Questions tagged [gnupg]
GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails
0
votes
0answers
11 views
gpg ignores passphrase on my key stored on yubikey 5 nfc
I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A).
While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
0
votes
0answers
62 views
Is GPG's AES encryption that much stronger than its RSA headers? [duplicate]
Correct me if I'm wrong at any point of this questino.
I understand that AES is a lot cheaper to compute than RSA (or any form of asymmetric encryption) and that that is why GPG and similar programs (...
0
votes
0answers
41 views
PGP file Decryption with gpg command [on hold]
I am trying to decrypt pgp encrypted files. I had both public and private keys and I created two files like pub.key and sec.key and imported them using
gpg --import pub.key
gpg --import sec.key
and ...
1
vote
0answers
34 views
How to display the SHA256 hash while signing or in signature
I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
1answer
55 views
What are a keypair and a public key ring?
The GNU Privacy Handbook says:
The command-line option -gen-key is used to create a new primary
keypair.
gpg --gen-key
Does a keypair mean a pair of private key and public key?
The book also ...
2
votes
1answer
31 views
Why is GPG-agent still caching my passphrase?
I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including:
default-cache-ttl 0
max-cache-ttl 0
(also flipped the bit to 1)
within ~/.gnupg/gpg-agent.conf ...
1
vote
1answer
22 views
Leaking `.gnupg` directory when private keys are stored on a smart card
What security risks can be caused by leaking .gnupg directory (for example, accidentally committing it to GitHub) when private keys are stored on a smart card?
0
votes
1answer
57 views
OpenPGP SmartCard: generate revocation certificate on-card?
As far as I can tell:
It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
1answer
45 views
Use GPG smartcard and gpg-agent to protect multiple SSH keys
I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine.
ssh-add -...
0
votes
2answers
30 views
Confused about GitHub's GPG key association and authenticity
I'm not sure I understand GPG, and something on GitHub has left me wondering.
In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
0
votes
1answer
61 views
Is it safe to share an encrypted GPG private key?
I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
3
votes
0answers
36 views
Import GnuPG Subkey to other Primary Key
Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
2
votes
2answers
69 views
On gpg2's symmetric decryption
According to an answer and comments in a earlier question of mine, when one uses gpg2 to symmetrically encrypt a message, gpg2 randomly generates a one-time encryption key for that message, as well as ...
3
votes
1answer
60 views
How do GnuPG smartcard generate reliable random data?
I'm generating a private key on my new GPG smartcard at this very moment.
On linux, the random would be fed by the keystrokes on my keyboard, the network packets, the mouse movements etc.
How does ...
1
vote
1answer
36 views
On the use of gpg2 for long-term encryption
I am looking for tools/libraries for symmetrically encrypting millions of files (many terabytes' worth of content).
In particular, I am exploring the possibility of using gpg2 for this1.
One concern ...
0
votes
1answer
75 views
The passphrase in gnupg's symmetric vs asymmetric encryption schemes
This question is admittedly artificial. Its purpose is only to help me understand aspects of gnupg that I can't figure out from reading the documentation.
One thing that puzzles me about gnupg is ...
0
votes
1answer
53 views
I can't get gpg-zip to work. What am I doing wrong?
I haven't used gpg-zip before. I am trying to compress and encrypt a directory with more than 200 files. I did a test run with a smaller directory containing just a dozen PDFs in it, a folder I'll ...
0
votes
0answers
70 views
What are the possible ways to manage gpg keys over period of 10 years?
What key curation can be applied to a personal gpg keypair over a period of time (e.g. 10 years) if I also want to use the keypair for professional use? What are the measures that I need to take to ...
1
vote
1answer
66 views
One GPG key with multiple user identities for my career?
I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.
My understanding is that there are two ways this could be done:
Have one main/master GPG ...
4
votes
1answer
132 views
Correct way to replace a GPG key
I want to create a new GPG key with a longer key size.
What are the best ways to replace the key ?
My current key is associated with a lot of stuff like GitHub etc.
Should I revoke my old key and sign ...
3
votes
1answer
32 views
Can I use 3 same subkeys to 2 different GPG Smartcards?
Generated keys on an air-gapped PC.
Backed-up my .gpg folder on a USB.
Imported keys to smartcard 1.
Keys deleted
Replaced .pgp folder with .pgp from USB
Imported keys to smartcard 2.
Is this setup ...
1
vote
0answers
27 views
Does the output of --export-ssh-key change with different subkeys?
I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
1
vote
3answers
90 views
With GPG, can 3rd party verify that message has been encrypted by specific public key?
Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext).
Later Alice claims that Bob made a mistake and the ciphertext was not ...
1
vote
1answer
91 views
Why can GPG sign messages but not keys?
I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
2
votes
1answer
85 views
How to verify file Integrity?
I have downloaded a software(zipped), from a website: example-linux.gtk.x86_64.zip
There is another file given for verification, example-linux.gtk.x86_64.zip.asc, whose content are
-----BEGIN PGP ...
