Linked Questions

32
votes
1answer
16k views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
16
votes
2answers
18k views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
8
votes
3answers
1k views

GnuPG warning for a signed key with trust level 4

When encrypting a document with a public key I got a warning: $gpg --encrypt -r 6B7F10E4 file.pdf It is NOT certain that the key belongs to the person named in the user ID. If you *really* know ...
5
votes
2answers
5k views

Verifying a downloaded file with gpg

I'm trying to follow the instructions to verify a downloaded file here: http://www.pps.univ-paris-diderot.fr/~jch/software/pgp-validating.html Get a local copy of the signing key You will ...
3
votes
2answers
530 views

Will the OpenPGP key fingerprint change if the certificate is extended?

Should the fingerprint of a renewed (extended) OpenPGP Key be the same? Is there any documentation on it (RFC)? Quoting from RFC 4880: There are many ways possible for two keys to have the same ...
7
votes
1answer
303 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of them....
1
vote
1answer
606 views

Verify GnuPG download with signature file - and it fails

I'm trying to verify the new GnuPG download (for OS X) using GnuPG. (First of all I'm not sure if you should verify a file with the old version of it, which I probably didn't verify back then to be ...
3
votes
1answer
193 views

Combating Networks of Forged OpenPGP Keys on Public Keyservers

I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
0
votes
1answer
56 views

What are the Consequences of OpenPGP Key Collisions?

In this answer to GPG keys & SHA-1, there's the sentence: However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
0
votes
0answers
81 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...