Tagged Questions

-2
votes
1answer
178 views

Cascading Encryption Algorithm using mcrypt or GnuGP

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
0
votes
3answers
45 views

Is connection to keyserver encrypted?

When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
3
votes
1answer
121 views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
2
votes
3answers
65 views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
3
votes
2answers
169 views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
-1
votes
1answer
53 views

GnuPG implementations are not cross-compatible? [closed]

Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
-2
votes
1answer
201 views

is there better email, file, disk encryption than PGP? [closed]

Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable. However, PGP has been around for a long ...
7
votes
1answer
122 views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
6
votes
1answer
70 views

What is the best way to manage package signing keys?

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment. I have initially created a signing ...
1
vote
2answers
94 views

Certificate Security in intranet Environment?

We have this topology in our company : A new rule says that each document being sent by outlook should be encrypted. we decided using PGP. We already have a certificate ( self signed). the ...
4
votes
1answer
110 views

Is OpenPGP encryption a valid replacement for SSL when passing messages?

I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
8
votes
3answers
608 views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
5
votes
1answer
144 views

Could a consumer-friendly PGP-like file encryption application theoretically be secure?

In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
2
votes
2answers
386 views

Secure way to transfer public/secret key to second computer

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
1
vote
3answers
305 views

Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations? ...
6
votes
2answers
261 views

Does using both GPG encrypted files and encrypted filesystem make sense?

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
1
vote
0answers
107 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
2
votes
1answer
134 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user ...
1
vote
1answer
610 views

Brute-force a passphrase, generated by `pwgen 16 -s`, of a GPG CAST5 archive

A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses ...
3
votes
2answers
386 views

Security of GPG encryption with AES and MD5 if MD5 is broken

I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?
2
votes
1answer
1k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
3
votes
2answers
436 views

What encryption schemes require two or 3 private keys to read a message?

I would like to encrypt some data so that it can only be read if two or three people use a private secret to decrypt the data. What is the best / most modern way to accomplish multi-person ...
7
votes
2answers
753 views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
1
vote
2answers
135 views

OpenPGP: Sign-Verify workflow without Encrypt-Decrypt?

Is it a good and/or frequent practice to sign a file (with your own private key) without encrypting it (with the intended recipient's public key?) I haven't really been able to find a direct answer to ...
0
votes
1answer
366 views

Is Data Object on openPGP smartcard v2 encrypted?

currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard. I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
5
votes
1answer
281 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
8
votes
2answers
1k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
12
votes
9answers
4k views

Encrypting email for gmail

My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
16
votes
4answers
4k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
11
votes
2answers
697 views

Flaw in encryption through pseudorandom number stream (from gpg documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
9
votes
5answers
1k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
6
votes
3answers
636 views

Is the OpenPGP private key inherently password-protected?

I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key? Essentially, ...
8
votes
3answers
437 views

Most widespread use of PGP after 20 years

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...