PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

1
vote
1answer
208 views

Pgp Private key storage on windows server advice

Looking for a bit of advice really, here's the situation: I currently have a security minded client who will be sending PGP encrypted files. I have to decrypt the files on my server before ...
0
votes
1answer
70 views

One public key contains all subkey?

I've created a keypair with gpg2 --gen-key Then I created a subkey only for sign. If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypt and one for signing. I ...
2
votes
1answer
134 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
2
votes
2answers
92 views

Are OpenPGP Robot key signers useful?

I've been thinking about building a web-based keysigning robot. Mostly I want to do this to dip my toes back into working with PGP after quite a few years of ignoring it. The robot I have in mind ...
3
votes
1answer
212 views

How can I recover a GPG private key from a PC which has died? [closed]

Long story short - PC with kleopatra processor died, and I only have a backup of my public key. I've gone into the HDD and tried to re-jig kleopatra in the hope it would remember everything for me on ...
4
votes
3answers
489 views

What is the most secure way to send emails using PGP?

I am a PGP beginner, having just downloaded GPG for OS X. I created my first pub/sec key for my email address and uploaded it to the public key server. GPG has several features available, namely: 1) ...
1
vote
1answer
198 views

OpenPGP keyserver URLs: what are typical or meaningful use-cases?

i'm getting re-acquainted with OpenPGP and noticed that GnuPG allows me to store a "preferred keyserver" URL in my keys: reuben@localhost:~$ gpg2 --edit-key 'Reuben NP Garrett ...
0
votes
1answer
230 views

Given a Gnupg Public / Private key pair, how can I identify the strength of the encryption used?

I have been using a key pair at home with gpg command line tool on Ubuntu, to encrypt password text files for a few years now. I no longer have any record of the type of encryption and bit length used ...
7
votes
1answer
188 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
5
votes
1answer
242 views

Is is typical to create both x509 and OpenPGP key pairs?

I'm looking into increasing my use of signed and encrypted "things" - LibreOffice Documents, Off-the-record chat, PDFs, emails, etc. I'm finding that some things only support x509 format-certificates, ...
3
votes
6answers
208 views

Does an email signature increase security?

I'm using Thunderbird with Enigmail. It has both encrypt and sign options for sending PGP emails -- but why is an email signature needed? It just looks overkill to me! Alice and Bob can use PGP to ...
-1
votes
1answer
104 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
1
vote
1answer
78 views

Can I ask GPG keyservers to name all keys signed by a particular key?

Given the alleged possibility that an adversary might attempt to acquire my (OFFLINE) Secret Certification Key and Passphrase and sign other keys with it, including a key they made with my ...
3
votes
2answers
270 views

What is the purpose of 'Version:' in PGP public key

PGP public keys look something like -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.9 (GNU/Linux) mQGiBEl2HAgRBAC9IZGQE3NRWFoXV7CcVRbo7xMe+nGPRMTOocA0pcv9N67R6CAZ ... -----END PGP PUBLIC ...
3
votes
2answers
525 views

What trust level should I give keys I need for encryption?

As I'm encrypting server backups, I typically install my public GPG key from a keyserver into me server's keyring: gpg --search-keys 6569758F I import the key into my keyring. I then attempt to ...
1
vote
1answer
82 views

Getting more users to use PGP [closed]

Does anyone know of browser Plugins that make Composing, sending, and reading email basically effortless? Mailvelope doesn't seem to be working with the floating compose boxes in Gmail currently. ...
2
votes
2answers
300 views

GPG good signature but Warning: untrusted signature

I'm having an issue with some of my clients being unable to open email attachments when I sign the messages. The error they get is something like (free translation): Error: cannot open. The ...
5
votes
2answers
389 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
-2
votes
2answers
177 views

What was the Lavabit's backdoors to their customers' e-mails? [closed]

There has been some talk about the Lavabit's case. New info was published today, but not important. I'd like to know how Lavabit worked. First I thought they just did something with OpenPGP. Then I ...
1
vote
2answers
132 views

PGP: Including your public key as a recipient? Any less secure?

I understand that when I send a message to my friend Bob using his public key, it's a 1 way encryption. However, if I add my own public key to the list of recipients, it allows me to later decrypt ...
2
votes
1answer
277 views

Why is compression done between hash function and encryption in pgp?

What are services of pgp? How is compression performed between hash function and encryption? How it can be applied in reality?
1
vote
2answers
552 views

What's the limit on the size of the data that public-key cryptos can handle?

Someone mentioned here that asymmetric encryption might not be appropriate for bulk data and gave an example of RSA with 100 bytes. Of course, I understand that it was a rough example. But it made me ...
5
votes
3answers
1k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
1
vote
1answer
446 views

Additional security for WebRTC/DTLS-SRTP with PGP?

