Hot answers tagged

6

Checking the root certificates of my browser I see that almost all Root CAs are using SHA-1 or below. The signing algorithm used for the trusted root certificates is unimportant. Signatures are used to establish trust. By definition, a trusted root certificate is one which you implicitly trust based on provenance (e.g., where it came from and how it ...


5

How can I use letsencrypt to get a signed public key for use with OpenPGP? This is not possible for several reasons. letsencrypt does not Verify Idenitity So I can prove in court the key is mine [...] letsencrypt only verifies domain ownership, with other words whether you have control over the domain. They do not verify any personal information. ...


4

A: Authentication only. You can still do "null" encryption afterwards, if you like. But if you do non-null encryption, then you'll have an idea of who with you're doing that. That's the authentication part. -- There used to be a time when SGC, Server-Gated-Cryptography, was a thing. An extra bit in the certificate would either allow or disallow any decent ...


3

If you use a public key that someone else is using, it means that you are also using the same private key. In other words, that person would be able to (a) decrypt any encrypted messages you receive and (b) impersonate your digital signature. Just like a pair of identical house keys are interchangeable, a pair of identical public-private key pairs are ...


2

tl;dr: both dumps contain the same keys, but you get some additional certifications from the key server not included in the minimal export of the VeraCrypt website. OpenPGP Packets OpenPGP keys are composed by a set of OpenPGP packets, which can be listed by gpg --list-packets and pgpdump. For exported keys, there's one required packet, the public key ...


2

A PGP keyfile is not a single key string, but contains several entries (packets). Instead of trying to compare the ASCII representation of both files, you should use appropriate tools such as gpg(1) and compare the fingerprints. Is there some way to make this easy? Yes, like this: $ wget https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc $ ...


1

There are subtleties about such comparisons. To crack symmetric encryption, like this password-based encryption of the private key, one needs to one either of the following: guess the password; guess the symmetric key derived from the password; leverage a structural weakness in the encryption algorithm or how it is used. In the page you link, the ...


1

The long and short is: it depends! A long, strong, random passphrase encrypted properly with lots of iterations is very safe unless there's a flaw in gpg somewhere (which is possible, of course), very safe. A weak passphrase is always unsafe. A small number of iterations on encryption makes the area of "weak passphrase" bigger, and the area of "strong ...


1

Sorry, per the sourcecode you can't prevent the writing of $outdir/$serial.pem and still get your (desired) -out. You could put $outdir someplace like /tmp that gets discarded frequently; or on an OS that allows you to add new filesystem types (Linux at least) you could create a filesystem type that implements a directory such that anything created in it is ...



Only top voted, non community-wiki answers of a minimum length are eligible