Tag Info

New answers tagged

0

Why has this happened? Shouldn't the old key just get replaced with the updated one? In OpenPGP (at lest for version 4 keys), the expiry date in not stored in the key packet itself, but in binding signatures (self signatures) on the keys. Changes to the expiry date (and other attributes) are performed by distributing a never version of the binding ...


1

Consider a single primary key to be equivalent to one identity. You cannot connect subkeys to user IDs. Both subkeys and user IDs are attached to the primary key, the only connection from user IDs to subkeys is through the primary key. If you want to select different subkeys for different machines (for example at home and at work), this is easily possible ...


0

I am not sure the idea to use axolotl for email is sound or not, but it is worth a try. My team Tradle chose to create an alternative to email like @geargewalker had suggested. Still, here are some pointers for you: First problem that @georgewalker has mentioned is solvable. PGP have always had public key servers, but they were too clunky to use. One part ...


4

It's not possible to change the creation date of a PGP key, because the creation date is part of the Public and Private Key Packet. The OpenPGP Standard (RFC4880) says 5.5.2. Public-Key Packet Formats (snip) A version 4 packet contains: - ... - A four-octet number denoting the time that the key was created. - ... 5.5.3. Secret-Key Packet ...


7

You cannot reconstruct an OpenPGP key based on it's fingerprint. The fingerprint is a hash value of the public key, so calculating the fingerprint of a key is a one-way operation. But: if somebody only distributes his key's fingerprint, he will almost certainly have distributed his public key on the key server network, from where you can pull it. Given you ...


1

It indicates whether the key is DSA or RSA. You can read more about the differences between the two here. You can determine which type your key is using gpg --list-keys at the CLI. I'm not sure what GUI you'd use on a Mac so I can't speak to that. C:\>gpg --list-keys -------------------------------- pub 4096R/2C55AF0B 2014-10-28 [expires: ...


1

This mechanism only works if people know which key I have signed. Can I assume that such signing information is stored on key servers? Yes, certifications are stored on key servers. Does this mean that I have to resend my key to a key server after having signed someone's key? You have to upload a key, but not yours, instead upload the certified ...


0

First of all, please take @Joseph Kern's answer seriously! Think how hard it is to play an audio tape or access the data on a floppy disk nowadays—both storage formats were prevalent and widespread in the 1990's, only two decades ago. You mentioned USB sticks: the standard USB-plug will be gone within a decade, replaced by the new USB-C plug and that will ...


3

Backups and Archives Oh My! Based on my unscientific Googling First issues first, let's turn this into a scientific exercise (library science!), the decisions you make today will affect people that you haven't (or might never) meet. You've mentioned two of your three options for key management; analogue and digital. Have you considered your third ...


3

I'm also interested in the practicalities of paper backup, in particular tools that allow adding error-detection and error-correction capabilities similar to what RAR does for archives (i.e. dial-your-desired-security), and perhaps encodings that are more efficient and/or robust in the face of OCR than, say, base64. Have you considered combining paper ...


3

@curious_cat has a great answer. I'm going to add a few other areas, though. First, what's your budget for this? You need the budget in three areas: Capital and operational expenditure for inital start-up buying HD-Rosetta capable addressable microscopes, equipment to etch stone or clay tablets, OCR scanners that can handle stone or clay tablets, etc. ...


14

What about something like Verbatim's Archival Grade Gold DVD-R>? It gives 4 GB storage. They claim a life of "up to 100 years" but I find no independent verification. Frankly I'm skeptical. But maybe you can boost your chances by just burning the same data on to multiple disks and hope any failures are uncorrelated? I'd buy disks from different lots or ...


1

configure your mail server so that when an outgoing e-mail is sent, I enforce STARTTLS ... verify the certificate I would pin in the next session. If the certificate does not match, the e-mail doesn't get sent. There are several problems: The mail is delivered in multiple hops, e.g. from your mail client to your mail server from their to the mail ...


1

What attacks do you want to prevent? If a malicious system administrator (or anybody/any agency forcing him to be one) is contained in the list, you're out of luck without end-to-end encryption, no matter what fancy validation schemes you apply. Regarding your approach: as I understand, it is absed on the idea that nobody will be able to control different ...


0

Merging the user ID packets would be indeed possible -- but you'd have to create a new self-signatures afterwards for the user ID. You could use gpg-slit to cut apart the individual OpenPGP packets, and reconcatenate them using cat while putting the user ID packet at the right place (be aware: this requires deeper understanding of RFC 4880, OpenPGP). But ...


0

The trust systems of OpenPGP (web of trust) and X.509 (hierarchical) are not compatible, nor are the signatures (the "math behind" both of them in respect to the keys indeed would be, as long as the algorithms are defined for both, for example with RSA). While you could easily map the hierarchical X.509 trust system to the more powerful (and complex) ...


0

Your statements are broadly correct, at least for public-key encrypted email. Of course, this is not the only way of doing things. One of the key limitations of this kind of encryption is the distribution and management of keys. This is indeed one of key factors limiting the takeup of email encryption. Even corporate takeup of email encryption is minimal ...


0

Since the second statement assumes the first one is true, it cannot be evaluated independently, therefore it is enough to prove the first one to be false. And in my opinion, the first one is not entirely correct. There are other ways of sending an encrypted e-mail. It is just a matter of abstraction what really says where the correctness is. It is possible ...


0

The Version header is purely informative; my guess is that it's included to make compatibility bugs easier to discover (e.g. if a client is unable to decrypt 10 messages, and all 10 were made by the same version). Source: http://superuser.com/a/823907


3

As far as I do understand, you want to convert an authentication subkey to an SSH key, and authenticate using this. If I generate a PGP subkey that only has the authentication capablity and use this to generate an SSH keypair to authenticate Git for example, does this pose a security threat? Whether this is reasonable or not depends on what you're ...


5

The problem is probably not so much algorithmic security. The problem is that if there is a security problem with one of the applications that you also have a security problem the other application. Furthermore, it may be that some kind of attacks on the protocol may be made possible because you share keys. In other words, this is not a good idea with ...


3

Keeping Certifications Private or Public The whole OpenPGP web of trust idea is build around certifications (signatures of other keys) being publicly available, so other users can build trust paths on these. Keeping certifications private is surely legit, but will not help others (also contacting you). If you only share your key among your friends, they ...


2

Web of trust? Instead of using a centralized, public key server, you and your friends could be exchanging key files directly. In which case the added signatures would be doing something. However, if you are going to sign it, and then leave the file on your hard drive then you are correct that it doesn't do much good to others (though I think the GNOME ...



Top 50 recent answers are included