Using trust to validate keys
The web of trust allows a more elaborate algorithm to be used to validate a key. Formerly, a
key was considered valid only if you signed it personally. A more flexible algorithm can now
be used: a key K is considered valid if it meets two conditions:
1. it is signed by enough valid keys, meaning
_ you have signed it personally,
_ it has been signed by one fully trusted key, or
_ it has been signed by three marginally trusted keys; and
2. the path of signed keys leading from K back to your own key is five steps or shorter.
The path length, number of marginally trusted keys required, and number of fully trusted
keys required may be adjusted. The numbers given above are the default values used by GnuPG.
Figure 3-1 shows a web of trust rooted at Alice. The graph illustrates who has signed who’s
keys. The table shows which keys Alice considers valid based on her trust in the other
members of the web. This example assumes that two marginally-trusted keys or one fully-
trusted key is needed to validate another key. The maximum path length is three.
When computing valid keys in the example, Blake and Dharma’s are always considered fully
valid since they were signed directly by Alice. The validity of the other keys depends on
trust. In the first case, Dharma is trusted fully, which implies that Chloe’s and Francis’s
keys will be considered valid. In the second example, Blake and Dharma are trusted
marginally. Since two marginally trusted keys are needed to fully validate a key, Chloe’s
key will be considered fully valid, but Francis’s key will be considered only marginally
valid. In the case where Chloe and Dharma are marginally trusted, Chloe’s key will be
marginally valid since Dharma’s key is fully valid. Francis’s key, however, will also be
considered marginally valid since only a fully valid key can be used to validate other keys,
and Dharma’s key is the only fully valid key that has been used to sign Francis’s key. When
marginal trust in Blake is added, Chloe’s key becomes fully valid and can then be used to
fully validate Francis’s key and marginally validate Elena’s key. Lastly, when Blake, Chloe,
and Elena are fully trusted, this is still insufficient to validate Geoff’s key since the
maximum certification path is three, but the path length from Geoff back to Alice is four.
The web of trust model is a flexible approach to the problem of safe public key exchange. It
permits you to tune GnuPG to reflect how you use it. At one extreme you may insist on
multiple, short paths from your key to another key K in order to trust it. On the other
hand, you may be satisfied with longer paths and perhaps as little as one path from your key
to the other key K. Requiring multiple, short paths is a strong guarantee that K belongs to
whom your think it does. The price, of course, is that it is more difficult to validate keys
since you must personally sign more keys than if you accepted fewer and longer paths.
Figure 3-1. A hypothetical web of trust
Distributing keys
Ideally, you distribute your key by personally giving it to your correspondents. In
practice, however, keys are often distributed by email or some other electronic
communication medium. Distribution by email is good practice when you have only a few
correspondents, and even if you have many correspondents, you can use an alternative means
such as posting your public key on your World Wide Web homepage. This is unacceptable,
however, if people who need your public key do not know where to find it on the Web.
To solve this problem public key servers are used to collect and distribute public keys. A
public key received by the server is either added to the server’s database or merged with
the existing key if already present. When a key request comes to the server, the server
consults its database and returns the requested public key if found. A keyserver is also
valuable when many people are frequently signing other people’s keys. Without a keyserver,
when Blake sign’s Alice’s key then Blake would send Alice a copy of her public key signed by
him so that Alice could add the updated key to her ring as well as distribute it to all of
her correspondents. Going through this effort fulfills Alice’s and Blake’s responsibility to
the community at large in building tight webs of trust and thus improving the security of
PGP. It is nevertheless a nuisance if key signing is frequent.
Using a keyserver makes the process somewhat easier. When Blake signs Alice’s key he sends
the signed key to the key server. The key server adds Blake’s signature to its copy of
Alice’s key. Individuals interested in updating their copy of Alice’s key then consult the
keyserver on their own initiative to retrieve the updated key. Alice need never be involved
with distribution and can retrieve signatures on her key simply by querying a keyserver.
One or more keys may be sent to a keyserver using the command-line option -send-keys. The
option takes one or more key specifiers and sends the specified keys to the key server. The
key server to which to send the keys is specified with the command-line option -keyserver.
