3
votes
1answer
54 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
2
votes
1answer
121 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
6
votes
3answers
2k views

When changing a PGP passphrase, does it only affect the private key?

I am beginning to use GPG for email encryption. If I use gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
9
votes
2answers
460 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
3
votes
1answer
415 views

Recognizing PGP-encrypted disks

I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS. I am interested to know how an encrypted partition/disk/file with a particular ...
3
votes
1answer
1k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
4
votes
1answer
227 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
3
votes
2answers
542 views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
1
vote
0answers
164 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
1
vote
1answer
187 views

PGP Secret Key Values calculation

I know this is somewhat counterintuitive, but: Does anyone know of any place where I might get intermediate values from PGP when it decrypts the secret values of the Secret Key packets and shows ...
2
votes
1answer
2k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
1
vote
2answers
168 views

OpenPGP: Sign-Verify workflow without Encrypt-Decrypt?

Is it a good and/or frequent practice to sign a file (with your own private key) without encrypting it (with the intended recipient's public key?) I haven't really been able to find a direct answer to ...
0
votes
1answer
655 views

Is Data Object on openPGP smartcard v2 encrypted?

currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard. I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
6
votes
3answers
3k views

Generate a PGP key with more than 4096 bits?

I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?
22
votes
4answers
12k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
14
votes
2answers
1k views

Flaw in encryption through pseudorandom number stream (from gpg documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
3
votes
1answer
253 views

self-signatures using SHA1

This page says: self-signatures must not use SHA1 You can check this by doing: gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep ...
10
votes
5answers
2k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
6
votes
3answers
1k views

Is the OpenPGP private key inherently password-protected?

I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key? Essentially, ...
10
votes
2answers
1k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
8
votes
3answers
577 views

Most widespread use of PGP after 20 years

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
18
votes
6answers
1k views

Shouldn't GPG key fetching use a secure connection?

If I run this for example: gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451 then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
3
votes
4answers
418 views

Generating OpenPGP key pair with restrictions

I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
15
votes
2answers
5k views

How does RSA encryption compare to PGP?

On this answer ck says RSA and PGP are different. What you are essentially asking is how do I run my petrol car on diesel? The answer is you can't. I would be interested in a more ...
13
votes
2answers
2k views

GnuPG/OpenPGP Key Practices

I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
51
votes
6answers
22k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...