PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

0
votes
0answers
23 views

Which symmetric encryption method does PGP use for its hybrid-method?

I'm doing some research on PGP for a class-assignment. I've tried to find out which exact implementation PGP uses for its symmetric encryption part. Finding out about RSA as the asymmetric one was ...
0
votes
1answer
24 views

When updating a subkey's expiration date, do old backups of my private master key become invalid?

In GnuPG I have a master key that doesn't expire, with separate subkeys with one year expiration time for encryption, authentication, and signing. If I update the expiration dates of my subkeys, will ...
29
votes
6answers
3k views

Is there any reason I shouldn't make a GPG-encrypted file publicly-accessible?

I'm working on a project where we need to keep a few specific files easily accessible, but encrypted. My idea for accomplishing this is to have the files available in the project's public website, ...
0
votes
0answers
19 views

What public key systems allow for delegation?

I am looking for a public key system that allows for a 3rd party to use that key for other purposes. What private key systems allow for this? PGP, S/MIME, PKI?
2
votes
1answer
18 views

Are expired keys eligible default keys?

From GnuPG's man page: [...] the default key is the first key found in the secret keyring. Are expired keys eligible default keys? Or should I manually set the default key in gpg.conf? I'm ...
1
vote
1answer
18 views

How to raise a key to ultimate trust on another machine?

I have created a master key with two subkeys: one for signing and the other for encryption. Finally, I have exported the two subkeys to a new machine. How can I tell the new machine to consider the ...
0
votes
0answers
16 views

PGP not decrypting when using gpg4win [migrated]

I have set up the GPGTools on OS X 10.11 and they work perfectly fine in Apple Mail, as I have verified by testing with two of my email addresses. Even in Outlook 2016 with the gpg4win plugin on my ...
5
votes
1answer
43 views

Sending GPG private key to myself

I recently started to use GPG and I wanted to import my secret key from another computer. I was thinking about sending it to myself by email or using an USB storage device. Question : Is it safe ? ...
0
votes
0answers
20 views

Enigmail: Issue about sending to old key

So I have set up a new GPG key for myself. I previously had one under the same email, but it has since been revoked. I installed enigmail on my new system with this new key and It seems that it is ...
3
votes
1answer
20 views

Creating subkeys for an existing OpenPGP key

I have an existing OpenPGP key which has been used infrequently. All capabilities appear to be bound to the master key, there are no subkeys. /home/user/.gnupg/pubring.gpg ---------------------------...
3
votes
1answer
45 views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
1
vote
1answer
85 views

What's the minimal way of sharing your public PGP key in email signature?

What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
33
votes
6answers
2k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
42
votes
5answers
6k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
1
vote
1answer
51 views

What issues exist in generating a signed, paper-based PGP message stored by a hostile organisation?

I have recently been the victim of having my medical record tampered with by the organisation holding it. Under state law I have a legal right to submit information to be included in my medical record,...
2
votes
0answers
12 views

Multiple PGP keys on one server [duplicate]

I have a server on which we are planning to expire the current PGP keys later this year. Now we have several clients which are currently using that PGP key. We want to have another new PGP key pair ...
66
votes
3answers
12k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
2
votes
1answer
64 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
4
votes
1answer
58 views

Explanation of modern PGP?

wikipedia states that OpenPGP is currently defined with RFC 4880 which defines a very simple process that doesn't seem like it represents modern RSA + AES encrypted email: The sender creates a ...
4
votes
1answer
81 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
5
votes
1answer
139 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
1
vote
1answer
31 views

Create revocation certificate for all user IDs

My OpenPGP key consists of three identities and two subkeys. I now would like to create a revocation certificate for the master key. pub 4096R/2J9F2349 2016-05-10 [expires: 2016-11-06] uid ...
3
votes
2answers
61 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: https://sks-keyservers.net/pks/lookup?op=vindex&search=...
0
votes
2answers
60 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
2
votes
1answer
83 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
1
vote
0answers
88 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
3
votes
1answer
25 views

Does it matter what version of GnuPG I use to create revocation certificates?

Today I am about to create a bunch of revocation certificates for all of my emails. Why? Because it already happened to me in the past, that I lost my private key, or my computer was compromised. It ...
6
votes
1answer
176 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
1
vote
1answer
23 views

Why does the revocation sent to the OpenPGP keyservers not show up?

I have created a new OpenPGP key pair. So I wish to revoke the former I used. Here's what I managed to do so far: This way I found that email's ID = 3C76732B gpg --search burian.vlastimil2@gmail....
2
votes
1answer
38 views

What is the purpose and meaning of the --sig-notation and --cert-notation options in GnuPG?

What is the purpose of the --sig-notation and --cert-notation options in GnuPG? What are the intended use cases? In the first part the a @ character is used, so I guess the options are for providing ...
2
votes
1answer
32 views

How to import primary secret key from backup into GnuPG?

