PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

9
votes
2answers
753 views

Recipient non-repudiation in secure e-mail transport

PGP works well to provide many key aspects of information security; message confidentiality and integrity, sender and recipient authenticity, and sender non-repudiation (the sender, who has digitally ...
-1
votes
1answer
133 views

GnuPG implementations are not cross-compatible? [closed]

Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
-3
votes
1answer
2k views

is there better email, file, disk encryption than PGP? [closed]

Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable. However, PGP has been around for a long time,...
14
votes
1answer
2k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
0
votes
2answers
664 views

Network security: Public and Private keys

In Pretty Good Privacy, it is said that Sender sends compressed message and encrypts the message with the private key of himself. And then Receiver will decrypt that message with the public key of the ...
3
votes
2answers
451 views

Safely remove an expired PGP key file

since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched ...
22
votes
4answers
6k views

How can I encrypt a file using gpg without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
21
votes
2answers
5k views

What information is leaked from an OpenPGP encrypted file?

If an attacker obtains a file that has been encrypted using an OpenPGP public key, what information can the attacker deduce? For example, to what degree of certainty can the attacker deduce the ...
1
vote
1answer
118 views

GPG encryption date or GPG version recoverable?

Is there a way to determine the date of encryption or the GPG version of a GPG-encrypted file (with symmetric encryption)? I lost the password but some rough information about when the file was ...
4
votes
4answers
366 views

Securely publishing GPG keys

This is probably a stupid question/vaguely defined, but I need to ask it anyway. I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
14
votes
1answer
2k views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
7
votes
1answer
129 views

What is the best way to manage package signing keys?

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment. I have initially created a signing ...
1
vote
2answers
264 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
4
votes
1answer
477 views

Is OpenPGP encryption a valid replacement for SSL when passing messages?

I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
8
votes
3answers
437 views

Is DKIM needed for emails encrypted with OpenPGP?

DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did. ...
10
votes
1answer
694 views

Can all the (other) recepients of a PGP encrypted message be identified?

Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?
21
votes
3answers
4k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
4
votes
2answers
232 views

How to refuse delivering emails that are not signed by trusted PGP keys?

I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
6
votes
1answer
276 views

Could a consumer-friendly PGP-like file encryption application theoretically be secure?

In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
10
votes
4answers
8k views

Secure way to transfer public/secret key to second computer

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
6
votes
2answers
2k views

Can GPG be a full replacement for PGP?

I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement. Does GPG do everything PGP can do? I've researched a lot ...
2
votes
3answers
908 views

Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations? ...
6
votes
2answers
1k views

Does using both GPG encrypted files and encrypted filesystem make sense?

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
1
vote
1answer
252 views

PGP Secret Key Values calculation

I know this is somewhat counterintuitive, but: Does anyone know of any place where I might get intermediate values from PGP when it decrypts the secret values of the Secret Key packets and shows ...
2
votes
1answer
187 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

As a user of PGP I worry about receiving a virus that was previous encrypted with my public key, which anybody can get by querying many PGP key servers. What prevents an attacker to target a PGP user ...
8
votes
4answers
1k views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
2
votes
1answer
109 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
2
votes
1answer
2k views

Brute-force a passphrase, generated by `pwgen 16 -s`, of a GPG CAST5 archive

A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses ...
4
votes
1answer
2k views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
5
votes
2answers
1k views

Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?

Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption. Should slow hash function (like bcrypt) be applied to password before using it with ...
-3
votes
1answer
794 views

Safest and most secure way for backing up private data

Here is what happened, I first collected my data into one folder,tar'd it, encrypted it with gpg, put it in truecrypt container, and after that started to copy the container to another place, but ...
3
votes
2answers
551 views

Security of GPG encryption with AES and MD5 if MD5 is broken

I have a file encrypted with gpg, using AES256 and MD5. Suppose that the MD5 hash function is broken, but not the AES cipher. Does that make it easy to crack decrypt the file?
21
votes
3answers
4k views

Does OpenPGP key expiration add to security?

I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
4
votes
2answers
7k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
14
votes
3answers
6k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep <sitename&...
3
votes
1answer
225 views

Complex Consumer Matching Queries with PGP Universal

For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. ...
0
votes
2answers
758 views

Whether PGP is send over MIME?

If I am using PGP to encrypt mails whther it is send as a MIME (Multipurpose Internet Mail Extensions) message, and S/MIME and PGP are used for providing email security. When I send PGP message ...
4
votes
2answers
2k views

What encryption schemes require two or 3 private keys to read a message?

I would like to encrypt some data so that it can only be read if two or three people use a private secret to decrypt the data. What is the best / most modern way to accomplish multi-person ...
5
votes
2answers
10k views

Automating PGP encryption? (Windows)

Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times ...
11
votes
4answers
6k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
2
votes
2answers
323 views

OpenPGP: Sign-Verify workflow without Encrypt-Decrypt?

Is it a good and/or frequent practice to sign a file (with your own private key) without encrypting it (with the intended recipient's public key?) I haven't really been able to find a direct answer to ...
0
votes
1answer
991 views

Is Data Object on openPGP smartcard v2 encrypted?

currently I thinking about on-the-fly disk encryption using Truecrypt/dmcrypt LUKS with key stored on smartcard. I would like to use openPGP v2 smart card, respectively GPF Cryptostick which is based ...
6
votes
3answers
153 views

Should I make sure to get all of my OpenPGP uids are signed?

Should I make sure that I get all of the uids associated to my OpenPGP key signed, or is it enough to have one of them signed? If Bob can guarantee that alice@example.com belongs to Alice, I can't ...
7
votes
2answers
1k views

Enforce Code/Script Signing

I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ...
7
votes
3answers
4k views

Is it possible to verify a PGP-signed and encrypted message without decrypting it?

Let's assume I have a PGP message and I want to know who sent it, is it possible to do it if I have the RSA encrypted message, two possible senders (and their public keys that they signed and ...
6
votes
3answers
6k views

How can I convert my encypted PGP secret key for use performing SSH authentication?

I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
7
votes
1answer
554 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
12
votes
5answers
7k views

Generate a PGP key with more than 4096 bits?

I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?
21
votes
2answers
4k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
10
votes
3answers
5k views

How can PGP and openPGP be compatible?

PGP and openPGP use different encryption algorithms. As I understand, PGP uses IDEA to encrypt a message, then RSA to encrypt the IDEA key. If openPGP doesn't use IDEA, how can it read PGP-encrypted ...