The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
37 views

GPG encryption and signing

Why don't the commands gpg2 --armor --sign file.txt and gpg2 --clearsign file.txt have the same output? Also when I use just --sign I get a bunch of binary gibberish surrounding the message in ...
2
votes
0answers
27 views

How do I verify a GPG symmetrically encrypted file? [migrated]

I created an encrypted file with symmetric encryption. gpg -c 50GBfile Now I want to delete the original. Before I delete the original, I want to verify the integrity of the encrypted file. Does ...
1
vote
1answer
39 views

Security of sending information to stdout

By default, something like gpg -d file.gpg sends it's output to stdout. What happens to input that is sent to stdout? Is it possible to recover this?
0
votes
1answer
60 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
2
votes
2answers
66 views

PGP/GPG verifying authenticity

My apologies in advance if this is the wrong section to post in or if this question has been asked before. I'll try to keep this as short as I can. My boss recently implemented a new security system ...
0
votes
1answer
46 views

A few GPG questions

Since I am new to encryption and have recently been losing stuff, I decided to start a file that contains some passwords for online accounts and whatnot, encrypt it, back it up (and keep a single copy ...
0
votes
0answers
31 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
0
votes
3answers
57 views

What is the technical rationale behind intermediary email servers?

EFF's Survelliance Self-Defense (SSD) project has an illustration of how email over SMTP goes through intermediate mail exchange servers: AFAIK each intermediate servers is expected to add its own ...
1
vote
1answer
45 views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...
1
vote
1answer
13 views

Should I sign the CAcert key?

Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too. Question: Cacert ...
2
votes
1answer
53 views

Can I reencrypt my GPG private key with more password rounds?

As noted elsewhere, SSH private keys can be reencrypted (in different formats) with more rounds of iteration in the password-derivation function. Is there a way to do something similar for an already ...
2
votes
1answer
84 views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
1
vote
1answer
201 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
3
votes
2answers
120 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
40 views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K ...
1
vote
3answers
135 views

OpenPGP Master Key Size

I want to start using OpenPGP, so I read about it. I have a question about key size. Currently the default maximum key size is 4096. I know this can be changed by recompiling the software, and I ...
0
votes
2answers
45 views

How can I verify the GPG signature is valid?

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I ...
1
vote
1answer
149 views

How does gpg know that a passphrase is bad in symmetric encryption?

Following from, What information is leaked from an OpenPGP encrypted file?, which was very helpful, I'd like to ask a similar question regarding symmetric encryption. For example, in a file encrypted ...
0
votes
1answer
49 views

Twofish gpg:WARNING: message was not integrity protected [closed]

I get this warning while I decrypt a Twofish-encrypted file in GPG. WARNING: message was not integrity protected. From what I found online, this warning should only come up for CAST5, not for ...
2
votes
1answer
143 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
0
votes
1answer
37 views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
1
vote
2answers
657 views

gpg --encrypt fails

When trying to encrypt files, I get the following error in KGpg editor window: The encryption failed with error code 2 On the command line I get: $ gpg --list-keys /home/user/.gnupg/pubring.gpg ...
2
votes
3answers
80 views

Is it a good practice to include a download URL of my GPG public key in my email signature?

I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature. Is this a good practice? If not, what's a good alternative?
2
votes
2answers
109 views

GPG key trust after a signing party

I might be totally misunderstanding the concept of web-of-trust, but imagine the following scenario: I generate my key, then go to a key signing party, and after, I import all the keys which ...
56
votes
10answers
7k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
0
votes
1answer
134 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
1
vote
2answers
169 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does GPG key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
2
votes
1answer
139 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
0
votes
0answers
50 views

What is the impact of the recent GPG acoustic key sniffing research? [duplicate]

I heard of the recent research that claims to have made possible the sniffing of even 4096-bit GPG keys under certain conditions. What is the impact of this vulnerability for home users? If this is a ...