PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

1
vote
0answers
36 views

Details related to the ZIP algorithm used in PGP message encryption [closed]

I am very new to PGP. PGP encryption works with hash function, asymmetric encryption, symmetric encryption and a zip algorithm (LZ77). What I know is that the zip algorithm is used to reduce the ...
1
vote
3answers
97 views

Is it possible that to sign a message with a PGP key in a way that leakes the key

Alice provides a software for signing messages. The software runs in a airgapped enviroment. The software is given the message that's to be signed and the private key. The software then produces a ...
1
vote
1answer
46 views

Using ECC for PGP-Master Key in combination with Yubikey

I acquired a Yubikey Neo last month. Now I want to use the Smart-Card functionality for PGP. I followed the official guides on the Yubico Website tested it with 2048 RSA Keys and it worked fine. But ...
3
votes
1answer
34 views

Merge a second OpenPGP key pair into user id of other key

I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from ...
2
votes
1answer
41 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
3
votes
1answer
54 views

How to verify an OpenPGP key's ownership?

I've added the public key of Diceware creator (please use it as a practical example), I've added it by downloading diceware.wordlist.asc, and I didn't have his key and couldn't immediately find it to ...
1
vote
0answers
24 views

Sharing master cert and verifying certs with that [migrated]

I'm working on an application which has to download some files frequently. I thought signing files is a good idea. So first thing I thought to do is to create a master cert and somehow distribute it ...
3
votes
1answer
82 views

GnuPG - Problems with large RSA keys

I have read that GnuPG limits the size of RSA keys to 4096-bits because this could lead to problems with running out of secure memory. But in which operation is this the case? Generating the keys? ...
4
votes
2answers
37 views

What do the terms used in OpenPGP keyserver SKS mean? (sig, sbind, sig3, exp2, Policy, …)

When viewing a key record in a public key server, such as this one, there are lots of keywords used: sig, sig3, exp3, Policy, sbind…). I understand that "sig" probably means a signature, but what's ...
14
votes
3answers
776 views

Why is encryption (or signing) of long lines in E-Mails with PGP problematic?

I am using Thunderbird with Enigmail and OpenPGP to encrypt and/or sign E-Mails. On many occasions Enigmail complains that I have too long lines in the mail and asks how it should wrap them. However ...
1
vote
1answer
36 views

What does the letter in an OpenPGP key's bits definition (like 4096D) denote?

I noticed that when looking at OpenPGP keys on a key server, the key's bits definition is usually followed by a letter, as in "4096D" for example. However, there are also keys with other letters than ...
2
votes
1answer
32 views

Multiple OpenPGP encryption keys signed by a single certificatation key?

Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do ...
2
votes
3answers
53 views

Chaining multiple PGP keys

I would like to know the practical limitations to contact chaining multiple peoples pgp key's in order to protect a file. In normal public key cryptography, four keys are required, public and private ...
4
votes
2answers
196 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
16
votes
3answers
5k views

ECC in (Open)PGP

How is with the support for ECC (Elliptic Curve Cryptography) in (Open)PGP so far? It seems that GnuPG (The GNU Privacy Guard) doesn't have an official implementation - but I did find the gnupg-ecc ...
3
votes
1answer
101 views

What public GPG key do I have to publish?

I just created a master key and two subkeys. The first subkey is used for encryption, the second one for signing. Now I am wondering what public key do I have to publish on my website. Does is ...
4
votes
1answer
38 views

Do I need to revoke both my OpenPGP primary key and subkey?

After creating an OpenPGP key pair in GnuPG, if I list keys with gpg --list-keys, I get (GnuPG default): /someone/.gnupg/pubring.gpg ------------------------ pub 2048R/BC589B05 2015-07-15 uid ...
8
votes
1answer
133 views

What to do with a PGP/GPG key to which I've lost the private key?

I created a private key with an Android app I'm no longer using. I had uploaded the public key to the keyservers without setting an expiry date. I later deinstalled that app, and deinstalling ...
8
votes
3answers
889 views

Can I expose a passphrase-protected private OpenPGP key? [duplicate]

I have created a 4096-bit key-pair using GnuPG. Can I expose the passphrase-protected private key to an untrusted system? E.g. can I put that key in my Dropbox account or send it to myself as an ...
1
vote
1answer
20 views

Why has my OpenPGP key been duplicated on expiry change?

