PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

-3
votes
0answers
17 views

Tails and GPG and IMAP and anon [on hold]

What is the best free email provider to use with tails clawsmail?
2
votes
2answers
111 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
-1
votes
0answers
23 views

Is there a GPG-compatible tool that downloads all the keys that have signed some of my downloaded keys? [closed]

I just had my first key signing party with just some friends from a much bigger group of loose friends. So I signed a few keys within the big group, but it is safe to assume that a lot of people in ...
1
vote
2answers
46 views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
0
votes
1answer
12 views

Keep GPG revocation certificate in safe place?

Do I have to keep the revocation certificate of my GPG key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines? I know that, if compromised, the certificate can be ...
0
votes
2answers
42 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
1
vote
3answers
47 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
0
votes
2answers
37 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
1
vote
2answers
132 views

PGP Encryption - Whats the need to encrypt using random one time key? [duplicate]

I just read about PGP encryption scheme here, and started wondering what is the need to encrypt the file with a one time random key? In other words, how is this scheme more secure than simply sending ...
1
vote
7answers
175 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
28
votes
2answers
3k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
0
votes
1answer
53 views

Tor, PGP and Tor Entrance Nodes

Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
2
votes
2answers
77 views

PGP/GPG verifying authenticity

My apologies in advance if this is the wrong section to post in or if this question has been asked before. I'll try to keep this as short as I can. My boss recently implemented a new security system ...
0
votes
0answers
32 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
1
vote
2answers
92 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
4
votes
4answers
66 views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
1
vote
3answers
162 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
0
votes
1answer
34 views

What is “web of trust” in PGP and S-MIME? [duplicate]

I'm studying network and system security and I came across the phrase Web of Trust: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
1
vote
3answers
64 views

PGP and S-MIME What is web of trust?

I'm studying network and system security and i came across the phrase Web of Trust! In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
1
vote
3answers
78 views

What does the pgp public key length depend on?

What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?
1
vote
2answers
38 views

Is PGP web of trust exportable?

I know that in local PGP keyrings, there's an idea of trust: I trust this key ultimately, this key less than that, etc. Is this web-of-trust exportable? For example, if I trust someone@openssl.org ...
3
votes
1answer
32 views

Transferring of keys from key servers to recipients

When I download PGP keys from keyservers like so: gpg --search-keys steve@openssl.org How are the public keys transferred down to my machine? Is there a possibility of a MITM attack to serve me the ...
1
vote
1answer
52 views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...
1
vote
1answer
99 views

How are private keys (sMIME, PGP, etc) synchronized across a user's devices?

Given that user needs to store a copy of the same private key on each of his devices (in order to decrypt email and other data encrypted with the public key) ... what are some general techniques for ...
2
votes
1answer
25 views

Should I sign the CAcert key?

Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too. Question: Cacert ...
3
votes
1answer
67 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
5
votes
4answers
256 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
2
votes
1answer
84 views

Why do I have keys of strangers in my GPG keychain?

I'm going though my GPG keychain. I've got a key for a few strangers in my keychain. I don't recall exchanging keys and I'm not sure how the public keys came to be installed in the keychain. I think ...
2
votes
1answer
47 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
1
vote
1answer
155 views

PGP as method of sharing AES key?

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption? Server sends PGP public key Client generates (uses as AES key for ...
1
vote
1answer
50 views

How to validate the confirmation link received when publishing a new PGP key?

I find PGP to be quite a complex subject. I have gotten to a point where I need to give a client a public key for encryption. I have successfully done my homework, generating a public key from my ...
3
votes
1answer
92 views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
2
votes
1answer
100 views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
3
votes
4answers
83 views

Does a PGP signature provide integrity verification?

Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files. Simply put, do PGP signatures provide file integrity ...
1
vote
1answer
278 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
3
votes
2answers
147 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
50 views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K ...
0
votes
1answer
54 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
3
votes
1answer
99 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
66
votes
5answers
10k views

What was so dangerous about PGP that its creator was charged in court for it?

I was reading up on the history of the PGP encryption software when I realised its creator was under criminal charges for munitions export without a license for releasing the source code of PGP. ...
1
vote
3answers
143 views

OpenPGP Master Key Size

I want to start using OpenPGP, so I read about it. I have a question about key size. Currently the default maximum key size is 4096. I know this can be changed by recompiling the software, and I ...
2
votes
0answers
69 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
2
votes
0answers
165 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
0
votes
2answers
47 views

How can I verify the GPG signature is valid?

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I ...
5
votes
2answers
94 views

Does RNG play a role in PGP signing?

We have a Jenkins system that builds and PGP-signs software releases, and we are considering moving the signing component to an isolated VM instead of running it as part of the overall builder ...
2
votes
4answers
152 views

Can I use elliptic curve DSA in a secure message service?

I'm looking to design a system that allows a user of a crypto-coin such as Bitcoin to both have an online wallet and to be able to send and receive encrypted emails in the same system. The relevant ...
1
vote
2answers
224 views

How to maintain security and trust with a PGP keypair for a team or group of people?

I've seen many instances where a company or organization generates and uses a PGP keypair for a team or group of people. Most likely they all have a copy of the private and public keys on their ...
2
votes
2answers
148 views

If I change my private key PGP passphrase, will the old private key+old passphrase work to decrypt already encrypted data?

Suppose I have a script that contains my PGP private key in plain text and requires me to manually type in the key passphrase to decrypt some data. Later, I decide that my passphrase is compromised ...