PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

0
votes
1answer
34 views

What do I do about a forgotten, ancient PGP key?

So I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key ...
0
votes
1answer
55 views

What exactly is a subkey?

I fairly understand the math behind RSA, Elgamal, AES, SHA but not how things are used in practise. How are subkeys different from master key? I understand its purpose from various websites but How is ...
2
votes
2answers
88 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
0
votes
1answer
46 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
2
votes
1answer
94 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
2
votes
1answer
214 views

Can OpenPGP private keys ever be secure enough to store publicly?

The OpenPGP (private) key format stores the key symmetrically encrypted. The "iterated and salted" setup derives this key from a passphrase, taking a "octet count" parameter that determines the ...
72
votes
7answers
34k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
11
votes
3answers
2k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
0
votes
0answers
13 views

Why do PGP Keys have expiration dates? [duplicate]

I read a tutorial to get started with PGP and so far I understand the importance and the difference between encryption, decryption, signing, and verifying. However, I don't understand why a key has ...
3
votes
1answer
59 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
1
vote
1answer
49 views

Necessary components for PGP [closed]

I came across this question during an interview. I was asked: What are the two main components of PGP encryption necessary for it to work? I was thinking in line of Private and Public Keys but I am ...
2
votes
2answers
154 views

Why gpg-signed files differ every time

I signed the same file producing a separate file for the signatures, and I noticed that every file is signed with a different signature. I don't get it. Shouldn't it always be signed with the same ...
3
votes
1answer
47 views

Has my GPG subkey been uploaded to the keyserver?

I've been trying out the new ECC keys that have been added to GnuPG 2.1. I created a primary key, then added an ed25519 signing subkey. So I know get this: ➜ ~ gpg2 -K ...
0
votes
1answer
9 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
2
votes
1answer
98 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of ...
5
votes
1answer
102 views

Should I sign the CAcert key?

Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too. Question: CAcert ...
3
votes
1answer
48 views

Key generation: Differences between GnuPG classic, stable, modern?

I plan to create a 4096 bit RSA&RSA key pair: gpg --gen-key --personal-digest-preferences SHA512 --cert-digest-algo SHA512 Is there any difference in generated key quality between versions 1.4 ...
2
votes
1answer
33 views

Upgrading OpenPGP public key on key servers?

What is the best way to upgrade an OpenPGP key that was created 11 years ago? It's 1024-bit and is published on the key server. I can create a new key, but what's the proper way to update the ...
3
votes
3answers
464 views

Two-way PGP email without publishing your key / address to a key server?

If I want to have some privacy and avoid the attention of publishing my email address to the public key server web of trust, yet have a secure two-way email conversation with one recipient, what are ...
2
votes
1answer
80 views

Is it safer to use a PGP key encrypted with a password than just the same password separately?

I'd like to encrypt some master passwords that I want to store with added security outside of KeePass, instead as just a normal record in the database. I was considering storing these passwords in an ...
1
vote
0answers
31 views

Software to use for encrypting data in PHP [closed]

I'm interested in programming and information security, I would like to combine both my interests to build sort of password manager. This would be how the user would interact with the site: Alice ...
2
votes
2answers
300 views

PGP as method of sharing AES key?

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption? Server sends PGP public key Client generates (uses as AES key for ...
0
votes
1answer
26 views

How do I import a GnuPG private PGP key into Symantec PGP commandline?

I am trying to import a private PGP key into Symantec PGP command line that originated in GnuPGP (1.4.11 AIX) into a Windows system. When I do a pgp --import private.asc, then do a pgp --list-keys ...
0
votes
0answers
12 views

What user interface is most useful to users who use PGP Key Splitting, or other Shamir-based keys?

I am developing an application that uses Shamir-based key splitting, and am looking at various products and am looking for a user-friendly, possibly dynamic graph that helps users build and manage key ...
3
votes
3answers
144 views

The best way to change my pgp key

I would like to change my pgp key because I have the same one 2 years ago. But, I want to warn my freinds that the owner of the old key and the owner of the new one is the same person (me). hwat is ...
23
votes
6answers
3k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
4
votes
8answers
320 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
1
vote
3answers
65 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
5
votes
1answer
267 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
-1
votes
2answers
104 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
4
votes
1answer
75 views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
2
votes
1answer
87 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
2
votes
1answer
41 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
2
votes
1answer
58 views

What is “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
2
votes
2answers
63 views

GPG Web-of-Trust Level [duplicate]

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
3
votes
1answer
90 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
3
votes
3answers
2k views

Extracting the PGP keyid from the Public key file?

is there a way via an CLI tool or some kind of API to extract the PGP KEY ID from the PGP PUBLIC KEY BLOCK ? I did find the hexa value of the key in the binary file, however I guess the position is ...
0
votes
1answer
46 views

Keep OpenPGP revocation certificate in safe place?

Do I have to keep the revocation certificate of my OpenPGP key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines? I know that, if compromised, the certificate can ...
2
votes
1answer
89 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
1
vote
1answer
128 views

One public key contains all subkeys?

I've created a keypair with gpg2 --gen-key Then I created a subkey only for signing. If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypting and one for ...
1
vote
1answer
100 views

GPG encryption date or GPG version recoverable?

Is there a way to determine the date of encryption or the GPG version of a GPG-encrypted file (with symmetric encryption)? I lost the password but some rough information about when the file was ...
1
vote
2answers
176 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
1
vote
2answers
374 views

How to get the prime number of a secret key in GnuPG?

When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find the actual prime number from the secret key? That ...
1
vote
3answers
146 views

What is the web of trust?

I'm studying network and system security and I came across the phrase "web of trust". From Wikipedia: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other ...
1
vote
1answer
53 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
4
votes
2answers
1k views

Can GPG be a full replacement for PGP?

I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement. Does GPG do everything PGP can do? I've researched a lot ...
27
votes
3answers
3k views

Tell people that I can encrypt emails

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In ...
10
votes
3answers
4k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep ...
16
votes
4answers
3k views

How can I encrypt a file using gpg without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...