New answers tagged

0

Generally, all OpenPGP primary keys have the certification capability C. You cannot have one without it, it is required to certify (sign) other's key, perform key management operation like creating and revoking subkeys and user IDs. Revoking the primary key means you have to exchange keys again with your communication partners, lose all the reputation in ...


2

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key. In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or ...


2

PGP Uses both asymmetric and symmetric encryption. Data is encrypted with a random key using symmetric encryption using on of these algorithms: As per RFC 4880: IDEA TripleDES CAST5 (128 bit key, as per [RFC2144]) Blowfish (128 bit key, 16 rounds) AES with 128-bit key AES with 192-bit key AES with 256-bit key Twofish with 256-bit key And in RFC ...


1

Problem Analysis You can verify what's contained in the export by piping into gpg --list-packets; I additionally grepped for the packet identifiers (starting with colons): gpg --export-secret-keys a4ff2279 | gpg --list-packets | grep '^:' Which from what the manual page says should list an atttribute packet like the following, but doesn't: :attribute ...


0

The photo is on the public part of the key, so you need to export that, too: gpg --export -test- > exported.public.gpg Then import both keys again: gpg --import exported.secret.gpg exported.public.gpg And the photo is there.


2

OpenPGP also hashes the package content's, but additionally cryptographically signs the hash. A simply hash sum only allows to detect transmission problems. It does not allow to detect attacks, at least not as long as the hash is not verified through some secure channel. Given the signer's key was validated and is trusted, OpenPGP provides such a secure ...


1

The hashing function is used only to check package integrity for transmission errors (which is done by verifying its checksum). It cannot provide any way to authenticate the maker of the package. PGP can be used to verify the signature of the package (or of any other piece of data) over the maker's public key, hence certifying its provenience.


1

For some algorithms, subkeys are a technical necessity: for example DSA (the digital signing algorithm) can only be used for signing, and requires an additional encryption subkey (for example Elgamal). This is not true for RSA, which can be used for both signature and encryption. Distinguishing between a primary key and subkeys has another reason: It allows ...


2

OpenPGP Signatures The program outputs a small picture.sig file to the destination folder. What does this file contain? [...] But the .sig file should also contain entire certificate, or maybe a fingerprint of it. What does it contain? How does Kleopatra automatically choose the right certificate? OpenPGP signatures can contain the original ...


2

Is it possible in PGP to change the settings to allow an encryption key outside of base-16? This is not defined by OpenPGP (although I indeed couldn't find any source defining a hexadecimal representation). I discussed a similar example in How is this OpenPGP key displaying in a non hexedecimal format?, where some characters have been garbled probably ...


1

tl;dr: these are made up key IDs of somebody trying to hide the actual information. They're not valid OpenPGP key IDs. OpenPGP Key IDs Following RFC 4880, OpenPGP, 3.3 Key IDs, a Key ID is an eight-octet scalar that identifies a key. 12.2 Key IDs and Fingerprints further specifies the calculation, but again no representation of those lower 64 bits to ...


2

Is it possible in PGP to change the settings to allow an encryption key outside of base-16? Are there settings that will allow a key of any thing you like? No. That piece of output is shown in base 16 (hexadecimal) just because it's a good way to show binary data (in this case a hashsum). In this case it's as if they had codified a message in morse ...


2

tl;dr: both dumps contain the same keys, but you get some additional certifications from the key server not included in the minimal export of the VeraCrypt website. OpenPGP Packets OpenPGP keys are composed by a set of OpenPGP packets, which can be listed by gpg --list-packets and pgpdump. For exported keys, there's one required packet, the public key ...


2

A PGP keyfile is not a single key string, but contains several entries (packets). Instead of trying to compare the ASCII representation of both files, you should use appropriate tools such as gpg(1) and compare the fingerprints. Is there some way to make this easy? Yes, like this: $ wget https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc $ ...


4

How can I use letsencrypt to get a signed public key for use with OpenPGP? This is not possible for several reasons. letsencrypt does not Verify Idenitity So I can prove in court the key is mine [...] letsencrypt only verifies domain ownership, with other words whether you have control over the domain. They do not verify any personal information. ...


0

I have been in a similar situation. The only option that I found universally acceptable for end users of all skill levels was to send files in an encrypted .zip file as attachments. On Linux these files are easy to create with the -e flag for zip: $ touch foo.txt $ zip -e foo.zip foo.txt Enter password: Verify password: adding: foo.txt (stored 0%) $ ...


0

The idea behind an offline OpenPGP primary (master) key is that an attacker getting access to your computer will not be able to perform key management operations (creating/revoking new user IDs and subkeys, revoking your key, certifying other's keys). Furthermore, the primary key is the target of certifications between keys -- if you lose it (have to revoke ...


0

Your second idea is the right one. You generally should back up all your important data, and your GnuPG keys definitely are important. The idea is not about keeping just the master key, but about making sure an attacker is unable to get the master key while you are still able to do your daily business with GnuPG on that machine. As soon as the master key ...


0

GnuPG does not allow to restrict the key set without specifying another key file. Use --no-default-keyring to disable the default keyring containing all the keys, and then specify a keyring (which can be a single exported key!) with --keyring public-key.asc. If necessary, export the key immediately before verifying the signature: gpg --export [user ID|key ...


-1

I see that you are doing this from Java. You might want to take a look at the Bouncy Castle library which allows you to work with OpenPGP data in Java, instead of having to call gpg. Look at this question to get started: http://stackoverflow.com/questions/19173181/bouncycastle-pgp-decrypt-and-verify


0

You could write a shell script to do that easily of course: Using DOS CMD file called vsig.cmd: @echo off gpg --verify %1 > %temp%\result.txt 2>&1 grep "%2" %temp%\result.txt if errorlevel 1 ( echo File was NOT signed by %2 exit /b 1 ) else ( echo File was signed by %2! exit /b 0 ) This will provide the following output: >vsig ...


0

You could, perhaps, use a keyring with only that specific key in it, and specify the keyring on the command line (using --no-default-keyring --keyring <file> ) Note that unless you have signed the key used to create the signature, the user name in GnuPG's output is not a good thing to check. Anybody can generate a valid key with a certain user name. ...


2

You have to distinguish between different kinds of attacks which are in scope of the hash sum algorithm chosen. The post you referenced on one hand discusses collision attacks (against the whole SHA-1 based fingerprint). However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...


6

OpenPGP User IDs User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses. Be aware user IDs are not checked by key servers, make sure to verify them on your own! OpenPGP Key IDs OpenPGP key IDs (and fingerprints) are used to ...


2

What is key id exactly? The part that looks like CB3AF6E6. GPG also accepts using email address to refer to a key.


4

OpenPGP smart cards do not store the public key. You can only use them together with a local copy of the key. As a consequence, you cannot use the various OpenPGP smart cards, including YubiKeys and Nitrokeys without leaving traces on the host machine. You can use a GnuPG key ring on a thumb drive by moving the whole GnuPG home directory there, and either ...



Top 50 recent answers are included