PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...
29
votes
6answers
9k views
How should I distribute my public key?
I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
22
votes
3answers
1k views
Is authentication using personal pictures more secure than passwords?
Statement 1
There is a start up called PixelPin. On the web site it reads:
The PixelPin solution is simple and quick to use, yet very secure.
PixelPin eliminates the traditional alphanumeric ...
16
votes
4answers
5k views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
13
votes
2answers
384 views
Will encrypting the same file with GPG and the same key produce the same ciphertext?
If I encrypt the same file twice with GPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
12
votes
9answers
4k views
Encrypting email for gmail
My friend who is an accountant was asking me what the best way to exchange documents with clients. He was trying to tell me that just sending via email was sufficient and I told him he was insane. I ...
11
votes
2answers
3k views
How does RSA encryption compare to PGP?
On this answer ck says
RSA and PGP are different.
What you are essentially asking is how
do I run my petrol car on diesel? The
answer is you can't.
I would be interested in a more ...
11
votes
2answers
737 views
Flaw in encryption through pseudorandom number stream (from gpg documentation)
I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity:
When I was in college in the early 70s, I devised what I believed was a brilliant ...
10
votes
5answers
641 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
10
votes
6answers
803 views
Shouldn't GPG key fetching use a secure connection?
If I run this for example:
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451
then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
10
votes
2answers
1k views
GnuPG/OpenPGP Key Practices
I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to ...
9
votes
5answers
1k views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
9
votes
2answers
589 views
Does my PGP key really need to match the e-mail address for which I'll be using it?
In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
8
votes
4answers
271 views
Why does PGP use symmetric encryption and RSA?
Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
8
votes
3answers
690 views
In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
8
votes
3answers
448 views
Most widespread use of PGP after 20 years
Phil Zimmerman released PGP (Pretty Good Privacy) on June 5, 1991. As we examine the legacy of that far-sighted and brave act 20 years later, what are the most widespread and helpful uses of PGP ...
8
votes
2answers
1k views
What are the risks of storing passwords in a GPG encrypted file?
I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like
gpg -d passwords.gpg | grep ...
8
votes
2answers
1k views
GPG File size with multiple recipients?
If I encrypt a file for multiple users how does the file size change?
Does the size of the output double for two users. How about 10 or 100 users?
8
votes
1answer
206 views
PGP: How is it possible for me to read a sent mail, encrypted by me with the recipient's public key?
I'm quite new to OpenPGP and am just starting to use it with Thunderbird.
When I encrypt a mail with a recipient's public key, using Thunderbird + Enigmail + OpenPGP, and send it, I can find the ...
7
votes
3answers
738 views
Is it possible to verify a PGP-signed and encrypted message without decrypting it?
Let's assume I have a PGP message and I want to know who sent it, is it possible to do it if I have the RSA encrypted message, two possible senders (and their public keys that they signed and ...
7
votes
2answers
336 views
What information is leaked from an OpenPGP encrypted file?
If an attacker obtains a file that has been encrypted using an OpenPGP public key, what information can the attacker deduce?
For example, to what degree of certainty can the attacker deduce the ...
7
votes
1answer
137 views
Can all the (other) recepients of a PGP encrypted message be identified?
Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?
...
7
votes
2answers
811 views
How do I encrypt the source and destination IP address, along with various parts of an email?
If the subject makes no sense to you, that's fine, it makes no sense to me.
I've been tasked with securing emails sent from some devices, and I'm looking for advice on intelligent questions to ask to ...
7
votes
3answers
478 views
How can I encrypt a file using `gpg` without including the recipient's key ID?
An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question.
Is there any way to remove that information from the resulting ...
7
votes
4answers
432 views
Alternative to “web of trust”
Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
1answer
154 views
GPG-encrypted mailing list and other approaches to safe communication
What is the best way to communicate privately on a mailing-list?
Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
6
votes
3answers
1k views
How can I convert my encypted PGP secret key for use performing SSH authentication?
I wish to covert my PGP key (RSA) to be used performing SSH authentication. After some searching, I found openpgp2ssh, which appears to be an appropriate tool. Everything works swimmingly for my ...
6
votes
2answers
389 views
What risks are inherent with connecting to an untrusted public key server?
Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here:
Shouldn't GPG key fetching use a secure connection?
...you should not trust the key ...