Similarly, the option -recv-keys is used to retrieve keys from a keyserver, but the option –
recv-keys requires a key ID be used to specify the key. In the following example Alice
updates her public key with new signatures from the keyserver certserver.pgp.com and then
sends her copy of Blake’s public key to the same keyserver to contribute any new
signatures she may have added.
alice% gpg -keyserver certserver.pgp.com -recv-key 0xBB7576AC
gpg: requesting key BB7576AC from certserver.pgp.com ...
gpg: key BB7576AC: 1 new signature
gpg: Total number processed: 1
gpg: new signatures: 1
alice% gpg -keyserver certserver.pgp.com -send-key blake@cyb.org
gpg: success sending to ’certserver.pgp.com’ (status=200)
There are several popular keyservers in use around the world. The major keyservers
synchronize themselves, so it is fine to pick a keyserver close to you on the Internet and
then use it regularly for sending and receiving keys.
Chapter 4. Daily use of GnuPG
GnuPG is a complex tool with technical, social, and legal issues surrounding it.
Technically, it has been designed to be used in situations having drastically different
security needs. This complicates key management. Socially, using GnuPG is not strictly a
personal decision. To use GnuPG effectively both parties communicating must use it. Finally,
as of 1999, laws regarding digital encryption, and in particular whether or not using GnuPG
is legal, vary from country to country and is currently being debated by many national
governments.
This chapter addresses these issues. It gives practical advice on how to use GnuPG to meet
your security needs. It also suggests ways to promote the use of GnuPG for secure
communication between yourself and your colleagues when your colleagues are not currently
using GnuPG. Finally, the legal status of GnuPG is outlined given the current status of
encryption laws in the world.
Defining your security needs
GnuPG is a tool you use to protect your privacy. Your privacy is protected if you can
correspond with others without eavesdroppers reading those messages.
How you should use GnuPG depends on the determination and resourcefulness of those who might
want to read your encrypted messages. An eavesdropper may be an unscrupulous system
administrator casually scanning your mail, it might be an industrial spy trying to collect
your company’s secrets, or it might be a law enforcement agency trying to prosecute you.
Using GnuPG to protect against casual eavesdropping is going to be different than using
GnuPG to protect against a determined adversary. Your goal, ultimately, is to make it more
expensive to recover the unencrypted data than that data is worth.
Customizing your use of GnuPG revolves around four issues:
_ choosing the key size of your public/private keypair,
_ protecting your private key,
_ selecting expiration dates and using subkeys, and
_ managing your web of trust.
A well-chosen key size protects you against brute-force attacks on encrypted messages.
Protecting your private key prevents an attacker from simply using your private key to
decrypt encrypted messages and sign messages in your name. Correctly managing your web of
trust prevents attackers from masquerading as people with whom you communicate. Ultimately,
addressing these issues with respect to your own security needs is how you balance the extra
work required to use GnuPG with the privacy it gives you.
Choosing a key size
Selecting a key size depends on the key. In OpenPGP, a public/private keypair usually has
multiple keys. At the least it has a master signing key, and it probably has one or more
additional subkeys for encryption. Using default key generation parameters with GnuPG, the
master key will be a DSA key, and the subkeys will be ElGamal keys.
DSA allows a key size up to 1024 bits. This is not especially good given today’s factoring
technology, but that is what the standard specifies. Without question, you should use 1024
bit DSA keys.
ElGamal keys, on the other hand, may be of any size. Since GnuPG is a hybrid public-key
system, the public key is used to encrypt a 128-bit session key, and the private key is used
to decrypt it. Key size nevertheless affects encryption and decryption speed since the cost
of these algorithms is exponential in the size of the key. Larger keys also take more time
to generate and take more space to store. Ultimately, there are diminishing returns on the
extra security a large key provides you. After all, if the key is large enough to resist a
brute-force attack, an eavesdropper will merely switch to some other method for obtaining
your plaintext data. Examples of other methods include robbing your home or office and
mugging you. 1024 bits is thus the recommended key size. If you genuinely need a larger key
size then you probably already know this and should be consulting an expert in data
security.
Protecting your private key
Protecting your private key is the most important job you have to use GnuPG correctly. If
someone obtains your private key, then all data encrypted to the private key can be
decrypted and signatures can be made in your name. If you lose your private key, then you
will no longer be able to decrypt documents encrypted to you in the future or in the past,
and you will not be able to make signatures. Losing sole possession of your private key is
catastrophic.
