PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

1
vote
1answer
15 views

Why has my OpenPGP key been duplicated on expiry change?

I've published my OpenPGP key publicly on the MIT key server. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with. I managed to do this ...
1
vote
1answer
23 views

Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different ...
0
votes
0answers
35 views

Are there any NFC Smartcards for Smartphones [closed]

What's the best double interface (contact / contact-less NFC) Smartcard for PGP/SSH/SMIME keys (readable with for example Open Keychain, etc.) as a standard sized card to be readable by smartphones ...
0
votes
1answer
32 views

Is there a way to change the creation date of a GPG/PGP cert

How can I modify the creation date of a GPG/PGP key? I can set the Creation-Date while creating a key. But can I change this Creation-Date after the key was created? I cannot find how to do this.
2
votes
1answer
63 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
0
votes
1answer
21 views

What does the letter in an OpenPGP key's bits definition (like 4096D) denote?

I noticed that when looking at OpenPGP keys on a key server, the key's bits definition is usually followed by a letter, as in "4096D" for example. However, there are also keys with other letters than ...
0
votes
0answers
12 views

Risk to pgp secret keys with known cleartext/ciphertext? [duplicate]

There are a couple of schemes which encrypt IMAP message stores to yourself using GPG/PGP. Which makes initial sense and would keep casual snoopers from getting email. But it raises a question as ...
1
vote
1answer
20 views

Are PGP/GnuPG trust information transferred to key servers?

When signing a key X in the PGP Web of Trust model, I assign the key full validity. Other people who have my key in their key ring can regard X as valid as far as they fully trust me (owner trust). ...
18
votes
5answers
1k views

Considerations for long-term key storage (paper backup, media for vault storage)?

I'm reviewing our company's security procedures regarding cryptographic keys and master passwords, and also my private system at home. The key generation process is pretty much the same as that ...
0
votes
2answers
23 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
2
votes
1answer
24 views

Merge a second OpenPGP key pair into user id of other key

I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from ...
1
vote
1answer
20 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
-2
votes
2answers
48 views

Are these statements correct [closed]

Are the following three statements more or less correct: -To send someone an encrypted email basically entails having access to their public key (either smime or pgp). Thus for all practical ...
2
votes
1answer
24 views

Is it okay to omit the 'Version:' line in a PGP public key? [duplicate]

The software I use to generate my PGP keys doesn't include the 'Version:' line that most PGP software includes by default. Almost every public key I've seen begins like this: -----BEGIN PGP PUBLIC ...
4
votes
2answers
225 views

Sharing RSA keys between PGP and SSH protocols: Does this pose a security risk?

If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? When I do, should I ...
0
votes
2answers
41 views

Signing an OpenPGP public key that is not uploaded to a key server

Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has ...
1
vote
1answer
48 views

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

The OpenPGP key contains a list of personal algorithm preferences (the meaning of the numbers can be decoded in RFC 4880): # gpg -a --export "foo@example.com" | gpg --list-packets | fgrep 'pref-' ...
2
votes
1answer
143 views

How to tell if my OpenPGP public key is self-signed?

I recently read: You should sign your PGP public key immediately after generating your public/private key-pair. And now I wonder how I can check whether I already did that. So my question is: ...
-1
votes
4answers
127 views

What mail applications use crypto?

I just read that everyone in the world can ready my mails (if intercepted in traffic by eavesdropping?). Also, it reads that current versions (book's from 2004 so I assume that new versions adopt ...
3
votes
1answer
65 views

How to decrypt email with revoked key in enigmail?

Is it possible to decrypt a message which is encrypted with a revoked PGP key? I still have the private key, but Enigmail doesn't show me revoked keys neither does automatic decryption. Edit: I ...
3
votes
1answer
104 views

toy OpenPGP encryption with manually generated keys

I've been playing around with OpenPGP encryption for a little while. Here are the steps I've followed: Generate an unencrypted public/private key pair in my keyring with gpg --gen-key. Dump the ...
5
votes
1answer
69 views

Master offline key, shared encryption/decryption key, unique signing keys?

I've read quite a few different articles on how to setup PGP keys with an offline master key. I own multiple YubiKey NEO hardware smart cards which I intend on using for PGP and as an SSH key. One of ...
0
votes
1answer
29 views

Risk of pgp-key to be compromised on smartphone [closed]

What risks to compromise my key, aside from the risk of the phone to be stolen, do I face when I use my private pgp key on a Motorola smartphone with the K-9-app? Can I mimimize the risk by using a ...
8
votes
3answers
555 views

Does OpenPGP encryption mean that not even I can see my data?

