Tag Info

New answers tagged

3

You already seem to have realized that there is no way to attach user IDs to subkeys. You cannot impose ultimate trust on others The problem with your concept is that while you can issue ultimate trust on your own devices, you cannot impose this for other users. If they're able to validate your "master" primary key through the web of trust, the other keys ...


0

You could literally chain the encryption by double-encrypting the file: cat FILE |gpg -er alice@example.com |gpg -er bob@example.com > FILE.alice+bob.gpg.gpg This would require Bob to decrypt FILE.alice+bob.gpg.gpg into FILE.alice+bob.gpg, which then requires Alice to decrypt. Alice won't be able to do anything with the double-encrypted file and Bob ...


0

OpenPGP actually defines (or at least indicates) a way to do so, RFC 4880, 5.2.3.21. Key Flags knows the option flag 0x10: 0x10 - The private component of this key may have been split by a secret-sharing mechanism. To do so, you'd have to split up the key on your own and put things together again. An easy way might be to separate "physical" ...


3

Out of the box with GnuPG/PGP, there is no way to encrypt a file with the method you suggest. There is a "group" encryption or ability to encrypt to multiple recipients, but that allows each recipient to individually decrypt the message rather than rely on anyone else's key. What you can do, and is commonly done, is to split the PGP private key and require ...


3

Revoking the primary key is sufficient. OpenPGP clients will refuse to use subkeys of revoked primary keys. Revoking primary and subkeys is different: primary key revocations are special self-certifications (self-signatures) containing revocation information, while subkey revocations are issued by the primary key they belong to. Using GnuPG, it is not ...


0

You normally would revoke the key: Revocation is described in the link to another question on ask Ubuntu. Basically: The "OpenPGP way" to remove old keys is to mark them as revoked by uploading special revocation certificates. These will tell other OpenPGP users that your key is superseded. Revoking keys is not possible if you don't have ...


2

If the protected system is not that critical, yeah sure. Go ahead. But do take note that whatever that key is guarding, it's effectively being replaced by your passphrase. Think of a vault being replaced by a cash box. You should take responsibility in the event that the passphrase somehow leaks (as a result of being drunk, torture, etc.)


8

Compare putting the encrypted private key onto some untrusted storage with putting the unencrypted one into an encrypted container like TrueCrypt or LUKS. Technically, the result is pretty much the same, apart from OpenPGP meta data being visible for the encrypted private key. Your key is as secure as the symmetric encryption algorithm applied for ...


2

It depends, but probably not. Even if the passphrase is sufficient, you can use weak or insecure algorithm to encrypt the private key. Then, we also need to assume that the key have some validity period. The validity period must not be longer, than it would take to crack the algoritm. We also need to assume that Dropbox can make a copy of it, so the ...



Top 50 recent answers are included