2
votes
1answer
23 views

What is validity in terms of PGP 6.5.8?

In PGP 6.5.8, there is a concept of "validity" for a key, and it shows in the user interface for each key on the keyring. What is this concept, and how to you set it so a key is considered valid?
1
vote
3answers
297 views

What is the difference between a key algorithm and the encryption algorithm?

I just starting to learn about PGP encryption. One thing that confuses me is the difference between a key algorithm, and an encryption algorithm. For example, lets say I have a trading partner (EDI ...
16
votes
6answers
1k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good ...
0
votes
1answer
45 views

What is the difference between “unknown” and “undefined” trust?

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
0
votes
2answers
60 views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
1
vote
1answer
45 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
0
votes
1answer
23 views

Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?

According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
0
votes
2answers
29 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
2
votes
3answers
65 views

GPG keys & SHA-1

I've heard that SHA-1 hashing is becoming less secure, and that most GPG keys are secured with SHA-1. Is there a way to determined if SHA-1 is in my GPG key, and what to do if this is the case?
1
vote
2answers
93 views

Does adding multiple recipients to an encrypted message decrease security?

Let's say you want to send the same GPG/OpenPGP encrypted message to 50+ recipients. Assuming everyone you send to is trusted, and there is no risk of any recipient leaking their secret key, is ...
2
votes
1answer
57 views

Which PGP settings have been found to be vulnerable?

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be ...
0
votes
1answer
50 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
1
vote
1answer
29 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
3
votes
1answer
42 views

How long to keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
2
votes
3answers
81 views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
0
votes
2answers
42 views

Can I generate multiple PGP key pairs for later use

I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I ...
1
vote
2answers
39 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...
2
votes
2answers
94 views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
0
votes
2answers
44 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
2
votes
2answers
112 views

PGP/GPG verifying authenticity

My boss recently implemented a new security system related to PGP/GPG. The whole idea behind this is to sign files so that people know from who they came. They don't require us to encrypt them, just ...
0
votes
0answers
33 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
1
vote
1answer
100 views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...
3
votes
1answer
50 views

Should I sign the CAcert key?

Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too. Question: Cacert ...
3
votes
1answer
79 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
2
votes
1answer
59 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
2
votes
1answer
121 views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
1
vote
1answer
525 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
4
votes
2answers
217 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
81 views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K ...
0
votes
1answer
91 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
1
vote
3answers
181 views

OpenPGP Master Key Size

Currently the default maximum key size is 4096. I know this can be changed by recompiling the software, and I don't mind doing that. My problem is about compatibility issues. It makes sense that some ...
0
votes
2answers
51 views

How can I verify the GPG signature is valid?

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I ...
2
votes
1answer
167 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
2
votes
1answer
212 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
7
votes
1answer
202 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
-1
votes
1answer
115 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
5
votes
3answers
1k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
7
votes
1answer
1k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...
3
votes
1answer
2k views

PGP RSA key size - encryption/decryption time

From what I've read, PGP only uses the pub/priv keys for encrypting/decrypting a symmetric key used for actually encrypting/decrypting data. I'd reasonably assume that longer asymmetric keys wouldn't ...
12
votes
2answers
442 views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alica and Bob are using. By replacing Alices and Bobs public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
3
votes
1answer
387 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
13
votes
2answers
711 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
1
vote
2answers
329 views

Secret key is a prime number in GnuPG

I hope that this question is not off topic here. When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find ...
8
votes
3answers
1k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
5
votes
3answers
769 views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
1
vote
1answer
455 views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...