Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

1- what does "use NAME as default secret key" do in Kleopatra tool options?

The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when encrypting several files. So does the option in question replaces my long passphrase with my name? is that what this is?

2- One more thing, I encrypt my files to upload them to dropbox, I don't need to sign them, right? It's just my own files, not sending them to anyone.

3- and lastly, will it make a difference to use long or short passphrase when creating a certificate? Now that I think about it, the file is going to be RSA 4096 encrypted! What difference does the passphrase make?

Thanks.

PS. A recommendation of (current, up to date) 3 Information Security books would be VERY helpful. I don't want to make a separate question just for this :) 1 or 2 Beginner level (introductory) 1 Intermediate 1 Advanced

Double Thanks :)

UPDATES:

So I've read the documentation (that I found by coincidence when looking for something else)

Answers to my own questions (for future users who might have the same question):

1- Still needs an answer!

2- Signing is used to let others know that I truly was the one to send the file. So no, I don't need to sign it when just backing up to dropbox.

3- Passphrase is used as a layer of protection for MY OWN certificate. Say my computer was stolen, or that a hacker got a hold of my certificate file, that passphrase is what will protect my certificate from unauthorized access and thus the hacker won't ever be able to forge sent data and pretend to be from me. The longer that passphrase the harder it is to crack.

QUESTION 1 still needs an answer and books recommendation is even more important now. This is an AMAZING science :D

share|improve this question

1 Answer 1

up vote 0 down vote accepted

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when encrypting several files. So does the option in question replaces my long passphrase with my name? is that what this is?

The "default secret key" is the key that Kleopatra will use to sign files with if you don't specify a specific key.

Note that if you're purely encrypting a file, no secret key is involved at all, and thus no passphrase is involved. It's the decryption (or signing) that requires the secret key.

3- and lastly, will it make a difference to use long or short passphrase when creating a certificate? Now that I think about it, the file is going to be RSA 4096 encrypted! What difference does the passphrase make?

No, your symmetric key is RSA 4096 bit encrypted. Your file is encrypted with the public key you're encrypting to's most preferred symmetric cipher that your software supports. From the command line, use "gpg --edit-key " and the "showpref" to see that public key's preferences, or "setpref" to change them; leftmost is most preferred. 3-key TripleDES and SHA-1 are always, always supported, even if they're not on the list (see RFC4880 for details). "gpg -v --version" will let you list your version's supported algorithms and the numbers they're assigned.

P.S. Your key's self-signature is probably SHA-1; if you can, generate keys at the command line with "gpg --gen-key --cert-digest-algo SHA256" or "gpg --gen-key --cert-digest-algo SHA512", and then use the edit-key setpref listed above to set your cipher preferences.

P.P.S. an example setpref line (see above) would be "setpref CAMELLIA256 CAMELLIA192 CAMELLIA128 AES256 AES192 AES 3DES SHA512 SHA384 SHA256 SHA1 BZIP2 ZIP ZLIB Uncompressed" - this has a strong preference for Camellia (EU, Japan) over AES (US); please reverse or otherwise change that as you see fit. It also does NOT list old ciphers like CAST5 or IDEA, nor broken hashes like MD5. SHA1 is listed only because it's the "must implement" hash.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.