Regardless of how you use GnuPG you should store the public key’s revocation certificate and
a backup of your private key on write-protected media in a safe place. For example, you
could burn them on a CD-ROM and store them in your safe deposit box at the bank in a sealed
envelope. Alternatively, you could store them on a floppy and hide it in your house.
Whatever you do, they should be put on media that is safe to store for as long as you expect
to keep the key, and you should store them more carefully than the copy of your private key
you use daily.
To help safeguard your key, GnuPG does not store your raw private key on disk. Instead it
encrypts it using a symmetric encryption algorithm. That is why you need a passphrase to
access the key. Thus there are two barriers an attacker must cross to access your private
key: (1) he must actually acquire the key, and (2) he must get past the encryption.
Safely storing your private key is important, but there is a cost. Ideally, you would keep
the private key on a removable, write-protected disk such as a floppy disk, and you would
use it on a single-user machine not connected to a network. This may be inconvenient or
impossible for you to do. For example, you may not own your own machine and must use a
computer at work or school, or it may mean you have to physically disconnect your computer
from your cable modem every time you want to use GnuPG.
This does not mean you cannot or should not use GnuPG. It means only that you have decided
that the data you are protecting is important enough to encrypt but not so important as to
take extra steps to make the first barrier stronger. It is your choice.
A good passphrase is absolutely critical when using GnuPG. Any attacker who gains access to
your private key must bypass the encryption on the private key. Instead of brute-force
guessing the key, an attacker will almost certainly instead try to guess the passphrase.
The motivation for trying passphrases is that most people choose a passphrase that is easier
to guess than a random 128-bit key. If the passphrase is a word, it is much cheaper to try
all the words in the dictionaries of the world’s languages. Even if the word is permuted,
e.g., k3wldood, it is still easier to try dictionary words with a catalog of permutations.
The same problem applies to quotations. In general, passphrases based on natural- language
utterances are poor passphrases since there is little randomness and lots of redundancy in
natural language. You should avoid natural language passphrases if you can.
A good passphrase is one that you can remember but is hard for someone to guess. It should
include characters from the whole range of printable characters on your keyboard. This
includes uppercase alphabetics characters, numbers, and special characters such as } and |.
Be creative and spend a little time considering your passphrase; a good choice is important
to ensure your privacy.
Selecting expiration dates and using subkeys
By default, a DSA master signing key and an ElGamal encryption subkey are generated when you
create a new keypair. This is convenient, because the roles of the two keys are different,
and you may therefore want the keys to have different lifetimes. The master signing key is
used to make digital signatures, and it also collects the signatures of others who have
confirmed your identity. The encryption key is used only for decrypting encrypted documents
sent to you. Typically, a digital signature has a long lifetime, e.g., forever, and you also
do not want to lose the signatures on your key that you worked hard to collect. On the other
hand, the encryption subkey may be changed periodically for extra security, since if an
encryption key is broken, the attacker can read all documents encrypted to that key both in
the future and from the past.
It is almost always the case that you will not want the master key to expire. There are two
reasons why you may choose an expiration date. First, you may intend for the key to have a
limited lifetime. For example, it is being used for an event such as a political campaign
and will no longer be useful after the campaign is over. Another reason is that if you lose
control of the key and do not have a revocation certificate with which to revoke the key,
having an expiration date on the master key ensures that the key will eventually fall into
disuse.
Changing encryption subkeys is straightforward but can be inconvenient. If you generate a
new keypair with an expiration date on the subkey, that subkey will eventually expire.
Shortly before the expiration you will add a new subkey and publish your updated public key.
Once the subkey expires, those who wish to correspond with you must find your updated key
since they will no longer be able to encrypt to the expired key. This may be inconvenient
depending on how you distribute the key. Fortunately, however, no extra signatures are
necessary since the new subkey will have been signed with your master signing key, which
presumably has already been validated by your correspondents.
The inconvenience may or may not be worth the extra security. Just as you can, an attacker
can still read all documents encrypted to an expired subkey. Changing subkeys only protects
future documents. In order to read documents encrypted to the new subkey, the attacker would
need to mount a new attack using whatever techniques he used against you the first time.
