Install GnuPG and generate keys (example with one database server and two account servers)

Download GnuPG

·	Go to http://www.gnupg.org, download "Precompiled binaries for MS-Windows 95, 98 and NT" and if necessary, other version for the database server.

Install GnuPG on both the account servers and the database server

·	Extract "gpg.exe" from "gnupg-w32-1.0.6.zip" to "c:\gnupg". (If you choose another directory this must be specified in the registry under \\HKEY_CURRENT_USER\Software\GNU\GnuPG\HomeDir, for more information see README.W32 in the GnuPG zip.)

Generate encryption keys on the servers

·	Open a DOS window, go to c:\gnupg, enter "gpg --gen-key"

·	Choose key type DSA/ElGamal

·	Choose key size 1024 bits

·	Choose 0 = keys do not expire

·	Choose user ID on the database server, for example - name = "Database server location", e-mail = "dbserver@location.se", and on the account servers, for example "Account server 1 location", e-mail = "a1@location.se" and "Account server 2 location", e-mail = "a2@location.se"

·	Choose the passphrase that protects the secret key (not completely necessary in this case).

Export the public keys

·	At the dos prompt, enter "pgp --export -a -o e-mail" (e-mail = "dbserver@location.se", "a1@location.se" and "a2@location.se")

Transfer and import public key files

·	Transfer the file "dbserver@location.se" to each account server and import it by entering "gpg --import dbserver@location.se"

·	Transfer the file "a1@location.se" to the database server and import it by entering "gpg --import a1@location.se"

·	Transfer the file "a2@location.se" to the database server and import it by entering "gpg --import a2@location.se"

How to encrypt and sign data files at the database server

The database server runs the following commands to sign (with the private key of the database server) and encrypt (with the public keys of the account servers) the files "data_k1.txt" and "data_k2.txt":

·	"echo password| gpg -u dbserver@location.se -r a1@location.se --armor --sign --encrypt --passphrase-fd 0 data_k1.txt"

·	"echo password| gpg -u dbserver@location.se -r a2@location.se --armor --sign --encrypt --passphrase-fd 0 data_k2.txt"

These commands creates the files "data_k1.asc" and "data_k1.asc", which are mailed to the account servers where SetupBatcher decrypts them by calling GnuPG.