Questions tagged [pgp]
PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.
714
questions
16
votes
5
answers
4k
views
Is it possible to sign Git commits on a different computer?
I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
1
vote
1
answer
24
views
Allow one of many encryption/signature algorithms for single public key certificate
Let's say a user creates their primary gpg key pair for User Name <[email protected]> and selects an encryption and signing algorithm that isn't widely available (think goldilocks). For instance, ...
0
votes
0
answers
17
views
How to recover my password from my file.key [duplicate]
I don't remember my passphrase for my PGP key that was created several years ago.
How can I decrypt my file.key to recover it?
Or what should I do to recover it from my file.key?
0
votes
1
answer
59
views
Convert PGP key to X.509?
Can I convert a PGP key to X.509, using OpenSSL or GNUPG?
Aren't these only container/wrapper formats?
4
votes
1
answer
207
views
Should one really disable AEAD for recent GnuPG created PGP keys?
Apparently, there are some problems with the new defaults that are set when one creates a PGP key using a recent version of GnuPG (2.4).
I ran into this after generating a new ECC/ED25519 key to ...
0
votes
0
answers
24
views
recovering a pgp private key [migrated]
My backup of my private key for my gpg key was deleted by mistake when I reinstalled kleopatra software and I need to get my PGP working again!
I need help, how can I recover my private key?
0
votes
0
answers
4
views
Encrypting with generic GPG key in gpg4win [migrated]
One of our business partners has a PGP domain key where the key is valid for encryption to any email address of the business.
The user id of the key is like [email protected] - and for the life of ...
0
votes
0
answers
71
views
These two pgp public keys are the same but different?
I'm doing some research on .onion websites and was trying to verify an onion URL.
I got a public key from two different sources: side by side they are identical until about ten lines before the end. ...
0
votes
0
answers
61
views
How does trust work in PGP?
I am trying to understand in detail how does one "express" trust in someone else's public key in PGP.
As far as I know, in PGP you associate uids (for simplicity, say that these are emails) ...
2
votes
0
answers
104
views
PGP expired encryption subkey : renew or replace?
I am in the process of learning PGP (GnuPG more precisely).
I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
0
votes
0
answers
65
views
Revoking a digital signature at the cryptographic level
How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid?
I'm talking of recalling a signed document, not revoking the ...
0
votes
1
answer
78
views
Does an official IETF-codified URN exist for PGP keys?
I've been able to locate http://www.aaronsw.com/2002/draft-swartz-pgp-urn-00, but it appears to be an unofficial proposal never submitted to the IETF. Does it hold any water?
4
votes
1
answer
173
views
GPG allows importing an invalid secp256k1 public key
I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
0
votes
1
answer
193
views
Why is ECC (Eliptical Curve) an `--expert` feature in PGP?
Eleptial Curve is now included in PGP. However when I run gpg2 --full-gen-key, I get
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
...
1
vote
1
answer
87
views
With selfhosting email server, selfsigned certificate, does it make a difference with PGP mail, What can be leaked?
If we are self hosting our own email server with mydomain.com with a self sign CA for S/MIME. What are some possible ways that our email content can get leaked?
Then if we use PGP email, does it make ...
0
votes
2
answers
614
views
Backup GPG private key in KeePassXC
In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field.
Provided that the db file has very good password, is this ...
0
votes
1
answer
218
views
What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts
What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts?
Use case, both of parties use third party ...
0
votes
1
answer
89
views
How can we ensure the best practice with mail pgp when the recipient is not using it?
How can we ensure the best practice with mail pgp when the recipient is not using it?, so when Bob send the vary first email to Alex, Bob signing and encrypted it?
Q1. In that case, Is Alex able to ...
2
votes
1
answer
829
views
PGP key pair - How to set up for multiple users to decrypt messages with Kleopatra
This is my first project of this nature, and I am hoping this is a basic use case for PGP encryption. Please forgive my ignorance!
There is a server being configured by a service provider (SP). The SP ...
1
vote
0
answers
169
views
Why does the fingerprint of a GPG key change after it is made a sub key?
I recently consolidated some of my independently GPG keys.
I used the following the command to edit the oldest key
gpg --expert --edit-key <oldest-keygrip>
gpg> add-key --keygrip=<another-...
1
vote
2
answers
559
views
what is the safest way to open/decrypt an encrypted gpg/pgp file in memory | gnu/linux debian?
I would like to open/decrypt an encrypted gpg/pgp file in the main memory without leaving any footprints on the file system including swap,etc.
what is the safest option on a gnu/linux debian from ...
1
vote
0
answers
105
views
Login with self-signed PGP/GPG cert. without security key
Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal ...
