PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

2
votes
1answer
30 views

Ability to determine which PGP public keys a message has been encrypted for?

Is it possible to determine, given a PGP message that you can already decrypt, to determine which other PGP keys that message has also been encrypted for?
-1
votes
1answer
36 views

Do we need to same PGP version for decryption [on hold]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...
0
votes
0answers
11 views

generating public/private credentials for MS Outlook email encryption [migrated]

An app running on a CentOS 7 web server needs to receive encrypted emails sent from users of MS Outlook. Can someone please provide explicit instructions as to how I can generate or procure all of ...
0
votes
0answers
38 views

most widely applicable email encryption technology [on hold]

A private web application needs to send and receive encrypted emails with perhaps a few dozen known users. This is a Java / Spring MVC app running on a CentOS 7 server, and using JavaMail to connect ...
4
votes
2answers
314 views

When signing email with GPG, how does verification by the receiver work?

I use GPG to sign my outgoing emails. I understand how it works when I encrypt mail to send to someone else. Then I need his/her public key, encrypt it with that, and only he can decrypt it using ...
1
vote
0answers
31 views

Using OpenSSL to generate encryption key for Outlook users [migrated]

A private web application needs to receive encrypted email from perhaps 20 known users. How can I use OpenSSL to generate a valid encryption certificate that Outlook users can import and use to ...
1
vote
1answer
24 views

Should I verify installer file PGP hash?

Let's say that I'll download an installer for a program on Windows and the publisher has released PGP Signature for the file. The installer file does not have any code signing certificates. If I ...
1
vote
1answer
101 views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
3
votes
2answers
42 views

PGP question decrypting my own message from 2 days ago

I have recently started using pgp and am still in the infancy stages with knowledge. i sent a friend an encrypted message using pgp4usb. a few days later they responded, with relevant info, being ...
4
votes
1answer
51 views

When should I sign a PGP key with a non-revocable signature?

GnuPG allows the user to sign a key with a non-revocable signature. I have done this when I’m signing one of my own keys—signing my personal key with my work key, for instance. Is there any other ...
2
votes
1answer
40 views

How are private keys encrypted?

I've just got back into the swing of using pgp and I'm wondering how the private key is encrypted (using the passphrase to decrypt). This has got to written down somewhere, but in my searches the vast ...
1
vote
1answer
31 views

Implement GPG Verification (Bitcoin-OTC)

I'm looking to implement a "Verify with Bitcoin-OTC" feature for my web app. The general idea is the user would prove he owns a particular account on the external site Bitcoin-OTC and my app would ...
1
vote
1answer
52 views

What do I do about a forgotten, ancient PGP key?

So I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key ...
0
votes
1answer
66 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
0
votes
0answers
13 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
2
votes
1answer
229 views

Can OpenPGP private keys ever be secure enough to store publicly?

The OpenPGP (private) key format stores the key symmetrically encrypted. The "iterated and salted" setup derives this key from a passphrase, taking a "octet count" parameter that determines the ...
2
votes
2answers
162 views

Why gpg-signed files differ every time

I signed the same file producing a separate file for the signatures, and I noticed that every file is signed with a different signature. I don't get it. Shouldn't it always be signed with the same ...
0
votes
1answer
12 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
4
votes
1answer
113 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
3
votes
1answer
67 views

Has my GPG subkey been uploaded to the keyserver?

I've been trying out the new ECC keys that have been added to GnuPG 2.1. I created a primary key, then added an ed25519 signing subkey. So I know get this: ➜ ~ gpg2 -K ...
3
votes
1answer
72 views

Key generation: Differences between GnuPG classic, stable, modern?

I plan to create a 4096 bit RSA&RSA key pair: gpg --gen-key --personal-digest-preferences SHA512 --cert-digest-algo SHA512 Is there any difference in generated key quality between versions 1.4 ...
2
votes
1answer
38 views

Upgrading OpenPGP public key on key servers?

What is the best way to upgrade an OpenPGP key that was created 11 years ago? It's 1024-bit and is published on the key server. I can create a new key, but what's the proper way to update the ...
3
votes
3answers
488 views

Two-way PGP email without publishing your key / address to a key server?

If I want to have some privacy and avoid the attention of publishing my email address to the public key server web of trust, yet have a secure two-way email conversation with one recipient, what are ...
2
votes
1answer
81 views

Is it safer to use a PGP key encrypted with a password than just the same password separately?

I'd like to encrypt some master passwords that I want to store with added security outside of KeePass, instead as just a normal record in the database. I was considering storing these passwords in an ...
1
vote
0answers
39 views

Software to use for encrypting data in PHP [closed]

I'm interested in programming and information security, I would like to combine both my interests to build sort of password manager. This would be how the user would interact with the site: Alice ...
0
votes
0answers
15 views

What user interface is most useful to users who use PGP Key Splitting, or other Shamir-based keys?

I am developing an application that uses Shamir-based key splitting, and am looking at various products and am looking for a user-friendly, possibly dynamic graph that helps users build and manage key ...
0
votes
1answer
48 views

How do I import a GnuPG private PGP key into Symantec PGP commandline?

I am trying to import a private PGP key into Symantec PGP command line that originated in GnuPGP (1.4.11 AIX) into a Windows system. When I do a pgp --import private.asc, then do a pgp --list-keys ...
0
votes
1answer
65 views

What exactly is a subkey?

I fairly understand the math behind RSA, Elgamal, AES, SHA but not how things are used in practise. How are subkeys different from master key? I understand its purpose from various websites but How is ...
1
vote
3answers
72 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
1
vote
1answer
52 views

Necessary components for PGP [closed]

I came across this question during an interview. I was asked: What are the two main components of PGP encryption necessary for it to work? I was thinking in line of Private and Public Keys but I am ...
23
votes
6answers
3k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
-1
votes
2answers
142 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
4
votes
1answer
92 views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
2
votes
1answer
98 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
2
votes
1answer
43 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
2
votes
1answer
91 views

What is “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
2
votes
2answers
73 views

GPG Web-of-Trust Level [duplicate]

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
5
votes
1answer
72 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
1
vote
1answer
624 views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
2
votes
1answer
82 views

Why are PGP signatures not more widely used as an authentication method?

Example: Bob generates a key pair for this example. Bob registers at example dot com where he provides his public key. When Bob will try to log in, example dot com will ask him to sign a random ...
2
votes
1answer
236 views

Wrapping my head around Protonmail

I've been trying to grasp how Protonmail could work. From what it gather, it works like this: When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
0
votes
1answer
61 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
2
votes
2answers
91 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
0
votes
1answer
26 views

What are valid OpenPGP revocation signature types?

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL ...
0
votes
2answers
128 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
2
votes
1answer
35 views

What is validity in terms of PGP 6.5.8?

In PGP 6.5.8, there is a concept of "validity" for a key, and it shows in the user interface for each key on the keyring. What is this concept, and how to you set it so a key is considered valid?
1
vote
3answers
399 views

What is the difference between a key algorithm and the encryption algorithm?

I just starting to learn about PGP encryption. One thing that confuses me is the difference between a key algorithm, and an encryption algorithm. For example, lets say I have a trading partner (EDI ...
17
votes
6answers
2k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good ...
1
vote
1answer
86 views

What is the difference between “unknown” and “undefined” trust?

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
0
votes
2answers
162 views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...