Linked Questions
18 questions linked to/from What is the exact meaning of this gpg output regarding trust?
24
votes
2
answers
18k
views
What is the difference between "full" and "ultimate" trust? [duplicate]
When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools):
1 = I don't know or won't say (undefined)
2 = I do NOT ...
- 6,935
2
votes
2
answers
2k
views
GPG Web-of-Trust Level [duplicate]
(and really sorry for my english)
I have a question about Web-of-Trust of GPG.
Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...
- 121
1
vote
1
answer
383
views
GPG key signing [duplicate]
GnuPG was warning me each time I use someone's key:
There is no assurance this key belongs to the named user
Use this key anyway? (y/N)
To get rid of this warning I signed his key:
gpg --sign-key [...
user78540
12
votes
2
answers
12k
views
GPG good signature but Warning: untrusted signature
I'm having an issue with some of my clients being unable to open email attachments when I sign the messages. The error they get is something like (free translation):
Error: cannot open. The ...
- 121
12
votes
3
answers
705
views
Why don't PGP keyservers enforce double-opt-in?
One thing that I found out when starting using PGP:
When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be.
Since a PGP key contains ...
- 9,054
5
votes
4
answers
6k
views
Does a PGP signature provide integrity verification?
Many websites including OpenSSL's website provide downloads along with MD5/SHA1 checksums sometimes in addition to PGP signatures for the files.
Simply put, do PGP signatures provide file integrity ...
- 6,843
11
votes
2
answers
10k
views
What trust level should I give keys I need for encryption?
As I'm encrypting server backups, I typically install my public GPG key from a keyserver into me server's keyring:
gpg --search-keys 6569758F
I import the key into my keyring.
I then attempt to ...
- 6,843
8
votes
3
answers
3k
views
GnuPG warning for a signed key with trust level 4
When encrypting a document with a public key I got a warning:
$gpg --encrypt -r 6B7F10E4 file.pdf
It is NOT certain that the key belongs to the person named
in the user ID. If you *really* know ...
- 297
5
votes
2
answers
11k
views
Verifying a downloaded file with gpg
I'm trying to follow the instructions to verify a downloaded file here:
http://www.pps.univ-paris-diderot.fr/~jch/software/pgp-validating.html
Get a local copy of the signing key
You will ...
- 151
6
votes
1
answer
3k
views
How to verify an OpenPGP key's ownership?
I've added the public key of Diceware creator (please use it as a practical example), I've added it by downloading diceware.wordlist.asc, and I didn't have his key and couldn't immediately find it to ...
- 1,853
4
votes
1
answer
3k
views
PGP Owner Trust Field & Signature Trust Field Distinction
I'm reading Cryptography and Network Security Principles and Practices (5th ed, p584) and reading about PGP keyrings, I'm a little confused about the differences between the owner trust field and the ...
- 2,627
6
votes
1
answer
1k
views
Validity, Owner Trust, Trust Signatures & Certification Level
Two questions on signatures.
I am trying to understand the various types of "trust signature". The man page says, "For more information please read the sections “Trust Signature” and “...
- 418
1
vote
1
answer
813
views
How can I verify if a person is in my web of trust?
Lets say I trust person A (whose public key is in a key server) and I want to know if I can also trust person B (pub key is also in a key server).
How can I verify that I have a chain of trust ...
- 349
0
votes
1
answer
1k
views
PGP legitimacy calculation
While studying PGP I started to doubt how to calculate the legitimacy/validity of a key. The problem comes when we set that key legitimacy is calculated as the weighted sum of the trust values.
What ...
- 103
1
vote
1
answer
1k
views
Verify GnuPG download with signature file - and it fails
I'm trying to verify the new GnuPG download (for OS X) using GnuPG. (First of all I'm not sure if you should verify a file with the old version of it, which I probably didn't verify back then to be ...
- 7,569