0
votes
1
answer
91
views
Is my PGP key which I uploaded to sync.net compromised?
I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
3
votes
2
answers
1k
views
Brute forcing lost password for PGP encrypted file (symmetric)
I have a file I encrypted with PGP in 2003. It contains some personal data I'd like to regain access to. I have vague idea of the password, but not enough to successfully guess; but I know its ...
1
vote
1
answer
78
views
How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?
I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party ...
1
vote
0
answers
98
views
Can an email address attached to key be traced back to me? [closed]
I used my actual protonmail email address at the start of creating my own key. Can this email address be traced to me?
So when I sign something with my key and it's decrypted, can anyone see the email ...
1
vote
0
answers
329
views
Which PGP fingerprint to share/publish as my digital identity?
The primary secret key should be stored offline and only be used for creating/signing keys.
There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
1
vote
1
answer
413
views
What is the purpose of PGP email signatures?
As far as I understand, the only purpose of PGP signatures is to prove your identity. Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email ...
1
vote
0
answers
130
views
Using GPG is there a way to label public keys on my OpenPGP keyring?
I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
3
votes
1
answer
4k
views
What are the security implications of using GPG instead of SSH keys for authentication
I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
0
votes
1
answer
782
views
PGP identity for Telegram account
I want to use a Telegram username instead of an email address in a PGP key.
Is there an agreed upon standard for doing this? Do you know a software or service which acts as a bridge to connect a PGP ...
0
votes
0
answers
154
views
PGP public key flagged as malicious to root. Was ran before
Hello I had used this pgp public key on my win10 OS with pgptool to message someone.
Then when i used that same public key in whonix OS console it came back with some type of warning about malicious ...
0
votes
0
answers
119
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
4
votes
0
answers
382
views
Best practices for GPG user ids and mail extensions / catch-all addresses
Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
0
votes
1
answer
403
views
deleted a subkey and can now no longer decrypt
My public key had expired so I tried to edit the expiry date with
gpg --edit-key
It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
2
votes
1
answer
976
views
Best practices for verifying authenticity of public key
When one desires to share their public key openly, besides sharing just the key itself:
How does one verify that the key belongs to who it claims to be owned by?
What is the use case of the key's ...
2
votes
1
answer
492
views
Why a public key must be signed with its private pair in PGP
I know about the trust web in PGP. When you sign a key, everybody that trusts you will trust the person with that key. But what is the point of self-signing a key when anybody else can do that with ...
3
votes
1
answer
173
views
Why are key IDs typically the *last* digits of the key hash?
With PGP for example, the "properties" of the following key are:
pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02]
6713B62DC36CE36403C724B1FFD641CF2BD6571B
uid [...
1
vote
1
answer
631
views
Sub-key or new key-pair? (PGP/GPG Newbie)
I saw a PGP/GPG key of a dude on the internet with different sub-keys.
The reason is that when one sub-key expires, he creates a new one.
Now, from a security protective, is it better to create a new ...
0
votes
2
answers
149
views
Secure data (+ private key) storage in an insecure public cloud environment
We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure.
The data should be so secure ...
2
votes
2
answers
533
views
Can you use GPG to decrypt and encrypt with a different key in one step?
I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
7
votes
4
answers
3k
views
Why trust a PGP signature if it is distributed along with the data being verified?
Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
10
votes
1
answer
2k
views
How do GPG smart card devices handle large GPG operations?
How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.
My first 2 pet theories are:
There's some way to chunk up GPG operations or use some ...
3
votes
2
answers
3k
views
Can I use Yubikey to encrypt a file without PGP?
I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it.
I know you can save a PGP key onto Yubikey and use it ...
0
votes
1
answer
353
views
PGP "real" encryption with private key
When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
0
votes
1
answer
4k
views
PGP - Use Public key to Decrypt ? (or how that is totally wrong)
I was given a PGP encrypted file, and have been told I can decrypt it using a public key. I don't think that will work.
Can anyone that knows for sure how PGP works confirm that what I've been told is ...
3
votes
2
answers
2k
views
Exact meaning of RSA key in `gpg --verify` output
When verifying a pgp signed message using GnuPG, one gets an output similar to the following:
gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg: using RSA key ...
-1
votes
1
answer
258
views
Prevent server MITM attack
I want to create a secure messaging application such that you don't have to trust the server.
Register with username and password. ->
Generate a pair of PGP keys (RSA). ->
Encrypt the private ...
-1
votes
2
answers
503
views
PGP: how does the owner of a public key generate the fingerprint?
Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
4
votes
1
answer
466
views
Approval of GPG key strategy
I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now.
I've worked out a GPG key strategy and i ...