PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

-3
votes
0answers
13 views

Tails and GPG and IMAP and anon [on hold]

What is the best free email provider to use with tails clawsmail?
2
votes
2answers
110 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
0
votes
1answer
12 views

Keep GPG revocation certificate in safe place?

Do I have to keep the revocation certificate of my GPG key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines? I know that, if compromised, the certificate can be ...
-1
votes
0answers
22 views

Is there a GPG-compatible tool that downloads all the keys that have signed some of my downloaded keys? [closed]

I just had my first key signing party with just some friends from a much bigger group of loose friends. So I signed a few keys within the big group, but it is safe to assume that a lot of people in ...
1
vote
2answers
46 views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
0
votes
2answers
42 views

Is there any reason to send file checksum for signed, encrypted files with MDC

I am using OpenPGP and sending a signed, encrypted file with forced MDC (Modification Detection Code) over the network. In typical file transfer scenarios where security is not in picture, an md5 ...
6
votes
4answers
804 views

Can a PGP private key be deduced if the email text is known?

Suppose I send a PGP-encrypted email to person A, and the same email (same subject line, same message text) unencrypted to person B. Suppose a secret service intercepts both messages. The secret ...
0
votes
3answers
76 views

What does the pgp public key length depend on?

What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?
1
vote
3answers
47 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
1
vote
1answer
154 views

PGP as method of sharing AES key?

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption? Server sends PGP public key Client generates (uses as AES key for ...
0
votes
2answers
37 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
5
votes
4answers
255 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
1
vote
2answers
1k views

gpg --perfect-code

By default gpg use CAST5 with SHA1 (not so good) as it had AES256 and hash512! Now I want to use the perfect code to encrypt my files for both symmetric & asymmetric For symmetric encryption I ...
1
vote
2answers
130 views

PGP Encryption - Whats the need to encrypt using random one time key? [duplicate]

I just read about PGP encryption scheme here, and started wondering what is the need to encrypt the file with a one time random key? In other words, how is this scheme more secure than simply sending ...
28
votes
2answers
3k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
1
vote
7answers
172 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
2
votes
1answer
24 views

Should I sign the CAcert key?

Recently I got a CAcert Assurance and discovered that I can get my PGP key signed by CAcert key. After I got their signature, CAcert website suggested that I sign their key, too. Question: Cacert ...
5
votes
2answers
397 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
0
votes
1answer
53 views

Tor, PGP and Tor Entrance Nodes

Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
2
votes
2answers
76 views

PGP/GPG verifying authenticity

My apologies in advance if this is the wrong section to post in or if this question has been asked before. I'll try to keep this as short as I can. My boss recently implemented a new security system ...
4
votes
4answers
65 views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
0
votes
0answers
32 views

Converting PGP2.x UIDs on a GPG key

I have a couple of keys which were created many years ago, before GPG came out. (But let's pretend there's only one key involved.) The key has a mix of GPG and PGP-2.x-style UIDs. I've made one of ...
15
votes
3answers
1k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread ...
1
vote
2answers
92 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
10
votes
2answers
3k views

ECC in (Open)PGP

How is with the support for ECC (Elliptic Curve Cryptography) in (Open)PGP so far? It seems that GnuPG (The GNU Privacy Guard) doesn't have an official implementation - but I did find the gnupg-ecc ...
1
vote
3answers
161 views

Is storing the private key and public keys in same directory on server recommended, like OwnCloud does?

Is this recommended or a good/normal practice? I think not. Because I saw that OwnCloud stores all encryption keys in one directory on the server. One directory contains the private key(s) and one all ...
1
vote
3answers
63 views

PGP and S-MIME What is web of trust?

I'm studying network and system security and i came across the phrase Web of Trust! In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
0
votes
1answer
34 views

What is “web of trust” in PGP and S-MIME? [duplicate]

I'm studying network and system security and I came across the phrase Web of Trust: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
1
vote
2answers
38 views

Is PGP web of trust exportable?

I know that in local PGP keyrings, there's an idea of trust: I trust this key ultimately, this key less than that, etc. Is this web-of-trust exportable? For example, if I trust someone@openssl.org ...
3
votes
1answer
32 views

Transferring of keys from key servers to recipients

When I download PGP keys from keyservers like so: gpg --search-keys steve@openssl.org How are the public keys transferred down to my machine? Is there a possibility of a MITM attack to serve me the ...
1
vote
1answer
51 views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...
3
votes
1answer
67 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
1
vote
1answer
97 views

How are private keys (sMIME, PGP, etc) synchronized across a user's devices?

Given that user needs to store a copy of the same private key on each of his devices (in order to decrypt email and other data encrypted with the public key) ... what are some general techniques for ...
2
votes
1answer
84 views

Why do I have keys of strangers in my GPG keychain?

I'm going though my GPG keychain. I've got a key for a few strangers in my keychain. I don't recall exchanging keys and I'm not sure how the public keys came to be installed in the keychain. I think ...
2
votes
1answer
47 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
0
votes
2answers
2k views

Public keys on OpenSSL vs PGP?

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as ...
0
votes
1answer
52 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
0
votes
1answer
69 views

Use same PGP key for private and business mail addresses [duplicate]

I'm asking myself which one is better: Use the same PGP key pair for use with both private email addresses and business email addresses Use two separate PGP key pairs, one for private and one for ...
6
votes
3answers
482 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
6
votes
2answers
2k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
13
votes
2answers
641 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
1
vote
1answer
50 views

How to validate the confirmation link received when publishing a new PGP key?

I find PGP to be quite a complex subject. I have gotten to a point where I need to give a client a public key for encryption. I have successfully done my homework, generating a public key from my ...
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
3
votes
1answer
92 views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
2
votes
1answer
98 views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
9
votes
4answers
2k views

How can I encrypt a file using `gpg` without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
3
votes
4answers
83 views

Does a PGP signature provide integrity verification?

Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files. Simply put, do PGP signatures provide file integrity ...
1
vote
1answer
269 views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
9
votes
4answers
2k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...