First Time Setup Confusion

[Faramir]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Carlos Williams escribió:
> I am the email administrator for my small company and have never dealt
> with any kind of cryptographic software. I have several internal users
> on my email server (Postfix) who have the need to send encrypted email
> to trusted vendors so there will be some kind of public key exchange
> however I don't understand where GPG fits in the puzzle and maybe
> someone can explain this to me. I was told on a tech forum that PGP and
> / or GPG both are client side applications and don't need to run on my
> email (Postfix) server. I contacted PGP and they explained they have a
> client application that runs on the users desktop that handles the key
> encryption and exchange however I would like to use GPG and don't
> understand what the steps are that need to be done.
> 
> I read their mini_howto guide:
> 
> http://www.dewinter.com/gnupg_howto/english/GPGMiniHowto-1.html
> 
> However this basically runs over the entire process and everything I
> need to install this. I am just not clear on if I need to install GPG on
> my email server or a stand alone server (or does it matter) and how this
> all works with my current system.
> 
> Please pardon my ignorance and thanks for any help and or info!

  Hello Carlos Williams. GNUpg is the opensource (and free) software for
PGP encryption, so it is a very good choice. It doesn't need to be
installed in a server, but in each end user computer. It can even be
carried in a USB flash stick. What you need to send a signed, or
encrypted message with gpg, is: gpg, an email client with support for
gpg (I use mozilla thunderbird, with Enigmail add-on for that), and your
key pair (you generate it with gpg, there is not an external provider
for that).

  Then both sides exchange their public keys, they need to import the
public keys to their public keyring, and start using them. How to export
 and import the public keys varies depending if you are using command
line commands, or if you are using a GUI.

  But also, you must make sure you really got the right key from your
vendor, and not the key from somebody impersonating him. About how to do
that, I am sure other people here can explain it a lot better than I
could do that...




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQEcBAEBAgAGBQJIPbQtAAoJEMV4f6PvczxAULUIAI7i8OTS28wfMedu9tN1EQqi
pS1tXte7Rw0akuaMWjJbB0rrF2HxAKu2E+UECtdpFamXG/AZGOFee6JxJ/1ACjys
g8gHrrg5oaVbDyXNM5c7W9E7iR8qYjUXgiy1k7tKuPzW4biGZtNqDuA3JYVrWW8k
qO6K+CbMyUdPiCpUMAarR24sHFzv5TOfJuURY6VbCI5gCyLrPikECz3a6gMiMdF8
fmpYDHtlWwdd1s7CYRWa2YriNnhkMsaC/H9qrGYV6A9MNbACht0h+TLIddHV9evL
nYuU7++JJTWtXk5nm9cHN+Y3QAnCFYtkLyRjDkUGV2oplZJiVMMHvF5gr+1FUm4=
=4UZb
-----END PGP SIGNATURE-----