6
votes
3answers
677 views
Is the OpenPGP private key inherently password-protected?
I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key?
Essentially, ...
6
votes
2answers
280 views
Does using both GPG encrypted files and encrypted filesystem make sense?
For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
6
votes
1answer
72 views
What is the best way to manage package signing keys?
I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.
I have initially created a signing ...
6
votes
0answers
253 views
Migrating GPG master keys as subkeys to new master key
Currently I have 3 private GPG pairs which are all master keys.
I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread ...
5
votes
4answers
185 views
Securely publishing GPG keys
This is probably a stupid question/vaguely defined, but I need to ask it anyway.
I want to put a public key for mail exchange on my website, such that even very powerful adversary with power to ...
5
votes
2answers
175 views
Why are my gpg public key on my machine and on the key server different?
When I generated my PGP key using GnuPG, I had saved the public key as an ASCII version and uploaded that to the server. Now I can see the key on the keyserver but they are different blocks of data.
...
5
votes
1answer
289 views
OpenPGP Encryption / Decryption Process Using GnuPG
I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
5
votes
1answer
615 views
Ways to sign gpg public key so it is trusted?
I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
5
votes
2answers
331 views
Enforce Code/Script Signing
I have both a couple of X.509 Code Signing certificates and a GPG keypair that I can use to sign against code I run on my VPS. Every now and again I write code for iOS, OS X and Windows and always ...
5
votes
1answer
153 views
Could a consumer-friendly PGP-like file encryption application theoretically be secure?
In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
5
votes
1answer
670 views
Does GPG key expiration add to security?
I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or ...
5
votes
3answers
103 views
Should I make sure to get all of my OpenPGP uids are signed?
Should I make sure that I get all of the uids associated to my OpenPGP key signed, or is it enough to have one of them signed?
If Bob can guarantee that alice@example.com belongs to Alice, I can't ...
4
votes
2answers
98 views
Is DKIM needed for emails encrypted with OpenPGP?
DKIM seems to prove that a message came from where it claims to be from. However, OpenPGP encrypts the entire email and signs it which obviously proves it also came from the person it says it did.
...
4
votes
3answers
175 views
Virus with PGP Encryption Preventing Virus Scan
A user reported having a virus that was causing pop up windows asking for money. When he turned on his laptop and logged into PGP encryption (whole disk) the desktop quickly showed but then a white ...
4
votes
2answers
156 views
Recipient non-repudiation in secure e-mail transport
PGP works well to provide many key aspects of information security; message confidentiality and integrity, sender and recipient authenticity, and sender non-repudiation (the sender, who has digitally ...
4
votes
3answers
1k views
How can PGP and openPGP be compatible?
PGP and openPGP use different encryption algorithms. As I understand, PGP uses IDEA to encrypt a message, then RSA to encrypt the IDEA key. If openPGP doesn't use IDEA, how can it read PGP-encrypted ...
4
votes
2answers
99 views
Anything to do about old gpg keys?
Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, ...
4
votes
1answer
193 views
Potential issues with Kim Dotcom's new proposed “encrypted webmail service”
Just spotted a Reddit thread about Kim Dotcom, of MegaUpload fame, planning to produce a secure webmail system that allows people to communicate securely, without the worry of having their messages ...
4
votes
1answer
121 views
Is OpenPGP encryption a valid replacement for SSL when passing messages?
I am writing an application that occasionally needs to transmit larger messages to other servers on the internet without allowing people to snoop on the traffic. The normal way to handle this is to ...
4
votes
1answer
59 views
GPG warns about unprotected subkeys while using monkeysphere
Issuing monkeysphere subkey-to-shh-agent GPG warns me:
gpg: about to export an unprotected subkey
then it asks for the passphrase and everything works fine.
What's the meaning of "export an ...
4
votes
2answers
164 views
How to refuse delivering emails that are not signed by trusted PGP keys?
I'm fed up by spam and would like to have an email address that will only deliver mails signed by users I declared trusted. Some kind of purgatory for mails the signatures of which are trustworthy by ...
4
votes
1answer
105 views
Complex Consumer Matching Queries with PGP Universal
For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. ...
3
votes
3answers
121 views
When changing a PGP passphrase, does it only affect the private key?
I am beginning to use GPG for email encryption. If I use
gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
