Tag Info

New answers tagged

1

PGP (and also GnuPG) uses the concept of a web of trust to allow you to validate the ownership of other's keys, also if you didn't meet them in person. PGP's Trust Model A long explanation is in PGP's manual, starting from checking trust. The short version: In PGP, a key is valid, if it is not revoked or expired it is your own key (which is also ...


0

You can certainly use one of the publicly available keyservers; I would recommend the pool of SKS keyservers, since this will help distribute our load. A QR code can encode the link to your key, and it's easy to use an online generator. Alternatively, keep your eye on a service such as keybase.io. A number of folks have invites now...


1

Think of a padlock, and the keys that open it. You don't need a key to close a padlock, just to open it. Your PGP Public Key is similar to the padlock. You give out padlocks (without keys) to other people, and they use it to lock something inside a small box. (And we know that padlocks are not that safe, are easy to break, but let's assume they are very ...


1

Your trading partner has both a public key and private key. Under normal circumstances, the public key is used by you to encrypt files that your trading partner decrypts with their private key. A public key is made widely available so that anyone can send encrypted content to that person. The keys are an asymmetrical pair in that you can not decrypt the ...


2

OpenPGP uses a hybrid encryption approach. Public-key encryption (commonly, RSA is used, but there are also other algorithms) has the advantage of a different public and private key set, but is getting really slow over time. The public key is the one used for encrypting to the recipient, who can decrypt using his private key. This public key is usually ...


1

You can put a link to your PGP and other information by simply linking to your website itself. What I do is actually have a link on my card that says: mysite.com/cv the cv page is a nice (enough) page that has my CV (resume) both online and pdf as well as a few other things. You can always update your CV & contact info there and there is the added bonus ...


17

Considering that your public key is only usable by a computer1; you can remove clutter from your business card by having all electronic data accessible online and referred to by a QR code. The link could refer to a vCard file stored on, say, a public Dropbox. As the vCard format can store any business or contact information including OpenPGP keys. ...


3

Put your whole key as qr-code on it, see near the end of this discussion, search for "monkeysign": http://www.gossamer-threads.com/lists/gnupg/users/64465


7

I've put the whole fingerprint on my cards, but highlighted the short ID (being the last eight characters of the fingerprint). It's at the other's side to verify correctly. Regarding putting a link on a business card; consider the possible use cases. The normal way of fetching a key is through the key server network; and for doing so no URL is needed: ...


3

Two ways I can think of Submit your key to a public key server like pgp.mit.edu/. On your business bard you can provide the link with the unique id that you are given. I don't know exactly you should word it, but it is just an idea. You could put your key on a webpage and provide the link to that webpage. This might, of course, mean that you would need ...


1

The options 2 to 5 (never, marginally, fully and ultimately trusted) correspond to a definite decision made by you on the trust level which influences validity calculation. Unknown says, you haven't made any decision at all and thus is special, indicating no value at all (you might consider it some kind of NULL value). Option 1, undefined is similar and ...


1

Ultimate trust means that the key is allowed as introducer in the web of trust. This means, if a key is ultimately trusted, all certified keys are considered valid, no matter if there is a trust path to the ultimately trusted key. This does not require you to posses the private keys, but you usually will do. Full trust (by default, this can be adjusted) ...


0

Ultimate means you have the private key. In terms of calculating the web of trust relationships, full and ultimate have the same weight.


4

Yes, it is broken, if you're confusing the different kinds of trust (nice article, sadly the page is offline, but archive.org has it), using it wrong (eg., just fetching any keys as described in your question) or want to make others use it without educating them. The basic idea is totally fine, but you have to be somewhat picky whom to trust (a.k.a. the ...


1

SHA-1 is only one of the many hashing algorithms available in the OpenPGP standard. You can (and should) choose better algorithms for signing documents or keys. However, SHA-1 is the only algorithm used for generating an OpenPGP V4 fingerprint. Is this an issue? I think not for the immediate future. There are two kinds of attacks on a hashing algorithm. ...


0

Yes Although you have taken good precautions against loss or theft of your laptop, you remain vulnerable to electronic attacks. In particular browser-based malware could take control of your computer and steal your PGP key. The point of using subkeys is that you keep the master key somewhere really safe - which is not your everyday laptop. There have been ...


0

You should be able to add the additional subkeys to your master key pair, while still leaving the master keys intact. It doesn't matter if the "master keys" have been used for a while, you don't have to generate new master keys to add subkeys to it. You linked to the article I usually recommend which describes this process, of using gpg --edit-key ...


0

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions. You can use various ciphers to encrypt your ...


0

I would create a separate pair. The 1st key should be kept offline, or there isn't much use in having subs....though you must go to the offline machine to sign any keys you get from someone else, then bring them back to the online system. I haven't messed with a personal HSM (Yubikey), but that may be able to ease the pain.


2

'gpg --version' will show your prefs. Add similar to gpg.conf (your prefs, of course): personal-cipher-preferences AES256 TWOFISH AES192 AES personal-digest-preferences SHA512 SHA384 SHA256 personal-compress-preferences ZLIB BZIP2 ZIP As for your key, I don't have that answer. But, as your daily key should be a SUB, revoke the SUB and re-issue a new ...


1

Cryptographically, the scheme you describe is not increasing your risk. From an overall security standpoint, adding the additional recipients creates more points where things can go wrong. Each of the recipients represents an additional endpoint where the message must be secured. You may trust each of the people, but can you equally trust all of their ...


0

This in general depends on the exact way the assymetric encryption is peformed (i.e. a completely naive implementation of RSA could be a problem, See Halstads attack), for GPG/OpenPGP there should be negligible extra security risk when encrypting the same string using multiple different public keys. Modern cryptographic protocols and algorithms are usually ...



Top 50 recent answers are included