Finally, it only makes sense to have one valid encryption subkey on a keyring. There is no
additional security gained by having two or more active subkeys. There may of course be any
number of expired keys on a keyring so that documents encrypted in the past may still be
decrypted, but only one subkey needs to be active at any given time.
Managing your web of trust
As with protecting your private key, managing your web of trust is another aspect of using
GnuPG that requires balancing security against ease of use. If you are using GnuPG to
protect against casual eavesdropping and forgeries then you can afford to be relatively
trusting of other people’s signatures. On the other hand, if you are concerned that there
may be a determined attacker interested in invading your privacy, then you should be much
less trusting of other signatures and spend more time personally verifying signatures.
Regardless of your own security needs, though, you should always be careful when signing
other keys. It is selfish to sign a key with just enough confidence in the key’s validity to
satisfy your own security needs. Others, with more stringent security needs, may want to
depend on your signature. If they cannot depend on you then that weakens the web of trust
and makes it more difficult for all GnuPG users to communicate. Use the same care in signing
keys that you would like others to use when you depend on their signatures.
In practice, managing your web of trust reduces to assigning trust to others and tuning the
options - marginals-needed and -completes-needed. Any key you personally sign will be
considered valid, but except for small groups, it will not be practical to personally sign
the key of every person with whom you communicate. You will therefore have to assign trust
to others.
It is probably wise to be accurate when assigning trust and then use the options to tune how
careful GnuPG is with key validation. As a concrete example, you may fully trust a few close
friends that you know are careful with key signing and then marginally trust all others on
your keyring. From there, you may set –completesneeded to 1 and -marginals-needed to 2. If
you are more concerned with security you might choose values of 1 and 3 or 2 and 3
respectively. If you are less concerned with privacy attacks and just want some reasonable
confidence about validity, set the values to 1 and 1. In general, higher numbers for these
options imply that more people would be needed to conspire against you in order to have a
key validated that does not actually belong to the person whom you think it does.
Building your web of trust
Wanting to use GnuPG yourself is not enough. In order to use to communicate securely with
others you must have a web of trust. At first glance, however, building a web of trust is a
daunting task. The people with whom you communicate need to use GnuPG1, and there needs to
be enough key signing so that keys can be considered valid. These are not technical
problems; they are social problems. Nevertheless, you must overcome these problems if you
want to use GnuPG.
When getting started using GnuPG it is important to realize that you need not securely
communicate with every one of your correspondents. Start with a small circle of people,
perhaps just yourself and one or two others who also want to exercise their right to
privacy. Generate your keys and sign each other’s public keys. This is your initial web of
trust. By doing this you will appreciate the value of a small, robust web of trust and will
be more cautious as you grow your web in the future.
In addition to those in your initial web of trust, you may want to communicate securely with
others who are also using GnuPG. Doing so, however, can be awkward for two reasons: (1) you
do not always know when someone uses or is willing to use GnuPG, and (2) if you do know of
someone who uses it, you may still have trouble validating their key. The first reason
occurs because people do not always advertise that they use GnuPG.
The way to change this behavior is to set the example and advertise that you use GnuPG.
There are at least three ways to do this: you can sign messages you mail to others or post
to message boards, you can put your public key on your web page, or, if you put your key on
a keyserver, you can put your key ID in your email signature. If you advertise your key then
you make it that much more acceptable for others to advertise their keys. Furthermore, you
make it easier for others to start communicating with you securely since you have taken the
initiative and made it clear that you use GnuPG.
Key validation is more difficult. If you do not personally know the person whose key you
want to sign, then it is not possible to sign the key yourself. You must rely on the
signatures of others and hope to find a chain of signatures leading from the key in question
back to your own. To have any chance of finding a chain, you must take the initiative and
get your key signed by others outside of your initial web of trust. An effective way to
accomplish this is to participate in key signing parties. If you are going to a conference
look ahead of time for a key signing party, and if you do not see one being held, offer to
hold one (http://www.herrons.com/kb2nsx/keysign.html). You can also be more passive and
carry your fingerprint with you for impromptu key exchanges. In such a situation the person
to whom you gave the fingerprint would verify it and sign your public key once he returned
home.