I am having a thought experiment. Can you help me? Two clients who both use PGP. They initiate a WebRTC call using DTLS-SRTP via a 3rd party server. Is there any benefit of encrypting, via their ...
1
vote
1answer
310 views

Why are the first 16 bits of the message digest not encrypted in PGP? [closed]

The first 16 bits of the message digest in a PGP signature are translated in the clear. As we know, sending something in clear text does not sound like a very good idea from a security point of view. ...
3
votes
2answers
399 views

Why would someone create an OpenPGP public key with my name and email address?

By chance, I typed gpg2 --search myemailaddress on the command line, and searched public keyservers for my email address (I'd actually just meant to search my local keyring, for which I should have ...
6
votes
1answer
1k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...
6
votes
4answers
522 views

Is it safe for GPG to compress all messages prior to encryption by default?

By default, GPG compresses text during encryption. Additionally, RFC 4880 says: 2.3. Compression OpenPGP implementations SHOULD compress the message after applying the signature but before ...
2
votes
2answers
1k views

Extracting the PGP keyid from the Public key file?

is there a way via an CLI tool or some kind of API to extract the PGP KEY ID from the PGP PUBLIC KEY BLOCK ? I did find the hexa value of the key in the binary file, however I guess the position is ...
5
votes
3answers
740 views

Can a PGP private key be deduced if the email text is known?

Suppose I send a PGP-encrypted email to person A, and the same email (same subject line, same message text) unencrypted to person B. Suppose a secret service intercepts both messages. The secret ...
0
votes
1answer
129 views

How to fetch and update all my friend's keys? [closed]

Where can I upload a list of my friends and get a list of their keys found on keyservers? Here are some key servers: http://keyserver.ubuntu.com:11371/ http://pgp.mit.edu/ ...
6
votes
3answers
471 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
3
votes
1answer
2k views

PGP RSA key size - encryption/decryption time

From what I've read, PGP only uses the pub/priv keys for encrypting/decrypting a symmetric key used for actually encrypting/decrypting data. I'd reasonably assume that longer asymmetric keys wouldn't ...
5
votes
1answer
1k views

What is the exact meaning of this gpg output regarding trust?

When I import signatures or receive a key with gpg, it outputs some cryptic lines like: gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 16 trust: ...
11
votes
2answers
380 views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alica and Bob are using. By replacing Alices and Bobs public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
3
votes
1answer
355 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
0
votes
2answers
154 views

How do key servers resolve conflicts?

According to the PGP network FAQ While a number of key servers exist, it is only necessary to send your key to one of them. The key server will take care of the job of sending your key to all ...
8
votes
3answers
668 views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
5
votes
7answers
1k views

Is PGP combined with a regular web-based email service secure?

With the disappearance of private email services like Lavabit and Tormail (http://www.dailydot.com/news/email-anonymous-hushmail-lavabit-nsa/) it seems that we will need to resort back to standard ...
3
votes
2answers
139 views

Deciding whether to sign someones key

How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key. How serious of a commitment is it to sign ...
1
vote
1answer
177 views

What's the point of public key servers, if they usually don't require any authentication at all upon upload?

Do they offer any benefits at all to the security of key distribution?
0
votes
2answers
1k views

Public keys on OpenSSL vs PGP?

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as ...
5
votes
1answer
165 views

Password strengthening for PGP

I'm wondering about some of the semantics and security implications of using something like scrypt or bcrypt to "enhance" a password protecting a PGP private key. Essentially, I'm asking about the ...
4
votes
2answers
234 views

Security of PGP for Long-Term Storage

How secure are PGP/GPG encrypted mails? I realize that it's probably fine for regular e-mail scenarios, but what about the security over longer time periods (>30 years)? Is the 4096 bit limit for ...
5
votes
3answers
4k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
5
votes
2answers
356 views

Is it nescecary to wipe and reset the MBR when laptop changes owners even if full disk encryption is used?

Where I'm currently working we use full disk encryption and after a laptop transfer owners we use a secure erasure program. This is quite time consuming and I'm wondering is it necessary? For the disk ...
1
vote
1answer
237 views

Small encrypted network setup [closed]

Several partners and I have just started a small business and we would like to employ a good secure setup from day one. This is a problem however as there are many piecemeal packages, and I am stuck ...
10
votes
2answers
2k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
3
votes
2answers
468 views

How safe is a PGP private key that has “escaped”, but without its password?

Assuming your PGP private key is protected with a password, and it "escapes", but the password does not, how worried should you be? Obviously in the real world, you would immediately revoke the key ...
9
votes
4answers
2k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...