I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1. Even if I delete my entire ~/....
2
votes
2answers
234 views

Is the RSA private key useless without the password?

I notice whenever I generate a new gpg key (using pgp) I always have to assign a password to it, which makes perfect sense. But if I'm not mistaken, gpg is based on prime numbers. How is this ...
1
vote
1answer
54 views

Spam protection for public GPG keys?

Public keys published to a server almost always contain emails. Is there any sort of protection against bot harvesters that will use that email for spam?
2
votes
1answer
41 views

Revoking signing keys: do they still work afterwards?

Scenario: I have multiple signing subkeys, each for every portable device (i.e laptop). None of them have private master key (it is deleted following the tips in Alex Cabal's post. One of the devices ...
0
votes
1answer
52 views

PGP/GPG: Do I need more encrypton subkeys?

As far as I know after reading several tutorials, it's reasonable to create one subkey for signing per each device I use, especially one that can be stolen, like laptop. However, having multiple ...
2
votes
2answers
82 views

How does GnuPG encrypt secret keys?

When creating a secret key with GnuPG, you are asked for a password to protect it. Which encryption algorithm is used to achieve this? The handbook only says that a symmetric encryption algorithm is ...
3
votes
2answers
101 views

Is there any benefit to encrypting messages with PGP that will be trasmitted over SSL to a REST server?

Would there be any benefit at all to encrypting a message using PGP before sending it to a REST server over SSL, or is this completely redundant and a waste of processing time? For example, could a ...
3
votes
2answers
76 views

How does PGP grant authenticity?

I'm using the website https://www.igolder.com/PGP/encryption/ to encrypt/decrypt PGP messages and create public/private key pairs. I get that when I send somebody my encrypted message only he can ...
1
vote
1answer
39 views

How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) [duplicate]

To improve my privacy, I would like to use PGP to encrypt/sign my e-mails. How should I proceed to use PGP in a secure fashion? I am trying to think about how to do it properly. From what I found, ...
2
votes
1answer
54 views

Signing web forum messages

I maintain web forum software, which is accessible via NNTP and e-mail (as mailing lists). Since NNTP by design allows anyone to spoof their e-mail address, message signing can be used instead to ...
4
votes
1answer
28 views

Best practice: Should I revoke an identity self-signed using SHA1?

When I first created by PGP keypair, my identity was unfortunatly self-signed using SHA1. I later signed again using SHA512. Does it make sense to revoke the SHA1 signature now or will that just ...
1
vote
0answers
15 views

Multiple email addresses connected to same PGP identity [duplicate]

I am setting up PGP (using GPGTools GPG Suite for OS X) and I use multiple email addresses daily. It appears I have several choices on how to do this, and I am wondering what is most secure/most ...
3
votes
2answers
105 views

Why does my private OpenPGP key look different between devices?

Something I noticed, when I use gpg --export-secret-keys -a on different computers: My private key looks different, even though they are the same key pair. Is that normal or does this indicate ...
3
votes
1answer
24 views

How to get GnuPG fingerpints only for specified key name, not for substring matches?

I have few GnuPG keys: test, test2, some test. When I invoke gpg --fingerprint test, fingerprints of all keys are listed. When I run gpg --fingerprint test2, only test2 key fingerprint is printed. How ...
6
votes
2answers
363 views

Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation?

I often use GnuPG to encrypt files with a passphrase. I'm very paranoid, and afraid that the key derivation used by GnuPG isn't slow enough. For this reason, I've decided to do my own key derivation ...
3
votes
1answer
40 views

Critical sub-packets in OpenPGP not used

OpenPGP in RFC4880 allow to tag signature sub packets as "critical" by setting the high bit 7 in the packet type. I checked a few keys generated with GnuPG2 and all the sub packets are not critical, ...
3
votes
2answers
48 views

Specifying my key name while encrypting file to some receiver using GnuPG

I would like to make sure of one thing. When I am encrypting file, the only needed key to specify is --recipient, because I only need to specify key to encrypt (receiver key)? I don't need to specify ...
2
votes
1answer
62 views

What is the recommended procedure to migrate to a new OpenPGP master key?

I am thinking about starting again with a new master key. My current master key was not compromised, but I had stored it on my private server temporarily, which is against good practices (but I am the ...
2
votes
0answers
38 views

GPG Public Key changes after removing master key [closed]

Why does my gpg public key change after removing my master key (leaving just my subkeys) from the gpg key ring? I'm doing this so i can move my daily use keys (subkeys) to my online machine while ...
0
votes
1answer
68 views

How to decrypt a message using only session key?

I can view a session key to the encrypted data using option gpg --show-session-key <file>. Knowing the session key, how can i decrypt the data without using my private key?