1
vote
1answer
26 views

How long to keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
0
votes
2answers
33 views

Can I generate multiple PGP key pairs for later use

I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I ...
0
votes
2answers
38 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
3
votes
1answer
73 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
2
votes
1answer
55 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
0
votes
1answer
72 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
0
votes
2answers
48 views

How can I verify the GPG signature is valid?

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I ...
7
votes
1answer
196 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
-1
votes
1answer
111 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
5
votes
3answers
1k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
7
votes
1answer
1k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...
3
votes
1answer
2k views

PGP RSA key size - encryption/decryption time

From what I've read, PGP only uses the pub/priv keys for encrypting/decrypting a symmetric key used for actually encrypting/decrypting data. I'd reasonably assume that longer asymmetric keys wouldn't ...
12
votes
2answers
410 views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alica and Bob are using. By replacing Alices and Bobs public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
3
votes
1answer
380 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
13
votes
2answers
666 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
1
vote
2answers
315 views

Secret key is a prime number in GnuPG

I hope that this question is not off topic here. When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find ...
7
votes
3answers
1k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
5
votes
3answers
728 views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
1
vote
1answer
447 views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...