Tagged Questions

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

1
vote
0answers
18 views

How do I display the usage flags for my encryption keys in a less hackish way? [migrated]

I am trying to educate myself on the use of encryption keys and I've been experimenting with this old Linus Torvalds’ key that I found 956EB7BF449FA3AB. I am interested to display the usage flags but ...
0
votes
1answer
34 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
1
vote
2answers
42 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
0
votes
2answers
76 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
2
votes
1answer
24 views

What is validity in terms of PGP 6.5.8?

In PGP 6.5.8, there is a concept of "validity" for a key, and it shows in the user interface for each key on the keyring. What is this concept, and how to you set it so a key is considered valid?
1
vote
3answers
302 views

What is the difference between a key algorithm and the encryption algorithm?

I just starting to learn about PGP encryption. One thing that confuses me is the difference between a key algorithm, and an encryption algorithm. For example, lets say I have a trading partner (EDI ...
16
votes
6answers
1k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good ...
0
votes
1answer
47 views

What is the difference between “unknown” and “undefined” trust?

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
0
votes
2answers
65 views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
1
vote
1answer
49 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
-2
votes
0answers
27 views

newbie: identifying sender of email from their pgp signature

I have just installed enigmail and set up my openpgp key. I sent signed mails to two different email accounts that i have and noticed that they each have a different PGP messages. How can the PGP ...
1
vote
0answers
56 views

Secure self-concealing symmetric encryption (non-verifiable decryption)?

From what I observed using standard encryption tools such as OpenSSH and GPG, the decryption only succeeds when the correct password/key is provided (or at most a few others, in case of collision). ...
0
votes
1answer
44 views

Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?

According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
1
vote
2answers
45 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
2
votes
3answers
67 views

GPG keys & SHA-1

I've heard that SHA-1 hashing is becoming less secure, and that most GPG keys are secured with SHA-1. Is there a way to determined if SHA-1 is in my GPG key, and what to do if this is the case?
1
vote
2answers
94 views

Does adding multiple recipients to an encrypted message decrease security?

Let's say you want to send the same GPG/OpenPGP encrypted message to 50+ recipients. Assuming everyone you send to is trusted, and there is no risk of any recipient leaking their secret key, is ...
2
votes
1answer
58 views

Which PGP settings have been found to be vulnerable?

Digging through articles, one often finds recommendations such as "Use the default key type/size X", whereas an article written a few years later will write "Key type/size X has been found to be ...
0
votes
1answer
56 views

GnuPG / OpenPGP: How to eliminate redundancy in PGP private key?

I examined a few randomly generated private keys generated by Gnu PG, and found a lot of redundancy. It is enclosed by -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY BLOCK----- ...
0
votes
3answers
39 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
1
vote
1answer
29 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
3
votes
1answer
42 views

How long to keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
3
votes
1answer
62 views

Will PGP signed email be blocked in China?

I generally sign all of my outgoing email with PGP. I don't usually encrypt it because most people I send mail to don't have a public key. Anyway, if I send an unencrypted message with a PGP signature ...
2
votes
3answers
83 views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
23
votes
3answers
2k views

Tell people that I can encrypt emails

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In ...
0
votes
2answers
46 views

Can I generate multiple PGP key pairs for later use

I was just wondering if I can generate couple of PGP key pairs and save them for later use or backup. In addition can I be sure that other wont generate and use some of my key pairs in the meantime. I ...
1
vote
3answers
84 views

How can an email sender include his PGP key, so I can answer with an encrypted mail?

Let's say I were to post my e-mail address and public PGP key to my website. When a client contacts me, they would have to include their PGP public key in the e-mail so that I can respond to them in ...
1
vote
2answers
42 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...
6
votes
3answers
83 views

Why can't PGP/GPG Web-of-Trust be automated?

We heard lots of complaints about hard to use crypto tools, and recent ideas of Google how to fix this. I had another idea about this which seems quite obvious, but couldn't find anything about it on ...
1
vote
1answer
76 views

Are SSH keys and PGP keys the same thing?

I have a 3072 bit RSA key that I generated for use with SSH. Can this key-pair be used with PGP/GPG, or do I need to generate a new pair of keys separately for use in email encryption? Are the two ...
2
votes
2answers
128 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
2
votes
2answers
102 views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
0
votes
1answer
28 views

Keep GPG revocation certificate in safe place?

Do I have to keep the revocation certificate of my GPG key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines? I know that, if compromised, the certificate can be ...
0
votes
2answers
59 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
1
vote
3answers
77 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
0
votes
2answers
45 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
1
vote
2answers
152 views

PGP Encryption - Whats the need to encrypt using random one time key? [duplicate]

I just read about PGP encryption scheme here, and started wondering what is the need to encrypt the file with a one time random key? In other words, how is this scheme more secure than simply sending ...
1
vote
7answers
199 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
28
votes
2answers
3k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
0
votes
1answer
91 views

Tor, PGP and Tor Entrance Nodes

Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
2
votes
2answers
121 views

PGP/GPG verifying authenticity

My boss recently implemented a new security system related to PGP/GPG. The whole idea behind this is to sign files so that people know from who they came. They don't require us to encrypt them, just ...
0
votes
0answers
33 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
1
vote
2answers
112 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
4
votes
4answers
124 views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
1
vote
3answers
245 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
0
votes
1answer
40 views

What is “web of trust” in PGP and S-MIME? [duplicate]

I'm studying network and system security and I came across the phrase Web of Trust: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
1
vote
3answers
84 views

PGP and S-MIME What is web of trust?

I'm studying network and system security and i came across the phrase Web of Trust! In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
2
votes
3answers
98 views

What does the pgp public key length depend on?

What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?
1
vote
2answers
41 views

Is PGP web of trust exportable?

I know that in local PGP keyrings, there's an idea of trust: I trust this key ultimately, this key less than that, etc. Is this web-of-trust exportable? For example, if I trust someone@openssl.org ...
3
votes
1answer
38 views

Transferring of keys from key servers to recipients

When I download PGP keys from keyservers like so: gpg --search-keys steve@openssl.org How are the public keys transferred down to my machine? Is there a possibility of a MITM attack to serve me the ...