1
vote
0answers
49 views

Secure self-concealing symmetric encryption (non-verifiable decryption)?

From what I observed using standard encryption tools such as OpenSSH and GPG, the decryption only succeeds when the correct password/key is provided (or at most a few others, in case of collision). ...
1
vote
2answers
86 views

Does adding multiple recipients to an encrypted message decrease security?

Let's say you want to send the same GPG/OpenPGP encrypted message to 50+ recipients. Assuming everyone you send to is trusted, and there is no risk of any recipient leaking their secret key, is ...
23
votes
3answers
2k views

Tell people that I can encrypt emails

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In ...
2
votes
2answers
123 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
1
vote
7answers
192 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
0
votes
0answers
33 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
1
vote
3answers
209 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
1
vote
3answers
86 views

What does the pgp public key length depend on?

What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?
1
vote
1answer
180 views

PGP as method of sharing AES key?

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption? Server sends PGP public key Client generates (uses as AES key for ...
1
vote
1answer
436 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
4
votes
2answers
194 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
2
votes
4answers
165 views

Can I use elliptic curve DSA in a secure message service?

I'm looking to design a system that allows a user of a crypto-coin such as Bitcoin to both have an online wallet and to be able to send and receive encrypted emails in the same system. The relevant ...
1
vote
2answers
237 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
2
votes
2answers
178 views

If I change my private key PGP passphrase, will the old private key+old passphrase work to decrypt already encrypted data?

Suppose I have a script that contains my PGP private key in plain text and requires me to manually type in the key passphrase to decrypt some data. Later, I decide that my passphrase is compromised ...
2
votes
1answer
300 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
7
votes
3answers
3k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
4
votes
3answers
623 views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
-2
votes
2answers
179 views

What was the Lavabit's backdoors to their customers' e-mails? [closed]

There has been some talk about the Lavabit's case. New info was published today, but not important. I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I ...
1
vote
2answers
723 views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
1
vote
1answer
334 views

Why are the first 16 bits of the message digest not encrypted in PGP? [closed]

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. ...
7
votes
4answers
632 views

Is it safe for GPG to compress all messages prior to encryption by default?

By default, GPG compresses text during encryption. Additionally, RFC 4880 says: 2.3. Compression OpenPGP implementations SHOULD compress the message after applying the signature but before ...
0
votes
1answer
133 views

How to fetch and update all my friend's keys? [closed]

Where can I upload a list of my friends and get a list of their keys found on keyservers? Here are some key servers: http://keyserver.ubuntu.com:11371/ http://pgp.mit.edu/ ...
6
votes
3answers
485 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
3
votes
1answer
2k views

PGP RSA key size - encryption/decryption time

From what I've read, PGP only uses the pub/priv keys for encrypting/decrypting a symmetric key used for actually encrypting/decrypting data. I'd reasonably assume that longer asymmetric keys wouldn't ...
3
votes
1answer
383 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
1
vote
1answer
182 views

What's the point of public key servers, if they usually don't require any authentication at all upon upload?

Do they offer any benefits at all to the security of key distribution?
4
votes
2answers
242 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
10
votes
2answers
2k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
3
votes
2answers
522 views

How safe is a PGP private key that has “escaped”, but without its password?

Assuming your PGP private key is protected with a password, and it "escapes", but the password does not, how worried should you be? Obviously in the real world, you would immediately revoke the key ...
9
votes
4answers
2k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
-3
votes
2answers
167 views

Security and privacy in email and other communications [closed]

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
-2
votes
1answer
731 views

Cascading Encryption Algorithm using mcrypt or GnuGP

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
1
vote
3answers
97 views

Is connection to keyserver encrypted?

When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
8
votes
2answers
2k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
5
votes
3answers
742 views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
3
votes
2answers
732 views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
-1
votes
1answer
99 views

GnuPG implementations are not cross-compatible? [closed]

Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
-3
votes
1answer
1k views

is there better email, file, disk encryption than PGP? [closed]

Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable. However, PGP has been around for a long ...
8
votes
1answer
1k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
6
votes
1answer
102 views

What is the best way to manage package signing keys?

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment. I have initially created a signing ...
1
vote
2answers
157 views

Certificate Security in intranet Environment?

We have this topology in our company : A new rule says that each document being sent by outlook should be encrypted. we decided using PGP. We already have a certificate ( self signed). the ...
4
votes
1answer
376 views

Is OpenPGP encryption a valid replacement for SSL when passing messages?

I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
16
votes
3answers
2k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
6
votes
1answer
225 views

Could a consumer-friendly PGP-like file encryption application theoretically be secure?

In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
3
votes
3answers
3k views

Secure way to transfer public/secret key to second computer

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
1
vote
3answers
601 views

Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations? ...
6
votes
2answers
765 views

Does using both GPG encrypted files and encrypted filesystem make sense?

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
1
vote
0answers
189 views

OpenPGP CFB mode examples [closed]

Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow. I got one example from asking on ...
2
votes
1answer
158 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user ...