PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

1
vote
7answers
162 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
27
votes
2answers
3k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
0
votes
1answer
39 views

Tor, PGP and Tor Entrance Nodes

Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
0
votes
0answers
11 views

Is it possible to setup Enigmail for Thunderbird, so that signatures are sent as attachments? [migrated]

In a PGP sign only email, I find that when I use Enigmail, the signature is part of the body of the email and is pretty painful to read on say a browser. I have seen others send signed email where the ...
2
votes
2answers
66 views

PGP/GPG verifying authenticity

My apologies in advance if this is the wrong section to post in or if this question has been asked before. I'll try to keep this as short as I can. My boss recently implemented a new security system ...
0
votes
0answers
31 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
1
vote
2answers
85 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
3
votes
4answers
44 views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
1
vote
3answers
114 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
0
votes
1answer
30 views

What is “web of trust” in PGP and S-MIME? [duplicate]

I'm studying network and system security and I came across the phrase Web of Trust: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
1
vote
3answers
57 views

PGP and S-MIME What is web of trust?

I'm studying network and system security and i came across the phrase Web of Trust! In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
0
votes
3answers
56 views

What does the pgp public key length depend on?

What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?
1
vote
2answers
38 views

Is PGP web of trust exportable?

I know that in local PGP keyrings, there's an idea of trust: I trust this key ultimately, this key less than that, etc. Is this web-of-trust exportable? For example, if I trust someone@openssl.org ...
3
votes
1answer
31 views

Transferring of keys from key servers to recipients

When I download PGP keys from keyservers like so: gpg --search-keys steve@openssl.org How are the public keys transferred down to my machine? Is there a possibility of a MITM attack to serve me the ...
1
vote
1answer
44 views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...
1
vote
1answer
85 views

How are private keys (sMIME, PGP, etc) synchronized across a user's devices?

Given that user needs to store a copy of the same private key on each of his devices (in order to decrypt email and other data encrypted with the public key) ... what are some general techniques for ...
1
vote
1answer
12 views

Should I sign the CAcert key?

Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too. Question: Cacert ...
3
votes
1answer
64 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
5
votes
3answers
212 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
2
votes
1answer
79 views

Why do I have keys of strangers in my GPG keychain?

I'm going though my GPG keychain. I've got a key for a few strangers in my keychain. I don't recall exchanging keys and I'm not sure how the public keys came to be installed in the keychain. I think ...
2
votes
1answer
45 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
1
vote
1answer
122 views

PGP as method of sharing AES key?

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption? Server sends PGP public key Client generates (uses as AES key for ...
1
vote
1answer
46 views

How to validate the confirmation link received when publishing a new PGP key?

I find PGP to be quite a complex subject. I have gotten to a point where I need to give a client a public key for encryption. I have successfully done my homework, generating a public key from my ...
3
votes
1answer
84 views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
2
votes
1answer
81 views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
3
votes
4answers
76 views

Does a PGP signature provide integrity verification?

Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files. Simply put, do PGP signatures provide file integrity ...
1
vote
1answer
192 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
3
votes
2answers
118 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
38 views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K ...
0
votes
1answer
41 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
3
votes
1answer
94 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
66
votes
5answers
10k views

What was so dangerous about PGP that its creator was charged in court for it?

I was reading up on the history of the PGP encryption software when I realised its creator was under criminal charges for munitions export without a license for releasing the source code of PGP. ...
1
vote
3answers
128 views

OpenPGP Master Key Size

I want to start using OpenPGP, so I read about it. I have a question about key size. Currently the default maximum key size is 4096. I know this can be changed by recompiling the software, and I ...
1
vote
0answers
64 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
1
vote
0answers
155 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
0
votes
2answers
44 views

How can I verify the GPG signature is valid?

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I ...
5
votes
2answers
93 views

Does RNG play a role in PGP signing?

We have a Jenkins system that builds and PGP-signs software releases, and we are considering moving the signing component to an isolated VM instead of running it as part of the overall builder ...
2
votes
4answers
137 views

Can I use elliptic curve DSA in a secure message service?

I'm looking to design a system that allows a user of a crypto-coin such as Bitcoin to both have an online wallet and to be able to send and receive encrypted emails in the same system. The relevant ...
1
vote
2answers
200 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
2
votes
2answers
136 views

If I change my private key PGP passphrase, will the old private key+old passphrase work to decrypt already encrypted data?

Suppose I have a script that contains my PGP private key in plain text and requires me to manually type in the key passphrase to decrypt some data. Later, I decide that my passphrase is compromised ...
2
votes
1answer
143 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
0
votes
1answer
151 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
4
votes
1answer
38 views

PGP keys varying only in attached signatures

Here is a few questions revolving around the same core problem. Let's say I generate a PGP keypair. I now get the keypair signed by person A at signing party X. In the evening, I give my now-signed ...
0
votes
1answer
54 views

Is a PGP revocation certificate sensitive?

In relation to an openpgp key on a smartcard: Besides revoking the key, is there anything else it can be (ab)used for? Can I just ensure it's reliably stored but not worry about it's confidentiality? ...
2
votes
2answers
80 views

What to do if you ever lose a smart card?

I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks. My idea is to generate the key using GnuPG on an isolated computer, ...
0
votes
1answer
60 views

Use same PGP key for private and business mail addresses [duplicate]

I'm asking myself which one is better: Use the same PGP key pair for use with both private email addresses and business email addresses Use two separate PGP key pairs, one for private and one for ...
3
votes
2answers
104 views

The best way to change my pgp key

I would like to change my pgp key because I have the same one 2 years ago. But, I want to warn my freinds that the owner of the old key and the owner of the new one is the same person (me). hwat is ...
7
votes
3answers
2k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...