GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

learn more… | top users | synonyms (1)

7
votes
1answer
65 views
+50

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
0
votes
0answers
37 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...
2
votes
0answers
30 views

Do I have to use an IV when using GPG with AES 256?

Do I have to use an IV when using GPG with AES 256? Or does GPG handle that for me? I've noticed that I get different results each time I run the encryption, i.e. gpg --symmetric --cipher-algo ...
2
votes
2answers
64 views

Why is GPG encrypted message size not proportional to number of recipients & file size?

I have noticed that when I am using GnuPG to encrypt a file for multiple recipients, the size of the encrypted message does not seem to be directly proportional to the number of recipients. For ...
0
votes
1answer
13 views

Can I store a GPG revoke certificate online?

It's clearly a good idea to store the revocation certificate in a way which is both secure and reliable. Cloud-based storage services are great for reliability, but of course they lack of security. ...
2
votes
1answer
26 views

Is it possible to export a GPG subkey's public component?

I'm trying to export the public component of my subkey, but all GPG will give me is the public component of my master key. The keyring is set up like this. $ gpg -K /home/alex/.gnupg/secring.gpg ...
4
votes
1answer
51 views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
2
votes
1answer
74 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
3
votes
1answer
32 views

Which actions does the GnuPG “Certify” capability permit?

Of the following three actions: Certifying / signing other people's public keys. Generating a revocation certificate. Adding & revoking subkeys. ... which ones does the Certify capability on a ...
2
votes
1answer
35 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
0
votes
0answers
22 views

Reading HTML mail with PGP/Mime encryption in Thunderbird with Enigmail [migrated]

Yesterday I asked how to configure Thunderbird with Enigmail to use PGP/Mime encryption for signing emails. This works, but I noticed one problem. I don't know if this is common to Thunderbird, or ...
1
vote
0answers
23 views

Use PGP/Mime with Thunderbird and Enigmail [migrated]

I would like to sign all my mail with my PGP key, and no matter if the recipient uses PGP or not, it should not confuse them. Last week I read a discussion that inline PGP is not good pratice, and I ...
2
votes
2answers
46 views

GPG Web-of-Trust Level [duplicate]

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
-1
votes
1answer
133 views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
2
votes
2answers
71 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
2
votes
1answer
28 views

What is validity in terms of PGP 6.5.8?

In PGP 6.5.8, there is a concept of "validity" for a key, and it shows in the user interface for each key on the keyring. What is this concept, and how to you set it so a key is considered valid?
8
votes
4answers
744 views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
1
vote
1answer
74 views

Is an anonymity network like Tor viable on top of the GPG web of trust?

The web of trust is a graph where the vertices are GPG users (actually, their keys) and the edges are cross-signatures. If we put issues of owner trust aside and assume that all participants only sign ...
1
vote
3answers
347 views

What is the difference between a key algorithm and the encryption algorithm?

I just starting to learn about PGP encryption. One thing that confuses me is the difference between a key algorithm, and an encryption algorithm. For example, lets say I have a trading partner (EDI ...
17
votes
6answers
1k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good ...
1
vote
1answer
61 views

What is the difference between “unknown” and “undefined” trust?

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
0
votes
2answers
97 views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
2
votes
1answer
73 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
2
votes
1answer
74 views

Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?

According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
1
vote
1answer
54 views

Why should I separately backup my revoke certificate

So I understand the principles behind the concept of a revocation certificate and why it should be useful to create one and back up before harm occurs. The thing is, I don't see a wide range of media ...
1
vote
2answers
67 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
2
votes
3answers
92 views

GPG keys & SHA-1

I've heard that SHA-1 hashing is becoming less secure, and that most GPG keys are secured with SHA-1. Is there a way to determined if SHA-1 is in my GPG key, and what to do if this is the case?
2
votes
2answers
109 views

Does adding multiple recipients to an encrypted message decrease security?

Let's say you want to send the same GPG/OpenPGP encrypted message to 50+ recipients. Assuming everyone you send to is trusted, and there is no risk of any recipient leaking their secret key, is ...
10
votes
2answers
236 views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
2
votes
1answer
73 views

Which PGP settings have been found to be vulnerable?

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be ...
1
vote
1answer
104 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
1answer
49 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
4
votes
1answer
64 views

How long do keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
3
votes
3answers
101 views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
3
votes
3answers
108 views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
1
vote
1answer
68 views

Replacing subkeys.

Here's a specific scenario that I have. I want to have subkeys on my laptop and store the master key safely. So I went ahead and created new keys: gpg --gen-key gpg (GnuPG/MacGPG2) 2.0.20; ...
0
votes
2answers
58 views

Can I generate multiple PGP key pairs for later use

I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I ...
2
votes
2answers
46 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...
2
votes
2answers
150 views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
2
votes
1answer
34 views

Security implication of exporting private key

I have a key pair stored in GPG Keyring. If I export it to an ASCII Armored format, am I removing any layers of security as long as the exported key stays on the same server as the key ring itself? My ...
3
votes
3answers
117 views

How do I ensure that my Ubuntu download has not been tampered with?

I am downloading Ubuntu Linux, and would like to make sure that my download has not been tampered with. Ubuntu has a GPG key, which I could use to make sure that the download is valid -- but how do I ...
0
votes
2answers
51 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
0
votes
1answer
73 views

GPG encryption and signing

Why don't the commands gpg2 --armor --sign file.txt and gpg2 --clearsign file.txt have the same output? Also when I use just --sign I get a bunch of binary gibberish surrounding the message in ...
1
vote
1answer
45 views

Security of sending information to stdout

By default, something like gpg -d file.gpg sends it's output to stdout. What happens to input that is sent to stdout? Is it possible to recover this?
0
votes
1answer
96 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
2
votes
2answers
185 views

PGP/GPG verifying authenticity

My boss recently implemented a new security system related to PGP/GPG. The whole idea behind this is to sign files so that people know from who they came. They don't require us to encrypt them, just ...
1
vote
1answer
151 views

How secure is GPG symmetric encryption?

Since I am new to encryption and have recently been losing stuff, I decided to start a file that contains some passwords for online accounts and whatnot, encrypt it, back it up (and keep a single copy ...
0
votes
0answers
39 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
0
votes
3answers
95 views

What is the technical rationale behind intermediary email servers?

EFF's Survelliance Self-Defense (SSD) project has an illustration of how email over SMTP goes through intermediate mail exchange servers: AFAIK each intermediate servers is expected to add its own ...
1
vote
1answer
153 views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...