PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

68
votes
6answers
30k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
66
votes
5answers
10k views

What was so dangerous about PGP that its creator was charged in court for it?

I was reading up on the history of the PGP encryption software when I realised its creator was under criminal charges for munitions export without a license for releasing the source code of PGP. ...
31
votes
2answers
2k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
28
votes
2answers
3k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
27
votes
4answers
15k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
25
votes
3answers
2k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
23
votes
3answers
2k views

Tell people that I can encrypt emails

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In ...
21
votes
6answers
2k views

Shouldn't GPG key fetching use a secure connection?

If I run this for example: gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451 then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
20
votes
2answers
2k views

Will encrypting the same file with GPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
19
votes
6answers
1k views

Is there anything standing in the way of email encryption going mainstream? [closed]

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
17
votes
2answers
6k views

How does RSA encryption compare to PGP?

On this answer ck says RSA and PGP are different. What you are essentially asking is how do I run my petrol car on diesel? The answer is you can't. I would be interested in a more ...
16
votes
6answers
1k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good ...
16
votes
3answers
2k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
16
votes
3answers
1k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread ...
15
votes
2answers
2k views

GnuPG/OpenPGP Key Practices

I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
15
votes
2answers
2k views

Flaw in encryption through pseudorandom number stream (from gpg documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
14
votes
9answers
5k views

Encrypting email for gmail

My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
13
votes
2answers
3k views

How many GPG keys should I make?

I am learning how to use GPG keys, and I am wondering what is the threshold people generally use to maintain separate GPG keys. Maintaining an incredibly large number of keys is not good since it ...
13
votes
4answers
2k views

How can I encrypt a file using `gpg` without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
13
votes
2answers
2k views

What information is leaked from an OpenPGP encrypted file?

If an attacker obtains a file that has been encrypted using an OpenPGP public key, what information can the attacker deduce? For example, to what degree of certainty can the attacker deduce the ...
13
votes
2answers
714 views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
13
votes
2answers
2k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
13
votes
2answers
2k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
12
votes
5answers
1k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
12
votes
5answers
3k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
12
votes
2answers
442 views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alica and Bob are using. By replacing Alices and Bobs public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
11
votes
2answers
3k views

ECC in (Open)PGP

How is with the support for ECC (Elliptic Curve Cryptography) in (Open)PGP so far? It seems that GnuPG (The GNU Privacy Guard) doesn't have an official implementation - but I did find the gnupg-ecc ...
10
votes
4answers
2k views

How do I encrypt the source and destination IP address, along with various parts of an email?

If the subject makes no sense to you, that's fine, it makes no sense to me. I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
10
votes
3answers
756 views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
10
votes
2answers
2k views

Security of running openpgp.js in a browser with the private key in HTML5 localStorage

If I were to write a web application using openpgp.js (http://openpgpjs.org/) for creating PGP encrypted/signed messages and if I stored the user's private key in localStorage, would this be ...
10
votes
2answers
2k views

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or ...
9
votes
4answers
2k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
9
votes
3answers
3k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep ...
9
votes
2answers
3k views

What is a good general purpose GnuPG key setup?

Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
9
votes
1answer
354 views

Can all the (other) recepients of a PGP encrypted message be identified?

Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody? ...
9
votes
1answer
854 views

PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?

I'm quite new to OpenPGP and am just starting to use it with Thunderbird. When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
9
votes
1answer
1k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
8
votes
3answers
3k views

When changing a PGP passphrase, does it only affect the private key?

I am beginning to use GPG for email encryption. If I use gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
8
votes
3answers
609 views

Most widespread use of PGP after 20 years

Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
8
votes
3answers
1k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
8
votes
2answers
2k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
7
votes
3answers
2k views

Is it possible to verify a PGP-signed and encrypted message without decrypting it?

Let's assume I have a PGP message and I want to know who sent it, is it possible to do it if I have the RSA encrypted message, two possible senders (and their public keys that they signed and ...
7
votes
2answers
759 views

What risks are inherent with connecting to an untrusted public key server?

Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here: Shouldn't GPG key fetching use a secure connection? ...you should not trust the key ...
7
votes
4answers
4k views

Generate a PGP key with more than 4096 bits?

I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?
7
votes
3answers
3k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
7
votes
3answers
539 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
7
votes
2answers
474 views

Why are my gpg public key on my machine and on the key server different?

When I generated my PGP key using GnuPG, I had saved the public key as an ASCII version and uploaded that to the server. Now I can see the key on the keyserver but they are different blocks of data. ...
7
votes
4answers
660 views

Is it safe for GPG to compress all messages prior to encryption by default?

By default, GPG compresses text during encryption. Additionally, RFC 4880 says: 2.3. Compression OpenPGP implementations SHOULD compress the message after applying the signature but before ...
7
votes
4answers
841 views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
1answer
1k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...