I've published my OpenPGP key publicly on the MIT key server. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with. I managed to do this ...
1
vote
1answer
32 views

Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different ...
3
votes
3answers
623 views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by Textsecure and is an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have ...
0
votes
1answer
56 views

Is there a way to change the creation date of a GPG/PGP cert

How can I modify the creation date of a GPG/PGP key? I can set the Creation-Date while creating a key. But can I change this Creation-Date after the key was created? I cannot find how to do this.
2
votes
1answer
106 views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
0
votes
0answers
12 views

Risk to pgp secret keys with known cleartext/ciphertext? [duplicate]

There are a couple of schemes which encrypt IMAP message stores to yourself using GPG/PGP. Which makes initial sense and would keep casual snoopers from getting email. But it raises a question as ...
23
votes
2answers
6k views

How many GPG keys should I make?

I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
1
vote
1answer
26 views

Are PGP/GnuPG trust information transferred to key servers?

When signing a key X in the PGP Web of Trust model, I assign the key full validity. Other people who have my key in their key ring can regard X as valid as far as they fully trust me (owner trust). ...
3
votes
3answers
890 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
18
votes
5answers
1k views

Considerations for long-term key storage (paper backup, media for vault storage)?

I'm reviewing our company's security procedures regarding cryptographic keys and master passwords, and also my private system at home. The key generation process is pretty much the same as that ...
4
votes
1answer
3k views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
0
votes
2answers
27 views

Is there a way to attack STARTTLS + certificate pinning probed from multiple places?

I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
21
votes
2answers
4k views

Will encrypting the same file with GnuPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GnuPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
-2
votes
2answers
54 views

Are these statements correct [closed]

Are the following three statements more or less correct: -To send someone an encrypted email basically entails having access to their public key (either smime or pgp). Thus for all practical ...
2
votes
1answer
26 views

Is it okay to omit the 'Version:' line in a PGP public key? [duplicate]

The software I use to generate my PGP keys doesn't include the 'Version:' line that most PGP software includes by default. Almost every public key I've seen begins like this: -----BEGIN PGP PUBLIC ...
4
votes
2answers
251 views

Sharing RSA keys between PGP and SSH protocols: Does this pose a security risk?

If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? When I do, should I ...
0
votes
2answers
52 views

Signing an OpenPGP public key that is not uploaded to a key server

Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has ...
13
votes
3answers
4k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
1
vote
1answer
71 views

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

The OpenPGP key contains a list of personal algorithm preferences (the meaning of the numbers can be decoded in RFC 4880): # gpg -a --export "foo@example.com" | gpg --list-packets | fgrep 'pref-' ...
3
votes
1answer
152 views

toy OpenPGP encryption with manually generated keys

I've been playing around with OpenPGP encryption for a little while. Here are the steps I've followed: Generate an unencrypted public/private key pair in my keyring with gpg --gen-key. Dump the ...
2
votes
1answer
177 views

How to tell if my OpenPGP public key is self-signed?

I recently read: You should sign your PGP public key immediately after generating your public/private key-pair. And now I wonder how I can check whether I already did that. So my question is: ...
-1
votes
4answers
132 views

What mail applications use crypto?

I just read that everyone in the world can ready my mails (if intercepted in traffic by eavesdropping?). Also, it reads that current versions (book's from 2004 so I assume that new versions adopt ...
3
votes
1answer
95 views

How to decrypt email with revoked key in enigmail?

Is it possible to decrypt a message which is encrypted with a revoked PGP key? I still have the private key, but Enigmail doesn't show me revoked keys neither does automatic decryption. Edit: I ...
1
vote
2answers
98 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
5
votes
1answer
122 views

Master offline key, shared encryption/decryption key, unique signing keys?

I've read quite a few different articles on how to setup PGP keys with an offline master key. I own multiple YubiKey NEO hardware smart cards which I intend on using for PGP and as an SSH key. One of ...
17
votes
2answers
1k views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
0
votes
1answer
36 views

Risk of pgp-key to be compromised on smartphone [closed]

What risks to compromise my key, aside from the risk of the phone to be stolen, do I face when I use my private pgp key on a Motorola smartphone with the K-9-app? Can I mimimize the risk by using a ...
8
votes
3answers
576 views

Does OpenPGP encryption mean that not even I can see my data?

Say I have an email and I want to send it to someone else. I encrypt it with his public key. This ensures that only he can read my message. Does this also means that I won't be able to read it? If so, ...
3
votes
1answer
78 views

PGP Owner Trust Field & Signature Trust Field Distinction

I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
4
votes
2answers
150 views

Is it possible and does it make sense to sign an E-mail with PGP and S/MIME?

After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here. I know that, PGP and S/MIME ...
6
votes
4answers
416 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...