Say I have an email and I want to send it to someone else. I encrypt it with his public key. This ensures that only he can read my message. Does this also means that I won't be able to read it? If so, ...
3
votes
1answer
64 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
4
votes
2answers
133 views

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here. I know that, PGP and S/MIME ...
0
votes
2answers
72 views

Is it possible that to sign a message with a PGP key in a way that leakes the key

Alice provides a software for signing messages. The software runs in a airgapped enviroment. The software is given the message that's to be signed and the private key. The software then produces a ...
2
votes
1answer
50 views

GPG: What public key do I have to publish?

I just created a master key and two subkeys. The first subkey is used for encryption, the second one for signing. Now i am wondering what public key do I have to publish on my website. Does is ...
5
votes
1answer
138 views

Can I check who can decrypt my GPG message after I encrypt it?

When I send, say, a great recipe for funnel cake to Alice and Bob using GPG, I can be pretty sure they will both be able to decrypt it. However, can I be certain, or prove after the fact, that they ...
2
votes
1answer
131 views

PGP key on smart card: why do I need a “secret key” on disk?

I have a YubiKey NEO on which I have the OpenPGP applet and I have a PGP key installed. I work on 3 different computers and I initialized the card on computer bob. I'm now at computer rob. Someone ...
1
vote
0answers
40 views

OpenPGP (RFC4880) - do you agree with my SimpleS2K (string-to-key) implementation?

Background: I'm writing a GPL Python OpenPGP to JSON parser which I'm testing on files generated with GPG 1.4.16. If given a passphrase, the parser will generate keys using the string-to-key methods ...
0
votes
1answer
73 views

What is the risk of using SHA1 in PGP email signatures?

SHA-1 is being phased out by a lot of major companies due to vulnerabilities. For example Chrome no longer considers it safe for public web PKI. Is it insecure to use SHA-1 for PGP email signatures?
2
votes
4answers
47 views

Is PGP or S/MIME useful when both servers are self-controlled?

With regards to encryption and preventing a 3rd party from viewing my emails (and ignoring validity/signing), is encrypting an email via PGP or S/MIME useful when I control my server and my recipient ...
4
votes
2answers
95 views

Do GPG and OpenSSH use key stretching on their keypairs?

Both OpenSSH and GPG can generate key pairs which are stored as files in well-known paths inside the user directory. A passphrase is always asked for during the generation process, which is then used ...
2
votes
1answer
76 views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
5
votes
1answer
303 views

What are the security differences between SMIME email and PGP email? [closed]

Outside of key distribution, and specific to the technical details relating to encrypted email data (message body), what's the difference between SMIME and PGP? Example comparisons Security ...
5
votes
2answers
93 views

Why don't PGP keyservers enforce double-opt-in?

One thing that I found out when starting using PGP: When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be. Since a PGP key contains ...
1
vote
1answer
44 views

Using scrypt to encrypt data in a session variable

Let's say I want to store some data in the node's session, for example, like an authenticity token. Obviously I want to store it in an encrypted way if it's going in a cookie, then decrypt it on a ...
1
vote
1answer
44 views

PGP: Can I just upload my public part of encryption sub key to PGP server?

I'm a little bit confused here, since the best practice suggests that main key should be completely offline, so which key should I upload to the public directory? Here's what I have: main key (sign ...
2
votes
3answers
399 views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by Textsecure and is an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have ...
3
votes
3answers
481 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
3
votes
1answer
73 views

Ability to determine which PGP public keys a message has been encrypted for?

Is it possible to determine, given a PGP message that you can already decrypt, to determine which other PGP keys that message has also been encrypted for?
-1
votes
1answer
48 views

Do we need to same PGP version for decryption [closed]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...
4
votes
2answers
463 views

When signing email with GPG, how does verification by the receiver work?

I use GPG to sign my outgoing emails. I understand how it works when I encrypt mail to send to someone else. Then I need his/her public key, encrypt it with that, and only he can decrypt it using ...
1
vote
1answer
34 views

Should I verify installer file PGP hash?

Let's say that I'll download an installer for a program on Windows and the publisher has released PGP Signature for the file. The installer file does not have any code signing certificates. If I ...
1
vote
1answer
197 views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
4
votes
2answers
167 views

PGP question decrypting my own message from 2 days ago

I have recently started using pgp and am still in the infancy stages with knowledge. i sent a friend an encrypted message using pgp4usb. a few days later they responded, with relevant info, being ...
4
votes
1answer
77 views

When should I sign a PGP key with a non-revocable signature?

GnuPG allows the user to sign a key with a non-revocable signature. I have done this when I’m signing one of my own keys—signing my personal key with my work key, for instance. Is there any other ...
2
votes
1answer
61 views

How are private keys encrypted?

I've just got back into the swing of using pgp and I'm wondering how the private key is encrypted (using the passphrase to decrypt). This has got to written down somewhere, but in my searches the vast ...
1
vote
1answer
50 views

Implement GPG Verification (Bitcoin-OTC)

I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would ...