Questions tagged [gnupg]
GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails
0
votes
1answer
23 views
gpg-zip using secret key sign a zip
I have the following problem.
I created a Key-Pair with Thunderbird (Engimail), then I exported the asc file, and importet it in the git bash to gpg.
Now I need to sign a zip.
Using the command:
...
2
votes
0answers
9 views
GPG self-signature default check level
I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned.
When issuing gpg --check-sigs one ...
1
vote
0answers
22 views
Generating new E and S subkeys for a key that has been moved to card
I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
1
vote
1answer
38 views
GPG: Is 'pubring.kbx' safe to share?
This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?
I want to back ...
1
vote
1answer
20 views
Is the tomb's keyfile necessary when creating a password tomb with tomb-pass?
Pass tomb's documentation states
Usage:
pass tomb [-n] [-t time] [-f] [-p subfolder] gpg-id...
Create and initialise a new password tomb
Use gpg-id for encryption of both tomb and passwords
...
2
votes
1answer
53 views
What happens to a pass vault when the GPG key expires?
Say I were to use the Linux tool pass as my password manager and the corresponding GPG key were to expire. Would I still be able to get in?
-1
votes
0answers
48 views
Digitalocean Droplet got compromised - is it possible to decode the program?
My VPS got compromised and was used for DDOS attacks. I found the program that was responsible for it, opened it up in nano and looked like this:
Is it possible to decode it somehow, see the source? ...
3
votes
1answer
59 views
gnupg keys and pass database - Protecting both from unauthorised access and loss
My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
4
votes
2answers
83 views
Is it safe to store GPG encrypted data publicly eg on GitHub?
I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had.
After we create our public and ...
1
vote
1answer
37 views
Securely Download lubuntu from Non-Ubuntu System
The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
2
votes
1answer
35 views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
2
votes
1answer
37 views
Is the range of the s2k-count parameter in GPG still adequate?
From the manual: the s2k-count parameter specifies how many times the passphrase mangling for symmetric encryption is repeated. This value may range between 1024 and 65011712 inclusive.
Apparently in ...
2
votes
1answer
95 views
Export GPG key from smartcard and import yubikey
I have the OPEN PGP SMARTCARD V2.1 and there I have a signature key, a encryption key and a authentication key stored. The last 8 digits of the signature key is for example: 1234 5678.
Now I want to ...
2
votes
1answer
80 views
How to decrypt a gpg file?
I have a gpg file and a sha256 file. When I try to decrypt the gpg file using the gpg - d file.gpg command, it says that there is no secret key. I am absolutely new to this so I would appreciate any ...
2
votes
1answer
50 views
Is it reasonable to store encrypted TOTP keys + authentication credentials on a single device (for end-user)?
My current security model (at least for passwords) is to store them encrypted at rest and use GPG (in combination with an Yubikey) to perform encryption / decryption. I'm using pass (https://www....
2
votes
0answers
36 views
GPG - Use case for embedded system
I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure.
The user will load a GPG public key onto the device. ...
1
vote
0answers
21 views
Primary uid of Key is not changeable
Recently I had to revoke one of my UIDs and add a new one in my main GPG Key. As I expected the new UID became primary and I tried to change it back to the original one (it's not the revoked one). ...
1
vote
1answer
44 views
Wrong pgp key was signed
Someone signed my PGP key, by accident (we have never met, but I know the person a little).
The wrong signature was uploaded to the SKS pool.
Is there anything we can do about it to improve the web ...
1
vote
2answers
51 views
GPG secret key and passphrase
I generated a public/secret key pair with GnuPG. I know that the secret key must keep secret. However, I am wondering what are the risk to expose the secret key without the passphrase?
If Eve steals ...
1
vote
0answers
60 views
What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]
I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge.
Another solution I found is ...
2
votes
2answers
224 views
Is it a good idea to upload your gnupg files to github?
I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
1
vote
0answers
37 views
yubikey creating different ssh public key having same GPG
I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
0
votes
1answer
79 views
gpg --armor --export-secret-key differ on last 4 characters
I created a backup of a gpg key by doing:
gpg -a --export-secret-keys foo@bar > private.key
gpg -a --export foo@bar > public.key
Then on another system, I import them:
gpg --import private....
0
votes
0answers
55 views
Compatibility advantages of RSA-4096 over RSA-3072
I am targeting a security level of 128 bits for GnuPG, so I am using SHA-256 and AES-128. Now I need to choose between RSA-3072 and RSA-4096.
According to multiple sources RSA-3072 security level is ...
1
vote
1answer
25 views
GnuPG sub-keys revocation
My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored ...
4
votes
1answer
200 views
Why do so many PGP public keys begin with mQINBF?