Keep in mind, though, that this is optional. You have no obligation to either publicly
advertise your key or sign other people’s keys. The power of GnuPG is that it is flexible
enough to adapt to your security needs whatever they may be. The social reality, however, is
that you will need to take the initiative if you want to grow your web of trust and use
GnuPG for as much of your communication as possible.
Using GnuPG legally
The legal status of encryption software varies from country to country, and law regarding
encryption software is rapidly evolving. Bert-Japp Koops
(http://cwis.kub.nl/~frw/people/koops/bertjaap.htm) has an excellent Crypto Law Survey
(http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm) to which you should refer for the legal
status of encryption software in your country.
Chapter 5. Topics
This chapter covers miscellaneous topics that do not fit elsewhere in the user manual. As
topics are added, they may be collected and factored into chapters that stand on their own.
If you would like to see a particular topic covered, please suggest it. Even better,
volunteer to write a first draft covering your suggested topic!
Writing user interfaces
Alma Whitten (http://www.cs.cmu.edu/~alma) and Doug Tygar
(http://www.cs.berkeley.edu/~tygar) have done a study (http://reports-
archive.adm.cs.cmu.edu/anon/1998/abstracts/98-155.html) on NAI’s PGP 5.0 user interface and
came to the conclusion that novice users find PGP confusing and frustrating. In their human
factors study, only four out of twelve test subjects managed to correctly send encrypted
email to their team members, and three out of twelve emailed the secret without encryption.
Furthermore, half of the test subjects had a technical background.
These results are not surprising. PGP 5.0 has a nice user interface that is excellent if you
already understand how public-key encryption works and are familiar with the web-of-trust
key management model specified by OpenPGP. Unfortunately, novice users understand neither
public-key encryption nor key management, and the user interface does little to help.
You should certainly read Whitten and Tygar’s report if you are writing a user interface. It
gives specific comments from each of the test subjects, and those details are enlightening.
For example, it would appear that many of subjects believed that a message being sent to
other people should be encrypted to the test subject’s own public key. Consider it for a
minute, and you will see that it is an easy mistake to make. In general, novice users have
difficulty understanding the different roles of the public key and private key when using
GnuPG. As a user interface designer, you should try to make it clear at all times when one
of the two keys is being used. You could also use wizards or other common GUI techniques for
guiding the user through common tasks, such as key generation, where extra steps, such as
generating a key revocation certification and making a backup, are all but essential for
using GnuPG correctly. Other comments from the paper include the following.
_ Security is usually a secondary goal; people want to send email, browse, and so on. Do not
assume users will be motivated to read manuals or go looking for security controls.
_ The security of a networked computer is only as strong as its weakest component. Users
need to be guided to attend to all aspects of their security, not left to proceed through
random exploration as they might with a word processor or a spreadsheet.
_ Consistently use the same terms for the same actions. Do not alternate between synonyms
like “encrypt” and “encipher”.
_ For inexperienced users, simplify the display. Too much information hides the important
information. An initial display configuration could concentrate on giving the user the
correct model of the relationship between public and private keys and a clear understanding
of the functions for acquiring and distributing keys.
Designing an effective user interface for key management is even more difficult. The OpenPGP
web-oftrust model is unfortunately quite obtuse. For example, the specification imposes
three arbitrary trust levels onto the user: none, marginal, and complete. All degrees of
trust felt by the user must be fit into one of those three cubbyholes. The key validation
algorithm is also difficult for non-computer scientists to understand, particularly the
notions of “marginals needed” and “completes needed”. Since the web-of-trust model is well-
specified and cannot be changed, you will have to do your best and design a user interface
that helps to clarify it for the user. A definite improvement, for example, would be to
generate a diagram of how a key was validated when requested by the user. Relevant comments
from the paper include the following.
_ Users are likely to be uncertain on how and when to grant accesses.
_ Place a high priority on making sure users understand their security well enough to
prevent them from making potentially high-cost mistakes. Such mistakes include accidentally
deleting the private key, accidentally publicizing a key, accidentally revoking a key,
forgetting the pass phrase, and failing to back up the key rings.
