New answers tagged

0

Generally, all OpenPGP primary keys have the certification capability C. You cannot have one without it, it is required to certify (sign) other's key, perform key management operation like creating and revoking subkeys and user IDs. Revoking the primary key means you have to exchange keys again with your communication partners, lose all the reputation in ...


2

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key. In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or ...


2

Problem Analysis You can verify what's contained in the export by piping into gpg --list-packets; I additionally grepped for the packet identifiers (starting with colons): gpg --export-secret-keys a4ff2279 | gpg --list-packets | grep '^:' Which from what the manual page says should list an atttribute packet like the following, but doesn't: :attribute ...


0

The photo is on the public part of the key, so you need to export that, too: gpg --export -test- > exported.public.gpg Then import both keys again: gpg --import exported.secret.gpg exported.public.gpg And the photo is there.


2

You've asked several questions here, so I'm going to provide several answers, and a couple of clarifications. I will be storing the AES key (DEK) in a HSM-based key management service (ie. Azure Key Vault / AWS KMS) and will retrieve the key to encrypt/decrypt data on my Nodejs server. This is not generally what you want to do. If you're using an ...


-2

Consider some ssh key management software that can store and dynamically manage (change) ssh keys, this is directly analogous to a password management system. However these solutions come at a cost !


1

one way might be using a smartcard or similar for the authentication, nobody can read a password or similar from a smartcard and when you pull it, nobody is going to access your HSM, at least in theory.


0

when the key is on an HSM technically you shouldnt be able to get it out that quickly in the first place. if possible, require the HSM to require a special authentication to explicitly throw the keys. an HSM is not only for safe storage of the keys, but usually they also can perform crypto operations like signing, de/encryption etc. so depending whether ...


0

However, now I am trying to use "Type in the encryption key when you start up" and to save it in a session cookie (encrypted) but I do not know how to tell the user if his key is correct or not. Is there any reason why you are storing this client-side? The cookie will be sent with every request, and encryption here seems wrong because you will need ...


2

tl;dr: both dumps contain the same keys, but you get some additional certifications from the key server not included in the minimal export of the VeraCrypt website. OpenPGP Packets OpenPGP keys are composed by a set of OpenPGP packets, which can be listed by gpg --list-packets and pgpdump. For exported keys, there's one required packet, the public key ...


2

A PGP keyfile is not a single key string, but contains several entries (packets). Instead of trying to compare the ASCII representation of both files, you should use appropriate tools such as gpg(1) and compare the fingerprints. Is there some way to make this easy? Yes, like this: $ wget https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc $ ...


1

Apparently the sessionStorage is not really cleared when closing the tab. It is easily revived by clicking on "Reopen closed tab" I've written more about it in here: http://blog.guya.net/2015/08/25/the-never-ending-browser-sessions/


0

The idea behind an offline OpenPGP primary (master) key is that an attacker getting access to your computer will not be able to perform key management operations (creating/revoking new user IDs and subkeys, revoking your key, certifying other's keys). Furthermore, the primary key is the target of certifications between keys -- if you lose it (have to revoke ...


0

Your second idea is the right one. You generally should back up all your important data, and your GnuPG keys definitely are important. The idea is not about keeping just the master key, but about making sure an attacker is unable to get the master key while you are still able to do your daily business with GnuPG on that machine. As soon as the master key ...


2

You have to distinguish between different kinds of attacks which are in scope of the hash sum algorithm chosen. The post you referenced on one hand discusses collision attacks (against the whole SHA-1 based fingerprint). However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...


1

Add a second key, split it into multiple parts, and give the parts to different relatives (preferably with some level of redundancy, in case one of them loses their copy). Say 3-5 parts spread out over 6-15 relatives. Houses burn down, rats eat papers, things get lost. Check with them once a year to make sure they still have their copy. Clearly note on the ...


6

Keeping the keys with your parents as plan to do seems safe enough. It is indeed unlikely that someone would break into their house, then yours, just to get your data. The most likely disaster scenario is that a burglar breaks into their house, finds your house keys, and visits your house next just because they now have the house keys - AND find the printed ...


6

OpenPGP User IDs User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses. Be aware user IDs are not checked by key servers, make sure to verify them on your own! OpenPGP Key IDs OpenPGP key IDs (and fingerprints) are used to ...


2

What is key id exactly? The part that looks like CB3AF6E6. GPG also accepts using email address to refer to a key.



Top 50 recent answers are included