PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...
1
vote
3answers
306 views
Please recommend best-practices documents for sharing encrypted data with non-technical end-users
Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations?
...
6
votes
2answers
262 views
Does using both GPG encrypted files and encrypted filesystem make sense?
For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
1
vote
0answers
107 views
OpenPGP CFB mode examples [closed]
Does anyone know where to get worked out examples of OpenPGP's CFB mode encryption? I know RFC 4880 explains it very precisely, but I managed to mess it up somehow.
I got one example from asking on ...
1
vote
1answer
140 views
PGP Secret Key Values calculation
I know this is somewhat counterintuitive, but: Does anyone know of any place where I might get intermediate values from PGP when it decrypts the secret values of the Secret Key packets and shows ...
2
votes
1answer
134 views
How are AV scanners protecting against encrypted (PGPd) malicious code?
As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user ...
6
votes
4answers
414 views
Alternative to “web of trust”
Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
1
vote
1answer
62 views
Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?
Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity.
Can I somehow show my dissidence from the trust that everyone ...
1
vote
1answer
617 views
Brute-force a passphrase, generated by `pwgen 16 -s`, of a GPG CAST5 archive
A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses ...
0
votes
1answer
219 views
What is purpose of --s2k-* GnuPG options? [closed]
When I use gpg --symmetric --s2k- and press tab some options appear:
--s2k-cipher-algo
--s2k-count
--s2k-digest-algo
--s2k-mode
What do those options do?
10
votes
5answers
624 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
2
votes
2answers
313 views
Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?
Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption.
Should slow hash function (like bcrypt) be applied to password before using it with ...
0
votes
1answer
327 views
PGP encryption/signature with BouncyCastle [closed]
I've implemented PGP encryption and signature using BouncyCastle on Java. It works, but all the examples I'm based on have hardcoded the algorithms for symetric encryption, hashing and compression.
...
-2
votes
1answer
346 views
Safest and most secure way for backing up private data
Here is what happened, I first collected my data into one folder,tar'd it, encrypted it with gpg, put it in truecrypt container, and after that started to copy the container to another place, but ...
3
votes
2answers
387 views
Security of GPG encryption with AES and MD5 if MD5 is broken
I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?
1
vote
2answers
470 views
gpg encryption security
How secure is encryption files used gpg this way
gpg -c personal.zip
will not use any keys or other lines, and how good its compared to truecrypt
Note that I will upload encrypted files to my ...
4
votes
1answer
608 views
Does GPG key expiration add to security?
I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or ...
2
votes
1answer
1k views
Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?
If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data?
If the latter, then if someone had access ...
7
votes
2answers
1k views
What are the risks of storing passwords in a GPG encrypted file?
I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like
gpg -d passwords.gpg | grep ...
0
votes
0answers
653 views
Where to find a compiled version of GPG.exe for Windows? [closed]
I've been looking through the GnuPG.org site, and many others to try and find a compiled version of GPG.exe for Windows.
I understand there is GPG4Win, however, I was looking for something a little ...
4
votes
1answer
104 views
Complex Consumer Matching Queries with PGP Universal
For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. ...
0
votes
2answers
220 views
Whether PGP is send over MIME?
If I am using PGP to encrypt mails whther it is send as a MIME (Multipurpose Internet Mail Extensions) message, and S/MIME and PGP are used for providing email security.
When I send PGP message ...
3
votes
2answers
438 views
What encryption schemes require two or 3 private keys to read a message?
I would like to encrypt some data so that it can only be read if two or three people use a private secret to decrypt the data.
What is the best / most modern way to accomplish multi-person ...
2
votes
2answers
2k views
Automating PGP encryption? (Windows)
Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times ...
7
votes
2answers
756 views
How do I encrypt the source and destination IP address, along with various parts of an email?
If the subject makes no sense to you, that's fine, it makes no sense to me.
I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
1
vote
2answers
135 views
OpenPGP: Sign-Verify workflow without Encrypt-Decrypt?
Is it a good and/or frequent practice to sign a file (with your own private key) without encrypting it (with the intended recipient's public key?) I haven't really been able to find a direct answer to ...
0
votes
1answer
369 views
Is Data Object on openPGP smartcard v2 encrypted?
currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard.
I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
5
votes
3answers
102 views
Should I make sure to get all of my OpenPGP uids are signed?
Should I make sure that I get all of the uids associated to my OpenPGP key signed, or is it enough to have one of them signed?
If Bob can guarantee that alice@example.com belongs to Alice, I can't ...
5
votes
2answers
315 views
Enforce Code/Script Signing
I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ...
7
votes
3answers
680 views
Is it possible to verify a PGP-signed and encrypted message without decrypting it?
Let's assume I have a PGP message and I want to know who sent it, is it possible to do it if I have the RSA encrypted message, two possible senders (and their public keys that they signed and ...
6
votes
3answers
1k views
How can I convert my encypted PGP secret key for use performing SSH authentication?
I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
5
votes
1answer
281 views
OpenPGP Encryption / Decryption Process Using GnuPG
I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
3
votes
3answers
995 views
Generate a PGP key with more than 4096 bits?
I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?
8
votes
2answers
1k views
GPG File size with multiple recipients?
If I encrypt a file for multiple users how does the file size change?
Does the size of the output double for two users. How about 10 or 100 users?
4
votes
3answers
1k views
How can PGP and openPGP be compatible?
PGP and openPGP use different encryption algorithms. As I understand, PGP uses IDEA to encrypt a message, then RSA to encrypt the IDEA key. If openPGP doesn't use IDEA, how can it read PGP-encrypted ...
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
16
votes
4answers
4k views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
5
votes
1answer
539 views
Ways to sign gpg public key so it is trusted?
I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
11
votes
2answers
701 views
Flaw in encryption through pseudorandom number stream (from gpg documentation)
I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity:
When I was in college in the early 70s, I devised what I believed was a brilliant ...
3
votes
1answer
202 views
self-signatures using SHA1
This page says:
self-signatures must not use SHA1
You can check this by doing:
gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep ...
2
votes
0answers
470 views
Store PGP keys in HSM
Is anyone storing the PGP encryption key in a Hardware Security Module (HSM)? Company policy mandates this, so I need to store the private key to decrypt pgp file in HSM. But as much i know PGP uses ...
9
votes
5answers
1k views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
6
votes
3answers
637 views
Is the OpenPGP private key inherently password-protected?
I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key?
Essentially, ...
9
votes
2answers
551 views
Does my PGP key really need to match the e-mail address for which I'll be using it?
In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
8
votes
3answers
437 views
Most widespread use of PGP after 20 years
Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
6
votes
2answers
366 views
What risks are inherent with connecting to an untrusted public key server?
Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here:
Shouldn't GPG key fetching use a secure connection?
...you should not trust the key ...
10
votes
6answers
763 views
Shouldn't GPG key fetching use a secure connection?
If I run this for example:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
3
votes
4answers
320 views
Generating OpenPGP key pair with restrictions
I intend to generate an OpenPGP RSA key pair where a part (~half) of the private key is as I specify, i.e. a specific string. Are there tools for generating a key pair with such restrictions, or will ...
11
votes
2answers
2k views
How does RSA encryption compare to PGP?
On this answer ck says
RSA and PGP are different.
What you are essentially asking is how
do I run my petrol car on diesel? The
answer is you can't.
I would be interested in a more ...
10
votes
2answers
978 views
GnuPG/OpenPGP Key Practices
I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
28
votes
6answers
8k views
How should I distribute my public key?
I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
