Linked Questions
14 questions linked to/from Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?
41
votes
6
answers
104k
views
Extracting the PGP keyid from the public key file
Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block?
I found the hexa value of the key in the binary file, but I guess the position is based on ...
- 513
27
votes
2
answers
40k
views
GnuPG asks for a key ID when sharing my public key, what is that?
I generated a public key using GnuPG. I can see it using --list-keys
$ gpg --list-keys
/Users/mertnuhoglu/.gnupg/pubring.gpg
-------------------------------------
pub 4096R/CB3AF6E6 2015-12-24 [...
- 373
11
votes
2
answers
7k
views
What is an OpenPGP Key ID collision?
Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/).
What does the term collision refer to?
- 253
5
votes
2
answers
10k
views
Verifying a downloaded file with gpg
I'm trying to follow the instructions to verify a downloaded file here:
http://www.pps.univ-paris-diderot.fr/~jch/software/pgp-validating.html
Get a local copy of the signing key
You will ...
- 151
3
votes
2
answers
2k
views
Will the OpenPGP key fingerprint change if the certificate is extended?
Should the fingerprint of a renewed (extended) OpenPGP Key be the same? Is there any documentation on it (RFC)?
Quoting from RFC 4880:
There are many ways possible for two keys to have the same key
...
- 1,558
0
votes
1
answer
2k
views
What's the minimal way of sharing your public PGP key in email signature?
What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
3
votes
2
answers
1k
views
Exact meaning of RSA key in `gpg --verify` output
When verifying a pgp signed message using GnuPG, one gets an output similar to the following:
gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg: using RSA key ...
1
vote
1
answer
620
views
What to share (OpenPGP key ID or fingerprint) once key uploaded on key server?
I have uploaded my public key on:
https://sks-keyservers.net/
When sending mails, I want to notify the recipients about my public key just in case they want to use it.
Since the key is on key server,...
- 195
1
vote
1
answer
1k
views
Verify GnuPG download with signature file - and it fails
I'm trying to verify the new GnuPG download (for OS X) using GnuPG. (First of all I'm not sure if you should verify a file with the old version of it, which I probably didn't verify back then to be ...
- 7,519
3
votes
1
answer
357
views
Combating Networks of Forged OpenPGP Keys on Public Keyservers
I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
- 419
3
votes
1
answer
235
views
Are expired keys eligible default keys?
From GnuPG's man page:
[...] the default key is the first key found in the secret keyring.
Are expired keys eligible default keys? Or should I manually set the default key in gpg.conf?
I'm asking ...
- 669
0
votes
1
answer
159
views
What are the Consequences of OpenPGP Key Collisions?
In this answer to GPG keys & SHA-1, there's the sentence:
However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
- 4,727
2
votes
1
answer
160
views
How do we 'initiate' mail exchange with PGP
I am totally new with PGP, and I would like to know how I can initiate a mail exchange with it.
I created my public/private keys, and posted my private key on the MIT PGP Public Key Server. I can ...
- 23
0
votes
1
answer
201
views
Receiving mails with strange PGP Key ID
I have received encrypted emails which I can not decrypt because the key used for encryption seems not to be correct.
Usually I have a key ID with 8 hex characters. This key can be found on public ...
- 123