diff --git a/pkgs/system/all-packages-generic.nix b/pkgs/system/all-packages-generic.nix
index 205a37e515d..828ec07119a 100644
--- a/pkgs/system/all-packages-generic.nix
+++ b/pkgs/system/all-packages-generic.nix
@@ -281,6 +281,11 @@ rec {
     inherit fetchurl stdenv;
   };
 
+  gnupg = import ../tools/security/gnupg {
+    inherit fetchurl stdenv;
+    ideaSupport = false; # enable for IDEA crypto support
+  };
+
   mjpegtools = (import ../tools/video/mjpegtools) {
     inherit fetchurl stdenv libjpeg;
     inherit (xlibs) libX11;
diff --git a/pkgs/tools/security/gnupg/builder.sh b/pkgs/tools/security/gnupg/builder.sh
index 0b61d421abc..c5545c7456c 100644
--- a/pkgs/tools/security/gnupg/builder.sh
+++ b/pkgs/tools/security/gnupg/builder.sh
@@ -1,3 +1,10 @@
 source $stdenv/setup
 
+preConfigure=preConfigure
+preConfigure() {
+    if test -n "$idea"; then
+        gunzip < $idea > ./cipher/idea.c
+    fi
+}
+
 genericBuild
diff --git a/pkgs/tools/security/gnupg/default.nix b/pkgs/tools/security/gnupg/default.nix
index 135eab15391..78da80bda30 100644
--- a/pkgs/tools/security/gnupg/default.nix
+++ b/pkgs/tools/security/gnupg/default.nix
@@ -1,10 +1,20 @@
-{ stdenv, fetchurl }:
+{
+  # Support for the IDEA cipher (used by the old PGP) should only be
+  # enabled if it is legal for you to do so.
+  ideaSupport ? false
+  
+, stdenv, fetchurl
+}:
 
 stdenv.mkDerivation {
-  name = "gnupg-1.4.0";
+  name = "gnupg-1.4.2";
   builder = ./builder.sh;
   src = fetchurl {
-    url = http://nix.cs.uu.nl/dist/tarballs/gnupg_1.4.0.orig.tar.gz;
-    md5 = "74e407a8dcb09866555f79ae797555da";
+    url = ftp://ftp.surfnet.nl/pub/security/gnupg/gnupg/gnupg-1.4.2.tar.bz2;
+    md5 = "c7afd50c7d01fcfada229326b3958404";
   };
+  idea = if ideaSupport then fetchurl {
+    url = ftp://ftp.gnupg.dk/pub/contrib-dk/idea.c.gz;
+    md5 = "9dc3bc086824a8c7a331f35e09a3e57f";
+  } else null;
 }