New answers tagged

1

Let me answer this based on how PGP/GPG works. So you have a file for say Client X, and you are using FTP as a delivery mechanism. You want to ensure that your data is protected (encrypted) and only Client X can read it. To do so, you would be using your PGP key for signing, and they will use their key for decrypting. You (PGP key which can be looked up on ...


1

It is possible, if your server accepts files uploaded by an anonymous user and if you don't provide a hash (e.g. SHA-256, SHA-512,...) in order to check that cred.gpg actually contains passwords.pdf and not evilfile.pdf.


1

Risks of Exposing Encrypted Information With it being encrypted I assume having it publicly accessed wouldn't affect security as the encryption setup would make it pointless for anyone to try and decrypt it. Your encrypted information will stay private as long as the crypto works (no flaws in the underlying mathematical principles are found), the ...


0

I'd recommend creating a URI with OPENPGP4FPR as scheme your OpenPGP fingerprint in all caps as data. Then use something like qrencode to create a QR code of the resulting String. Apps like OpenKeychain on Android will understand this. You can show you fingerprint with: gpg --fingerprint <email|keyid> For example: $ gpg --fingerprint ...


2

Both versions of GnuPG are compatible in the output they produce: they both implement RFC 4880, OpenPGP. They're even compatible in the keyring and trust database formats they're using. GnuPG 2.1 supports some additional ciphers and has changes to the keyrings which might prevent using both older versions of GnuPG and GnuPG 2.1 (or in future: newer) at the ...


5

When you authenticate to Github with your SSH key, that authentication doesn't become part of the repository in any meaningful or lasting way. It causes Github to give you access for the moment, but it doesn't prove anything to anyone who is not Github. When you GPG-sign a git tag, that tag is part of the repository, and can be pushed to other copies of ...


1

The key server network does not consists of a single server, but a whole bunch of servers that synchronize through "gossipping". keys.gnupg.net actually points to pool.sks-keyservers.net, which again randomly serves IP addresses of key servers operated by individuals. This will take a while, expect some time between few minutes and multiple hours. If the ...


1

Notations provide meanings to add information to a signature or certification (which also is a special kind of signature). From RFC 4880, 5.2.3.16. Notation Data: This subpacket describes a "notation" on the signature that the issuer wishes to make. The notation has a name and a value, each of which are strings of octets. There may be more ...


-2

Displaying version data is a security vulnerability and should be disabled by default. This is a huge bug in PGP right now and it needs to be addressed by the core maintainers ASAP.


1

The file you're trying to import does not contain the actual private key, as indicated by this line in the output of gpg --list-packets: gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2 The special "dummy" S2K algorithm is applied when GnuPG actually exported a secret key stub to still enable using secret subkeys, but having an offline primary key (on ...


0

You seem to be asking for a fundamental understanding of how GPG generates keys, and what the role the password plays in this process. I will give some background, and then answer your direct questions at the end. The short answer is: each time you need to access your RSA private key, your password is used as a "seed" to re-generate the AES-256 key that you ...


2

The password is not part of the key, but used to encrypt the private key. Technically, the password is input to a key stretching algorithm whose output is used to encrypt the private key. The strategies for securing the password are: Make the password long and strong. Slow down the key stretching algorithm as much as you can tolerate. This answer ...



Top 50 recent answers are included