PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...
5
votes
3answers
150 views
Virus with PGP Encryption Preventing Virus Scan
A user reported having a virus that was causing pop up windows asking for money. When he turned on his laptop and logged into PGP encryption (whole disk) the desktop quickly showed but then a white ...
-2
votes
1answer
181 views
Cascading Encryption Algorithm using mcrypt or GnuGP
I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
3
votes
1answer
65 views
RFC 6637: Algorithm-Specific Fields for ECDH
I am trying to integrate RFC 6637 into Bouncy Castle C# which is more challenging as initially thought because both private key and public key have to be present to calculate the share secret: that ...
4
votes
3answers
193 views
Is it okay to sign a PGP key without an IRL meeting?
[PGP] can get paralyzed by excessive analness.
— Phil Zimmermann
Preamble
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
3
votes
1answer
102 views
Recognizing PGP-encrypted disks
I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS.
I am interested to know how an encrypted partition/disk/file with a particular ...
3
votes
1answer
88 views
User Groups (Circles) Inside a Web of Trust
Assume I have a universe of U users. Every user has his private key.
I want to build user groups by adding a company sub key to his key set.
Now users can sign his company sub key with there company ...
2
votes
1answer
104 views
ECC in (Open)PGP
How is with the support for ECC (Elliptic Curve Cryptography) in (Open)PGP so far? It seems that GnuPG (The GNU Privacy Guard) doesn't have an official implementation - but I did find the gnupg-ecc ...
13
votes
2answers
341 views
Will encrypting the same file with GPG and the same key produce the same ciphertext?
If I encrypt the same file twice with GPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
3
votes
2answers
54 views
Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?
CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service:
Service A makes a request to Service B on behalf of a ...
0
votes
2answers
60 views
Do keyservers keep logs of who adds whom to their keyrings?
Maybe it depends on the keyserver. Does that pose privacy issues?
0
votes
3answers
45 views
Is connection to keyserver encrypted?
When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
0
votes
2answers
140 views
Secret key is a prime number in GnuPG
I hope that this question is not off topic here.
When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find ...
-3
votes
1answer
98 views
Does PGP key I created and uploaded have any legal value? [closed]
Suppose you done:
gpg2 --gen-key
...
gpg2 --keyserver pgp.mit.edu --send-keys ...
Does such key have any legal meaning, e.g. to assert that it was really me that signed some message?
What can be ...
4
votes
0answers
178 views
Migrating GPG master keys as subkeys to new master key
Currently I have 3 private GPG pairs which are all master keys.
I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread ...
4
votes
1answer
56 views
GPG warns about unprotected subkeys while using monkeysphere
Issuing monkeysphere subkey-to-shh-agent GPG warns me:
gpg: about to export an unprotected subkey
then it asks for the passphrase and everything works fine.
What's the meaning of "export an ...
2
votes
0answers
109 views
User friendly PGP email [closed]
Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience?
Generate new key at first startup, rather than asking the user if they have an ...
22
votes
3answers
994 views
Is authentication using personal pictures more secure than passwords?
Statement 1
There is a start up called PixelPin. On the web site it reads:
The PixelPin solution is simple and quick to use, yet very secure.
PixelPin eliminates the traditional alphanumeric ...
3
votes
1answer
127 views
Why do PGP master keys only have a single subkey, and tie certification with signing by default?
After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
3
votes
2answers
86 views
Anything to do about old gpg keys?
Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
2
votes
3answers
65 views
Are private keys generated by different software packages compatible?
I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
1
vote
1answer
77 views
How to change (sub)key usage of a PGP key?
gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
3
votes
2answers
157 views
What is a good general purpose GnuPG key setup?
Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
4
votes
1answer
172 views
Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
3
votes
2answers
171 views
Is it reasonable to prevent timing attacks by using fixed processing time
I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing.
Part 1
Is it a good idea to ...
1
vote
2answers
150 views
gpg --perfect-code
By default gpg use cast5 with sha1 (not so good) as it had AES256 and hash512!
Now I want to use the perfect code to encrypt my files for both symmetric & asymmetric
For --symmetric encryption ...
2
votes
1answer
86 views
Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?
From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
3
votes
3answers
125 views
PGP keys and security contact pages
I have heard security researchers suggest that if you run a public website, you should put up a "security contact" page that includes a contact email address and your PGP public key so that people can ...
3
votes
2answers
214 views
How many GPG keys should I make?
I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
5
votes
2answers
152 views
Why are my gpg public key on my machine and on the key server different?
When I generated my PGP key using GnuPG, I had saved the public key as an ASCII version and uploaded that to the server. Now I can see the key on the keyserver but they are different blocks of data.
...
4
votes
2answers
140 views
Recipient non-repudiation in secure e-mail transport
PGP works well to provide many key aspects of information security; message confidentiality and integrity, sender and recipient authenticity, and sender non-repudiation (the sender, who has digitally ...
-1
votes
1answer
54 views
GnuPG implementations are not cross-compatible? [closed]
Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
-2
votes
1answer
216 views
is there better email, file, disk encryption than PGP? [closed]
Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable.
However, PGP has been around for a long ...
7
votes
1answer
124 views
GPG-encrypted mailing list and other approaches to safe communication
What is the best way to communicate privately on a mailing-list?
Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
0
votes
2answers
143 views
Network security: Public and Private keys
In Pretty Good Privacy, it is said that Sender sends compressed message and encrypts the message with the private key of himself. And then Receiver will decrypt that message with the public key of the ...
3
votes
2answers
117 views
Safely remove an expired PGP key file
since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched ...
6
votes
3answers
352 views
How can I encrypt a file using `gpg` without including the recipient's key ID?
An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question.
Is there any way to remove that information from the resulting ...
6
votes
2answers
275 views
What information is leaked from an OpenPGP encrypted file?
If an attacker obtains a file that has been encrypted using an OpenPGP public key, what information can the attacker deduce?
For example, to what degree of certainty can the attacker deduce the ...
1
vote
1answer
74 views
gpg encryption date or gpg version recoverable?
Is there a way to determine the date of encryption or the gpg version of a gpg-encrypted file (with symmetric encryption)?
I lost the password but some rough information about when the file was ...
5
votes
4answers
165 views
Securely publishing GPG keys
This is probably a stupid question/vaguely defined, but I need to ask it anyway.
I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
8
votes
1answer
193 views
PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?
I'm quite new to OpenPGP and am just starting to use it with Thunderbird.
When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
6
votes
1answer
70 views
What is the best way to manage package signing keys?
I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.
I have initially created a signing ...
1
vote
2answers
94 views
Certificate Security in intranet Environment?
We have this topology in our company :
A new rule says that each document being sent by outlook should be encrypted.
we decided using PGP.
We already have a certificate ( self signed).
the ...
4
votes
1answer
112 views
Is OpenPGP encryption a valid replacement for SSL when passing messages?
I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
4
votes
2answers
92 views
Is DKIM needed for emails encrypted with OpenPGP?
DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did.
...
7
votes
1answer
131 views
Can all the (other) recepients of a PGP encrypted message be identified?
Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?
...
8
votes
3answers
612 views
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
4
votes
2answers
162 views
How to refuse delivering emails that are not signed by trusted PGP keys?
I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
5
votes
1answer
144 views
Could a consumer-friendly PGP-like file encryption application theoretically be secure?
In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
2
votes
2answers
391 views
Secure way to transfer public/secret key to second computer
I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
3
votes
2answers
402 views
Can GPG be a full replacement for PGP?
I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement.
Does GPG do everything PGP can do? I've researched a lot ...