Appendix A. GNU Free Documentation License
Version 1.1, March 2000
Copyright (C) 2000 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA
02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license
document, but changing it is not allowed.
0. PREAMBLE
The purpose of this License is to make a manual, textbook, or other written document "free"
in the sense of freedom: to assure everyone the effective freedom to copy and redistribute
it, with or without modifying it, either commercially or noncommercially. Secondarily, this
License preserves for the author and publisher a way to get credit for their work, while not
being considered responsible for modifications made by others.
This License is a kind of "copyleft", which means that derivative works of the document must
themselves be free in the same sense. It complements the GNU General Public License, which
is a copyleft license designed for free software.
We have designed this License in order to use it for manuals for free software, because free
software needs free documentation: a free program should come with manuals providing the
same freedoms that the software does. But this License is not limited to software manuals;
it can be used for any textual work, regardless of subject matter or whether it is published
as a printed book. We recommend this License principally for works whose purpose is
instruction or reference.
1. APPLICABILITY AND DEFINITIONS
This License applies to any manual or other work that contains a notice placed by the
copyright holder saying it can be distributed under the terms of this License. The
"Document", below, refers to any such manual or work. Any member of the public is a
licensee, and is addressed as "you".
A "Modified Version" of the Document means any work containing the Document or a portion of
it, either copied verbatim, or with modifications and/or translated into another language.
A "Secondary Section" is a named appendix or a front-matter section of the Document that
deals exclusively with the relationship of the publishers or authors of the Document to the
Document’s overall subject (or to related matters) and contains nothing that could fall
directly within that overall subject. (For example, if the Document is in part a textbook of
mathematics, a Secondary Section may not explain any mathematics.) The relationship could be
a matter of historical connection with the subject or with related matters, or of legal,
commercial, philosophical, ethical or political position regarding them.
The "Invariant Sections" are certain Secondary Sections whose titles are designated, as
being those of Invariant Sections, in the notice that says that the Document is released
under this License.
The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts
or Back-Cover Texts, in the notice that says that the Document is released under this
License.
A "Transparent" copy of the Document means a machine-readable copy, represented in a format
whose specification is available to the general public, whose contents can be viewed and
edited directly and straightforwardly with generic text editors or (for images composed of
pixels) generic paint programs or (for drawings) some widely available drawing editor, and
that is suitable for input to text formatters or for automatic translation to a variety of
formats suitable for input to text formatters. A copy made in an otherwise Transparent file
format whose markup has been designed to thwart or discourage subsequent modification by
readers is not Transparent. A copy that is not "Transparent" is called "Opaque".
Examples of suitable formats for Transparent copies include plain ASCII without markup,
Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and
standard-conforming simple HTML designed for human modification. Opaque formats include
PostScript, PDF, proprietary formats that can be read and edited only by proprietary word
processors, SGML or XML for which the DTD and/or processing tools are not generally
available, and the machine-generated HTML produced by some word processors for output
purposes only.
The "Title Page" means, for a printed book, the title page itself, plus such following pages
as are needed to hold, legibly, the material this License requires to appear in the title
page. For works in formats which do not have any title page as such, "Title Page" means the
text near the most prominent appearance of the work’s title, preceding the beginning of the
body of the text.
2. VERBATIM COPYING
You may copy and distribute the Document in any medium, either commercially or
noncommercially, provided that this License, the copyright notices, and the license notice
saying this License applies to the Document are reproduced in all copies, and that you add
no other conditions whatsoever to those of this License. You may not use technical measures
to obstruct or control the reading or further copying of the copies you make or distribute.
However, you may accept compensation in exchange for copies. If you distribute a large
enough number of copies you must also follow the conditions in section 3.
You may also lend copies, under the same conditions stated above, and you may publicly
display copies.
3. COPYING IN QUANTITY
If you publish printed copies of the Document numbering more than 100, and the Document’s
license notice requires Cover Texts, you must enclose the copies in covers that carry,
clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-
Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the
publisher of these copies. The front cover must present the full title with all words of the
title equally prominent and visible. You may add other material on the covers in addition.
Copying with changes limited to the covers, as long as they preserve the title of the
Document and satisfy these conditions, can be treated as verbatim copying in other respects.