Why do so many PGP public keys begin with mQINBF? I am just curious.
1
vote
2answers
55 views
key usage for offline gnupg master key
I've been reading some articles about using an offline master key for gnupg, and I'm confused about the key usage. It seems every article has a different opinion about it. I've seen the following ...
2
votes
1answer
65 views
Why do people check the passport on key signing events?
I find the common procedure of key signing parties a little awkward:
Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
1
vote
1answer
31 views
How to find default S2K parameters in GPG
How can I find the default string-to-key parameters in GPG? I am using it in Tails.
1
vote
1answer
54 views
problem after upgrading from GnuPG 1.4 to GnuPG 2.1
My Debian box decided to upgrade from "gnupg 1.4" to "gnupg 2.1" after some kind of security update.
After this, I am no longer able to use or access any of my keys.
After any gpg command, it says:
...
0
votes
0answers
27 views
Backing Up Server - Subkey or New Key for Encryption?
I am backing up a series of VPSes I own using duplicity. Since I will be storing this in a storage system like AWS I'd like to encrypt them.
I already have a GPG key I use that is registered in ...
1
vote
1answer
50 views
How can I find the default KDF for my version of GPG?
I am trying to find the default KDF for my version of gpg:
gpg (GnuPG) 2.2.6
libgcrypt 1.8.2
Does anyone know how?
3
votes
1answer
317 views
GPG masterkey and subkey for encryption and signature and default keys
I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
-1
votes
1answer
92 views
Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?
The proposed method
Brief and simplified description of the attack:
Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
4
votes
1answer
88 views
Using different GPG keys for encrypting emails and encrypting personal files?
I'm going to use GPG for
Signing my documents
Encrypting emails
Encrypting my personal documents.
Will it be better for security measures to use different encryption keys for 2 and 3? For 3, it ...
4
votes
0answers
399 views
How to encrypt, sign and decrypt a file with gpg?
I am using gpg to encrypt and decrypt a file. Here are the steps I am doing taking reference from this question:
# Sender
gpg --encrypt --recipient recipient@gmail.com --output confidential.pgp ...
3
votes
1answer
239 views
Create certificate without private key or using USB eToken
Considering this thread:
Create certificate without private key with OpenSSL
I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's ...
1
vote
1answer
124 views
Methods to work with offline primary keys
I created a number of profiles with separate subkeys for authentication, signature, and encryption while primary keys are saved on USB Stick. It's working alright but I was wondering if there are some ...
0
votes
1answer
73 views
GPG key expiration and storage
I hope I came to right place to ask about GPG.
I have created secret, public, and sign keys and set expiration dates for all keys in case I lose an access to them or forget a keyphrase, etc. I have ...
0
votes
0answers
13 views
GPG2 - editing key A to add key B as subkey causes B's password to change to that of A's.
GPG2 - editing key A to add key B as subkey causes B's password to change to that of A's. I assume by design, but why?
0
votes
2answers
64 views
PGP Data loss prevention for Linux endpoints
If a company allows his employees to use encryption, especially PGP encryption, it will run into trouble. Because AES128 is unbreakable, that means traffic which is routed in the intranet can't be ...
1
vote
1answer
5k views
gpg: decryption failed: No secret key
I cannot seem to get gnupg to decrypt files encrypted with my keys. I've tried migrating my secret key from an old laptop to a new one, and I keep getting the same error:
gpg: decryption failed: No ...
1
vote
0answers
26 views
What are direct key signatures (0x1F) usages other than for revocation?
While looking what the PGP Global Directory is, I have found that it's key has two strange signatures:
pub 2048R/CA57AD7C 2004-12-06
sig dirct 4DD19F10 2014-01-21 __________ __________ [...
2
votes
1answer
36 views
Double signature with GPG, only validate one key
I have a file which I have signed with two GPG keys and want to validate that file trough a script.
The scripts validates that the signatures are correct by checking the returned status from GPG. If ...
0
votes
1answer
71 views
How to force GPG to use a Keycard when it is available
I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
2
votes
2answers
269 views
How does gpg decryption command know which key in a key ring to use
I don't understand how gpg command could know which key in a key ring to use for decryption. For example, a key ring may have multiple keys. When an encrypted file needs to be decrypted, we only need ...
1
vote
1answer
47 views
What identifies an entity in PGP?
When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
8
votes
4answers
1k views
Create backup Yubikey with identical PGP keys
I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
2
votes
1answer
51 views
Is it wise to remove redundant self-signatures from my PGP key?
I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there:
$ gpg --list-sigs AAAAAAAAAAAAAAAA
pub 4096R/AAAAAAAA 2014-...
-1
votes
3answers
164 views
Why does Github need to offer a GPG signature feature?
Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
