith

Code Contributed by:

Butch Anton
Massimo Valle

German Localizer:

zeitform Internet Dienste <http://www.zeitform.de>

French Localizer:

Franck Rousseau

Entourage is a trademark of Microsoft Corporation. All other trademarks are property of their respective owners.