If the required texts for either cover are too voluminous to fit legibly, you should put the
first ones listed (as many as fit reasonably) on the actual cover, and continue the rest
onto adjacent pages.
If you publish or distribute Opaque copies of the Document numbering more than 100, you must
either include a machine-readable Transparent copy along with each Opaque copy, or state in
or with each Opaque copy a publicly-accessible computer-network location containing a
complete Transparent copy of the Document, free of added material, which the general
network-using public has access to download anonymously at no charge using public-standard
network protocols. If you use the latter option, you must take reasonably prudent steps,
when you begin distribution of Opaque copies in quantity, to ensure that this Transparent
copy will remain thus accessible at the stated location until at least one year after the
last time you distribute an Opaque copy (directly or through your agents or retailers) of
that edition to the public.
It is requested, but not required, that you contact the authors of the Document well before
redistributing any large number of copies, to give them a chance to provide you with an
updated version of the Document.
4. MODIFICATIONS
You may copy and distribute a Modified Version of the Document under the conditions of
sections 2 and 3 above, provided that you release the Modified Version under precisely this
License, with the Modified Version filling the role of the Document, thus licensing
distribution and modification of the Modified Version to whoever possesses a copy of it. In
addition, you must do these things in the Modified Version:
A. Use in the Title Page (and on the covers, if any) a title distinct from that of the
Document, and from those of previous versions (which should, if there were any, be listed in
the History section of the Document). You may use the same title as a previous version if
the original publisher of that version gives permission.
B. List on the Title Page, as authors, one or more persons or entities responsible for
authorship of the modifications in the Modified Version, together with at least five of the
principal authors of the Document (all of its principal authors, if it has less than five).
C. State on the Title page the name of the publisher of the Modified Version, as the
publisher.
D. Preserve all the copyright notices of the Document.
E. Add an appropriate copyright notice for your modifications adjacent to the other
copyright notices.
F. Include, immediately after the copyright notices, a license notice giving the public
permission to use the Modified Version under the terms of this License, in the form shown in
the Addendum below.
G. Preserve in that license notice the full lists of Invariant Sections and required Cover
Texts given in the Document’s license notice.
H. Include an unaltered copy of this License.
I. Preserve the section entitled "History", and its title, and add to it an item stating at
least the title, year, new authors, and publisher of the Modified Version as given on the
Title Page. If there is no section entitled "History" in the Document, create one stating
the title, year, authors, and publisher of the Document as given on its Title Page, then add
an item describing the Modified Version as stated in the previous sentence.
J. Preserve the network location, if any, given in the Document for public access to a
Transparent copy of the Document, and likewise the network locations given in the Document
for previous versions it was based on. These may be placed in the "History" section. You may
omit a network location for a work that was published at least four years before the
Document itself, or if the original publisher of the version it refers to gives permission.
K. In any section entitled "Acknowledgements" or "Dedications", preserve the section’s
title, and preserve in the section all the substance and tone of each of the contributor
acknowledgements and/or dedications given therein.
L. Preserve all the Invariant Sections of the Document, unaltered in their text and in their
titles. Section numbers or the equivalent are not considered part of the section titles.
M. Delete any section entitled "Endorsements". Such a section may not be included in the
Modified Version.
N. Do not retitle any existing section as "Endorsements" or to conflict in title with any
Invariant Section.
If the Modified Version includes new front-matter sections or appendices that qualify as
Secondary Sections and contain no material copied from the Document, you may at your option
designate some or all of these sections as invariant. To do this, add their titles to the
list of Invariant Sections in the Modified Version’s license notice. These titles must be
distinct from any other section titles.
You may add a section entitled "Endorsements", provided it contains nothing but endorsements
of your Modified Version by various parties–for example, statements of peer review or that
the text has been approved by an organization as the authoritative definition of a standard.
You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25
words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version.
Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through
arrangements made by) any one entity. If the Document already includes a cover text for the
same cover, previously added by you or by arrangement made by the same entity you are acting
on behalf of, you may not add another; but you may replace the old one, on explicit
permission from the previous publisher that added the old one.
The author(s) and publisher(s) of the Document do not by this License give permission to use
their names for publicity for or to assert or imply endorsement of any Modified Version.
