Tag Info

New answers tagged

0

Pretty Easy Privacy (pEp) project It is not a successor, it uses the same protocol, and is a frontend for GnuPG, but this was what I was looking for: pEp is a user interface project that aims to make standards like PGP more accessible to ordinary people by removing the need for understanding key management. Hence pEp’s nature as a user interface ...


1

In the asymmetric encryption scheme you can achieve two things: message confidentiality : this is done by using someone's public key to encrypt a message. Only the owner of the private key can decrypt the message message authentication : this is done by using your own private key to sign a message. Anyone with the public key can verify the signature of the ...


4

They don't need your public key at all to decrypt. You need their public key to encrypt the message, which they decrypt with their private key. The only thing they need your public key for is to verify that the message comes from you. In that sense it doesn't make sense to attach your public key, unless, for instance, you plan to confirm fingerprints over ...


1

The public key can be used to send an email securely to the holder of the corresponding private key, however the holder of the public key cannot ascertain that the message actually comes from you. Attaching your public key in the email though can problematic because he cannot verify that the public key attached actually belongs to you. If all he cares about ...


6

First of all, although you used pgp, I assume you will actually be using GnuPG. Otherwise, fetch it - it's free software. Although PGP will probably also have similar functionality. Hidden Recipients It depends. If the sender included the recipient's key fingerprints, you can retrieve them; otherwise (if encrypted using the --hidden-recipient option) ...


2

The standard protocol for using asymmetric cryptography is the following: Alice generates a public/private key pair Alice publishes her public key + additional steps if you need if you need proper authentication of the key Bob retrieves Alice's key (and authenticate it when possible) Bob crypts the message using Alice's public key Bob sends the encrypted ...


6

There is a unique association between public and private key. That is, if the sender uses a certain private key to sign a message and you verify the signature using the corresponding public, then the signature verification will succeed only if the message has not been altered.¹ The verification procedure and nature of the association between public and ...


1

Signing data is to prove to someone else that it originated from you. By signing with your private key (that only you have) you ensure that anyone with your public key can verify the message. You don't use their public key, but they have yours. The signature itself is a cryptographic hash of the entire message that is signed with your private key. Any ...


3

Key server synchronize using different protocols, forming a network of more than hundred servers all around the world involved. E-Mail Synchronization The "old" way of key server synchronization is based on the key servers sending e-mails to each other. Whenever a key server receives new information he doesn't know yet (either uploaded by a user or ...


1

Yes, you should verify it. If an attacker can replace the installer file on the server with a malicious version, https (TLS) will not protect you because you're downloading from the correct site, but you're getting a malicious file. If the publisher has kept their private key truly private, even though the attacker has compromised the server, the attacker ...


1

The reason this doesn't work is that PGP doesn't encrypt a message with your key. Rather, it encrypts it with the recipient's key. It uses RSA, which is an asymmetric algorithm (actually, it encrypts the message with a symmetric cipher and a random key and encrypts the symmetric key with the recipient's public key, but it then throws away its copy of the ...


2

I notice that "encrypt to self" is not included until 0.4 of gpg4usb: New alpha release 0.4 added encrypt to self functionality, so that every message additionally is encrypted for the choosen key Encrypt to self is not usually the default with command line PGP/GPG clients - it's common for command line PGP/GPG systems to not include the ...


4

RFC4880, 5.2.3.12. Revocable considers non-revocable keys a "commitment" to a signature that cannot be revoked. I cannot think of a bunch of use cases apart from yours of non-revocable signatures to other keys you're owning yourself. I could imagine use of this flag for special signatures, like in a situation where an employee designates a revocation key ...


4

Key pairs are generated in a number of ways, but I am going to refer to the specific example of OpenSSL, which is a very popular and easy way of creating RSA keys for many uses. The command for creating a key used to be[1] openssl genrsa -cipher_name -out file_name_in_pem_format key_length Where cipher_name can be a number of symmetric encryption methods ...


1

Rather than going through the whole #bitcoin-otc login procedure on behalf of your users (which, in the case of an existing session, may either be denied or attempt to replace the current session), you could have a bot present in #bitcoin-otc and then either require the ident-verified users to message it with a randomly generated token, or have them request ...


0

in GPG, for security, one would stay away from brainpool, and nist curves. edDSA, montgomery and edwards curves are fine. ed25519 is luckily being deployed without subrterfuge for now. Although it is just for signing/certifying/authentication. Encryption will follow. the mailing lists on ietf.org are brilliant places to start, and checking cryp.to as ...



Top 50 recent answers are included