PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

1
vote
3answers
32 views

How to avoid identity theft at key signing parties?

Let me begin by distinguishing two kinds of identity theft: Conventional identity theft (e.g. using credentials from ID documents, bank accounts, etc, to commit fraud or other mischief). ...
3
votes
1answer
49 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
22
votes
6answers
3k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
1
vote
1answer
27 views

Necessary components for PGP

I came across this question during an interview. I was asked: What are the two main components of PGP encryption necessary for it to work? I was thinking in line of Private and Public Keys but I am ...
2
votes
2answers
275 views

PGP as method of sharing AES key?

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption? Server sends PGP public key Client generates (uses as AES key for ...
5
votes
1answer
253 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
-1
votes
2answers
71 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
4
votes
1answer
51 views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
2
votes
1answer
74 views

Why can't I upload a new ECC key to key servers, which is supported by GnuPG 2.1?

My OpenPGP key is soon to expire so I wanted to create a new one. GPG 2.1 came out a month ago including ECC support and I wanted to try the new key types. So I have generated a brand new ed25519 ...
1
vote
0answers
19 views

Encrypt Lightning event invite mails with pgp [migrated]

I use Thunderbirds/Icedoves Lightning add-on to manage my calendar, tasks and notes. When creating an event I can add attendees and send invitations to them, but they won't use their public pgp keys ...
2
votes
1answer
35 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
2
votes
1answer
26 views

What is “PGP Global Directory Verification Key”?

In the server keys of the MIT, there is several signatures from "PGP Global Directory Verification Key". Example (from http://pgp.mit.edu/pks/lookup?op=vindex&search=0xB63024F96C73DA99): sig ...
1
vote
2answers
67 views

How to properly transition from standard PGP keys to using subkeys?

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like ...
1
vote
0answers
23 views

Use PGP/Mime with Thunderbird and Enigmail [migrated]

I would like to sign all my mail with my PGP key, and no matter if the recipient uses PGP or not, it should not confuse them. Last week I read a discussion that inline PGP is not good pratice, and I ...
2
votes
2answers
47 views

GPG Web-of-Trust Level [duplicate]

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
2
votes
1answer
73 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized ...
3
votes
3answers
2k views

Extracting the PGP keyid from the Public key file?

is there a way via an CLI tool or some kind of API to extract the PGP KEY ID from the PGP PUBLIC KEY BLOCK ? I did find the hexa value of the key in the binary file, however I guess the position is ...
0
votes
1answer
38 views

Keep OpenPGP revocation certificate in safe place?

Do I have to keep the revocation certificate of my OpenPGP key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines? I know that, if compromised, the certificate can ...
2
votes
1answer
89 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
1
vote
1answer
113 views

One public key contains all subkeys?

I've created a keypair with gpg2 --gen-key Then I created a subkey only for signing. If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypting and one for ...
1
vote
1answer
96 views

GPG encryption date or GPG version recoverable?

Is there a way to determine the date of encryption or the GPG version of a GPG-encrypted file (with symmetric encryption)? I lost the password but some rough information about when the file was ...
1
vote
2answers
173 views

Certificate security in intranet environment?

We have this topology in our company: A new rule says that each document being sent by Outlook should be encrypted. We decided using PGP. We already have a certificate (self-signed). The problem ...
1
vote
2answers
364 views

How to get the prime number of a secret key in GnuPG?

When I use GnuPG I can get a secret key saved as a file. Opening this file in a text editor I see that the key is encoded with base64. How do I find the actual prime number from the secret key? That ...
3
votes
7answers
257 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
1
vote
3answers
133 views

What is the web of trust?

I'm studying network and system security and I came across the phrase "web of trust". From Wikipedia: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other ...
1
vote
1answer
49 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
4
votes
2answers
1k views

Can GPG be a full replacement for PGP?

I am working on automating a PGP process and plan to replace using PGP with GPG. But I need to make sure GPG can actually be a replacement. Does GPG do everything PGP can do? I've researched a lot ...
27
votes
3answers
3k views

Tell people that I can encrypt emails

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In ...
10
votes
3answers
4k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep ...
15
votes
4answers
3k views

How can I encrypt a file using gpg without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
18
votes
3answers
2k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread ...
16
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
4
votes
1answer
65 views

How long do keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
-1
votes
1answer
135 views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
17
votes
6answers
1k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good ...
2
votes
1answer
64 views

Why are PGP signatures not more widely used as an authentication method?

Example: Bob generates a key pair for this example. Bob registers at example dot com where he provides his public key. When Bob will try to log in, example dot com will ask him to sign a random ...
2
votes
1answer
98 views

Wrapping my head around Protonmail

I've been trying to grasp how Protonmail could work. From what it gather, it works like this: When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
0
votes
1answer
15 views

What are valid OpenPGP revocation signature types?

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL ...
2
votes
2answers
71 views

Distributing public keys; with or without a sub-key?

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does ...
0
votes
1answer
52 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
2
votes
1answer
74 views

Is it necessary to remove the primary secret GPG key from your laptop if it has full-disk encryption?

According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back ...
0
votes
2answers
98 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
4
votes
2answers
3k views

Is your PGP passphrase used to decrypt an encrypted private key, or needed in conjunction with the private key to decrypt the message?

If the former, then if the private key can be used to digitally sign messages, why doesn't your client offer to encrypt this highly sensitive piece of data? If the latter, then if someone had access ...
2
votes
1answer
29 views

What is validity in terms of PGP 6.5.8?

In PGP 6.5.8, there is a concept of "validity" for a key, and it shows in the user interface for each key on the keyring. What is this concept, and how to you set it so a key is considered valid?
1
vote
3answers
347 views

What is the difference between a key algorithm and the encryption algorithm?

I just starting to learn about PGP encryption. One thing that confuses me is the difference between a key algorithm, and an encryption algorithm. For example, lets say I have a trading partner (EDI ...
10
votes
4answers
3k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
1
vote
1answer
61 views

What is the difference between “unknown” and “undefined” trust?

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
0
votes
2answers
98 views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
2
votes
3answers
92 views

GPG keys & SHA-1

I've heard that SHA-1 hashing is becoming less secure, and that most GPG keys are secured with SHA-1. Is there a way to determined if SHA-1 is in my GPG key, and what to do if this is the case?