0
votes
1answer
39 views
Downloads and GPG singnatures [duplicate]
I've recently installed Kleopatra in order to use GPG for confirming the validity of downloads. I've downloaded the following (32-bit verison):
https://www.claws-mail.org/win32/
I also downloaded the ...
2
votes
1answer
69 views
Are there any known collisions of a “long” (64 bit) OpenPGP key ID?
We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
41 views
Are there risks to having many uids on my gpg key?
I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
1
vote
0answers
73 views
Help me understand Encryptpad and 7-zip for encryption
I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive).
I have found three options:
7-zip, which does AES-256
Encryptpad, which ...
0
votes
0answers
28 views
Which encryption and hash is best to use in GNUPG2?
Okay, I know this has been asked before (but it changes over time)... and I know there perhaps are no good answers... but here goes...
I want to create a new key-set for myself using gnupg2, but I ...
1
vote
1answer
48 views
Making a offline GNUPG2-key - should I make Master-key S&E or S only?
I want to make an offline-key in GNUPG2 - ie. a "Master-key" to which I'll add one or more sub-keys for daily use, before storing the whole thing on an USB. I will then remove the secret part of the ...
1
vote
1answer
14 views
Listing available hashes in GNUPG2?
I want to use the setpref command (under --edit-key ) to set a key's prefered hash-algorithms in gnupg2, and was wondering if there is a way to list which hashes my version of gpg supports?
0
votes
2answers
138 views
Openssl / OpenPGP file encryption - security advise [duplicate]
I am planning to use Openssl to encrypt our weekly offsite backups using a keyfile (symmetrical encryption) and after some research I found the following GnuPGP command:
base64 -w0 <keyfile.jpg | ...
1
vote
0answers
39 views
Response to a gpg fingerprint collision [duplicate]
I recently updated my gpg key and extended its expiration date for another year. Unlike prior years, I decided to 'look myself up' on http://keys.gnupg.net, and was shocked to find my name and email ...
1
vote
1answer
358 views
openssl vs gpg for file based encryption? Pros vs cons for security?
I want to encrypt a tar archive and optionally a block file system (akin to DMG image). Does anyone know the pros vs cons of encrypting each with OpenSSL vs GPG?
I ask because some have stated that ...
1
vote
2answers
55 views
What does the 'Sign' and "Add to recipients' means in GPG keychain?
Hello everyone,
I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
0answers
23 views
Does gpg-agent cache passphrases per symmetrically encrypted file?
I have used the following command to symmetrically encrypt different files, all with the same passphrase:
$ gpg -c --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-count 65536 some_file.txt
...
1
vote
0answers
268 views
GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard
I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors:
x>gpg -vv --decrypt encrypted.gpg
gpg: armor: BEGIN PGP MESSAGE
# off=0 ctb=XX ...
2
votes
0answers
73 views
GPG: how to encrypt using a keyfile? (symmetric)
In Ubuntu this produces a "filename.txt.gpg" file and works:
$ gpg --symmetric --passphrase-file keyfile.key filename.txt
In debian, I get a popup requesting I enter a password...
How do I encrypt ...
1
vote
0answers
145 views
PGP public key block Public-Key (old) - What does the OLD mean?
System: Linux Mint 19.
Today I created a new GPG key pair using:
gpg --full-generate-key
I armor-exported the public key and have run:
file *.public
As a surprise I found my key or format or ...
2
votes
0answers
24 views
GPG self-signature default check level
I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned.
When issuing gpg --check-sigs one ...
1
vote
0answers
26 views
Generating new E and S subkeys for a key that has been moved to card
I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
1
vote
1answer
150 views
GPG: Is 'pubring.kbx' safe to share?
This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?
I want to back ...
1
vote
1answer
46 views
Is the tomb's keyfile necessary when creating a password tomb with tomb-pass?
Pass tomb's documentation states
Usage:
pass tomb [-n] [-t time] [-f] [-p subfolder] gpg-id...
Create and initialise a new password tomb
Use gpg-id for encryption of both tomb and passwords
...
2
votes
1answer
85 views
What happens to a pass vault when the GPG key expires?
Say I were to use the Linux tool pass as my password manager and the corresponding GPG key were to expire. Would I still be able to get in?
3
votes
1answer
72 views
gnupg keys and pass database - Protecting both from unauthorised access and loss
My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
4
votes
2answers
131 views
Is it safe to store GPG encrypted data publicly eg on GitHub?
I've been learning some basics of information security and GPG encryption and it's super intriguing. I wanted to understand vulnerabilities behind an idea that I had.
After we create our public and ...
2
votes
1answer
47 views
Securely Download lubuntu from Non-Ubuntu System
The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an ...
2
votes
1answer
72 views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
2
votes
1answer
50 views
Is the range of the s2k-count parameter in GPG still adequate?
From the manual: the s2k-count parameter specifies how many times the passphrase mangling for symmetric encryption is repeated. This value may range between 1024 and 65011712 inclusive.
Apparently in ...