5. COMBINING DOCUMENTS
You may combine the Document with other documents released under this License, under the
terms defined in section 4 above for modified versions, provided that you include in the
combination all of the Invariant Sections of all of the original documents, unmodified, and
list them all as Invariant Sections of your combined work in its license notice.
The combined work need only contain one copy of this License, and multiple identical
Invariant Sections may be replaced with a single copy. If there are multiple Invariant
Sections with the same name but different contents, make the title of each such section
unique by adding at the end of it, in parentheses, the name of the original author or
publisher of that section if known, or else a unique number. Make the same adjustment to the
section titles in the list of Invariant Sections in the license notice of the combined work.
In the combination, you must combine any sections entitled "History" in the various original
documents, forming one section entitled "History"; likewise combine any sections entitled
"Acknowledgements", and any sections entitled "Dedications". You must delete all sections
entitled "Endorsements."
6. COLLECTIONS OF DOCUMENTS
You may make a collection consisting of the Document and other documents released under this
License, and replace the individual copies of this License in the various documents with a
single copy that is included in the collection, provided that you follow the rules of this
License for verbatim copying of each of the documents in all other respects.
You may extract a single document from such a collection, and distribute it individually
under this License, provided you insert a copy of this License into the extracted document,
and follow this License in all other respects regarding verbatim copying of that document.
7. AGGREGATION WITH INDEPENDENT WORKS
A compilation of the Document or its derivatives with other separate and independent
documents or works, in or on a volume of a storage or distribution medium, does not as a
whole count as a Modified Version of the Document, provided no compilation copyright is
claimed for the compilation. Such a compilation is called an "aggregate", and this License
does not apply to the other self-contained works thus compiled with the Document, on account
of their being thus compiled, if they are not themselves derivative works of the Document.
If the Cover Text requirement of section 3 is applicable to these copies of the Document,
then if the Document is less than one quarter of the entire aggregate, the Document’s Cover
Texts may be placed on covers that surround only the Document within the aggregate.
Otherwise they must appear on covers around the whole aggregate.
8. TRANSLATION
Translation is considered a kind of modification, so you may distribute translations of the
Document under the terms of section 4. Replacing Invariant Sections with translations
requires special permission from their copyright holders, but you may include translations
of some or all Invariant Sections in addition to the original versions of these Invariant
Sections. You may include a translation of this License provided that you also include the
original English version of this License. In case of a disagreement between the translation
and the original English version of this License, the original English version will prevail.
9. TERMINATION
You may not copy, modify, sublicense, or distribute the Document except as expressly
provided for under this License. Any other attempt to copy, modify, sublicense or distribute
the Document is void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under this License will not
have their licenses terminated so long as such parties remain in full compliance.
10. FUTURE REVISIONS OF THIS LICENSE
The Free Software Foundation may publish new, revised versions of the GNU Free Documentation
License from time to time. Such new versions will be similar in spirit to the present
version, but may differ in detail to address new problems or concerns. See
http://www.gnu.org/copyleft/.
Each version of the License is given a distinguishing version number. If the Document
specifies that a particular numbered version of this License "or any later version" applies
to it, you have the option of following the terms and conditions either of that specified
version or of any later version that has been published (not as a draft) by the Free
Software Foundation. If the Document does not specify a version number of this License, you
may choose any version ever published (not as a draft) by the Free Software Foundation.
How to use this License for your documents
To use this License in a document you have written, include a copy of the License in the
document and put the following copyright and license notices just after the title page:
Copyright (c) YEAR YOUR NAME. Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version 1.1 or any later
version published by the Free Software Foundation; with the Invariant Sections being LIST
THEIR TITLES, with the Front-Cover Texts being LIST, and with the Back-Cover Texts being
LIST. A copy of the license is included in the section entitled "GNU Free Documentation
License".
If you have no Invariant Sections, write "with no Invariant Sections" instead of saying
which ones are invariant. If you have no Front-Cover Texts, write "no Front-Cover Texts"
instead of "Front-Cover Texts being LIST"; likewise for Back-Cover Texts.
If your document contains nontrivial examples of program code, we recommend releasing these
examples in parallel under your choice of free software license, such as the GNU General
Public License, to permit their use in free software.
Credits
-- UnKnown --
|