PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

7
votes
3answers
2k views

When changing a PGP passphrase, does it only affect the private key?

I am beginning to use GPG for email encryption. If I use gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
-3
votes
2answers
161 views

Security and privacy in email and other communications [closed]

In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
2
votes
0answers
215 views

Emacs and EasyPG not performing public key encryption

I have a file which I edit and encrypt following this guide : http://emacs.wordpress.com/2008/07/18/keeping-your-secrets-secret/ I'm a noob as far as security goes and thought that the point of ...
2
votes
1answer
70 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
4
votes
3answers
490 views

Virus with PGP Encryption Preventing Virus Scan

A user reported having a virus that was causing pop up windows asking for money. When he turned on his laptop and logged into PGP encryption (whole disk) the desktop quickly showed but then a white ...
-2
votes
1answer
651 views

Cascading Encryption Algorithm using mcrypt or GnuGP

I'm trying to a cascading cipher encryption algorithm to encrypt a textfile via mcrypt. I'm essentially trying to emulate the behavior of TrueCrypt, where it can cascade two or three different cipher ...
4
votes
1answer
165 views

RFC 6637: Algorithm-Specific Fields for ECDH

I am trying to integrate RFC 6637 into Bouncy Castle C# which is more challenging as initially thought because both private key and public key have to be present to calculate the share secret: that ...
13
votes
2answers
624 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
3
votes
1answer
531 views

Recognizing PGP-encrypted disks

I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS. I am interested to know how an encrypted partition/disk/file with a particular ...
4
votes
1answer
145 views

User Groups (Circles) Inside a Web of Trust

Assume I have a universe of U users. Every user has his private key. I want to build user groups by adding a company sub key to his key set. Now users can sign his company sub key with there company ...
10
votes
2answers
3k views

ECC in (Open)PGP

How is with the support for ECC (Elliptic Curve Cryptography) in (Open)PGP so far? It seems that GnuPG (The GNU Privacy Guard) doesn't have an official implementation - but I did find the gnupg-ecc ...
20
votes
2answers
2k views

Will encrypting the same file with GPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
3
votes
2answers
88 views

Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?

CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service: Service A makes a request to Service B on behalf of a ...
0
votes
2answers
87 views

Do keyservers keep logs of who adds whom to their keyrings?

Maybe it depends on the keyserver. Does that pose privacy issues?
0
votes
3answers
89 views

Is connection to keyserver encrypted?

When you retrieve someone's information from a keyserver to add him to your pgp keyring, that is made through unencrypted keyservers, unless the user uploaded it to https://keyserver.pgp.com/. Even ...
1
vote
2answers
298 views

Secret key is a prime number in GnuPG

I hope that this question is not off topic here. When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find ...
-3
votes
1answer
145 views

Does PGP key I created and uploaded have any legal value? [closed]

Suppose you done: gpg2 --gen-key ... gpg2 --keyserver pgp.mit.edu --send-keys ... Does such key have any legal meaning, e.g. to assert that it was really me that signed some message? What can be ...
15
votes
3answers
1k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread ...
4
votes
1answer
108 views

GPG warns about unprotected subkeys while using monkeysphere

Issuing monkeysphere subkey-to-shh-agent GPG warns me: gpg: about to export an unprotected subkey then it asks for the passphrase and everything works fine. What's the meaning of "export an ...
2
votes
0answers
207 views

User friendly PGP email [closed]

Does there exist cross-platform email handlers following these basic guidelines based on some very limited experience? Generate new key at first startup, rather than asking the user if they have an ...
25
votes
3answers
1k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
6
votes
2answers
2k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
7
votes
3answers
888 views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
5
votes
3answers
640 views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...
1
vote
1answer
416 views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
8
votes
2answers
3k views

What is a good general purpose GnuPG key setup?

Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
4
votes
1answer
234 views

Potential issues with Kim Dotcom's new proposed “encrypted webmail service”

Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
3
votes
2answers
676 views

Is it reasonable to prevent timing attacks by using fixed processing time

I have systems that perform cryptographic operations within a SSL/TLS tunnel. My concern is that I may leak timing information when encrypting, decrypting, or hashing. Part 1 Is it a good idea to ...
1
vote
2answers
1k views

gpg --perfect-code

By default gpg use cast5 with sha1 (not so good) as it had AES256 and hash512! Now I want to use the perfect code to encrypt my files for both symmetric & asymmetric For --symmetric encryption ...
4
votes
1answer
260 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
3
votes
3answers
173 views

PGP keys and security contact pages

I have heard security researchers suggest that if you run a public website, you should put up a "security contact" page that includes a contact email address and your PGP public key so that people can ...
10
votes
2answers
3k views

How many GPG keys should I make?

I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
7
votes
2answers
437 views

Why are my gpg public key on my machine and on the key server different?

When I generated my PGP key using GnuPG, I had saved the public key as an ASCII version and uploaded that to the server. Now I can see the key on the keyserver but they are different blocks of data. ...
5
votes
2answers
415 views

Recipient non-repudiation in secure e-mail transport

PGP works well to provide many key aspects of information security; message confidentiality and integrity, sender and recipient authenticity, and sender non-repudiation (the sender, who has digitally ...
-1
votes
1answer
96 views

GnuPG implementations are not cross-compatible? [closed]

Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
-3
votes
1answer
1k views

is there better email, file, disk encryption than PGP? [closed]

Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable. However, PGP has been around for a long ...
8
votes
1answer
886 views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
0
votes
2answers
388 views

Network security: Public and Private keys

In Pretty Good Privacy, it is said that Sender sends compressed message and encrypts the message with the private key of himself. And then Receiver will decrypt that message with the public key of the ...
3
votes
2answers
250 views

Safely remove an expired PGP key file

since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched ...
8
votes
4answers
2k views

How can I encrypt a file using `gpg` without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
11
votes
2answers
2k views

What information is leaked from an OpenPGP encrypted file?

If an attacker obtains a file that has been encrypted using an OpenPGP public key, what information can the attacker deduce? For example, to what degree of certainty can the attacker deduce the ...
1
vote
1answer
91 views

gpg encryption date or gpg version recoverable?

Is there a way to determine the date of encryption or the gpg version of a gpg-encrypted file (with symmetric encryption)? I lost the password but some rough information about when the file was ...
4
votes
4answers
296 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
9
votes
1answer
667 views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
6
votes
1answer
98 views

What is the best way to manage package signing keys?

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment. I have initially created a signing ...
1
vote
2answers
153 views

Certificate Security in intranet Environment?

We have this topology in our company : A new rule says that each document being sent by outlook should be encrypted. we decided using PGP. We already have a certificate ( self signed). the ...
4
votes
1answer
356 views

Is OpenPGP encryption a valid replacement for SSL when passing messages?

I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
6
votes
2answers
206 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
9
votes
1answer
325 views

Can all the (other) recepients of a PGP encrypted message be identified?

Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody? ...
15
votes
3answers
2k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...