Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
1 vote
0 answers
30 views

How to verify the downloaded Mozilla Firefox binary? [duplicate]

I'm wondering about the correct steps when you want to download Firefox from their server and validate it has not been tampered with. Assume you download the latest Firefox tar-bz2-package from https:/...
Gere's user avatar
  • 147
1 vote
1 answer
144 views

Now that `sshcontrol` has been deprecated, how to use gpg key for ssh authentication with an agent?

The GnuPG Manual states that: This [sshcontrol] file is deprecated in favor of the "Use-for-ssh" attribute in the key files. What is now the correct way to configure gpg / gpg-agent to use ...
a2k42's user avatar
  • 123
0 votes
0 answers
29 views

Types of certificate? [duplicate]

What types of certificates are there? I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
anonymous's user avatar
0 votes
1 answer
84 views

Launch a process with secrets as environment variables

I have a process that needs secret keys to be passed as environment variables. That is for historical reasons. I have a AWS machine where this process runs but I do not want to store these keys in ...
Henrique Bucher's user avatar
0 votes
2 answers
67 views

gpg security on a shared Linux machine

AFAIK, the few ways private information from gpg can get leaked to other users on a shared Linux machine is: someone with root access can access gpg's files someone with root access can access gpg's ...
aackmann's user avatar
0 votes
1 answer
94 views

GnuPG (gpg) specify multiple keyservers

Specifying multiple keyservers doesn't seem to work correctly, and gpg always uses just the first key server. I have the following two lines in my dirmngr.conf: keyserver hkps://keys.openpgp.org ...
aackmann's user avatar
0 votes
1 answer
98 views

GPG deleted key/disassociation

I had a key that I accidentally deleted from the keyring a while ago and I'd like to dissociate my name from it. I still have the key as well as the revocation certificate. I made another keypair ...
primeCEOstack's user avatar
0 votes
1 answer
135 views

GPG can't decrypt my data because of an invalid packet

I have an encrypted data containig some of my data that I am unable to decrypt. It is archived with tar, compressed with gzip and encrypted with gnupg. Today I tried to decrypt it with gpg and it ...
Nicolas Dumitru's user avatar
0 votes
1 answer
56 views

Does gpg support storing public keys in encrypted state?

I know this might sound counter-intuitive, but is it possible to configure gpg to store public keys in encrypted state on disks? Such that when encrypting a message to someone, user would be asked to ...
aackmann's user avatar
0 votes
0 answers
20 views

How to recover my password from my file.key [duplicate]

I don't remember my passphrase for my PGP key that was created several years ago. How can I decrypt my file.key to recover it? Or what should I do to recover it from my file.key?
BitCoinsBank's user avatar
0 votes
1 answer
128 views

Convert PGP key to X.509?

Can I convert a PGP key to X.509, using OpenSSL or GNUPG? Aren't these only container/wrapper formats?
Geremia's user avatar
  • 1,753
4 votes
1 answer
406 views

Should one really disable AEAD for recent GnuPG created PGP keys?

Apparently, there are some problems with the new defaults that are set when one creates a PGP key using a recent version of GnuPG (2.4). I ran into this after generating a new ECC/ED25519 key to ...
Tobias Leupold's user avatar
1 vote
1 answer
359 views

Safe usage of bitaddress.org

I want to use bitaddress.org to create a wallet. Can you please verify my approach? Change the password of my router and wifi and unplug all devices from the network except my notebook. Go to https:/...
Ohumeronen's user avatar
0 votes
0 answers
51 views

Whonix Linux Installer bash script signature verification failure

I am verifying the Whonix Linux Installer bash script. I imported the GPG key first following the instructions from the wiki using the Debian procedure. I could successfully verify the Virtualbox ...
n30's user avatar
  • 1
2 votes
0 answers
232 views

PGP expired encryption subkey : renew or replace?

I am in the process of learning PGP (GnuPG more precisely). I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
ChennyStar's user avatar
1 vote
0 answers
56 views

Is a revocation certificate still valid after updating GPG key's expiration?

When I first generated my GPG key I created a revocation certificate for it as well. Now I've edited my key and its subkeys and updated their expiration. Do I need to generate a new revocation ...
Rob's user avatar
  • 78
0 votes
0 answers
101 views

Why doesn't file/folder encryption work the way I imagine it should? Can I have the UX I want? Tell me what's wrong with this idea

I have been looking around at various encryption schemes, and I haven't found anything exactly like what I want in terms of user experience. If what I want isn't a thing, I assume it's been thought of,...
Stonecraft's user avatar
1 vote
0 answers
93 views

Set a default GPG key id for email

If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to? and ditto encrypt from/with, ...
Sandra's user avatar
  • 111
0 votes
0 answers
68 views

Using Gnupg with either a smartcard key or a local key

I added a second signing subkey to my GPG key, which I then moved to a Yubikey: /home/user/.gnupg/pubring.kbx ---------------------------- sec# ed25519/ABCDECAD 2023-11-12 [SC] ...(fingerprint ...
j0057's user avatar
  • 101
3 votes
1 answer
382 views

What exactly is the security model of pass?

Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key. I'm confused at how this is considered secure. The GPG key has a passphrase ...
gomennathan's user avatar
1 vote
0 answers
87 views

Why does GPG seem to parse the whole encrypted file when it can't find the decryption key?

You can try this one for yourself... Generate a new GPG keypair. Create a large junk file. Maybe 5G or 10G in size. Encrypt the file and use the new key as the recipient. Delete the privkey which ...
bitofagoob's user avatar
1 vote
0 answers
60 views

Restricting ubuntu signing keys?

I started reading on apt and the security changes to always use GPG signing keys, but further saw that it by default uses all configured GPG signing keys, this seems like a small but unecessary ...
Xavanteex's user avatar
0 votes
0 answers
88 views

What is the best way to encrypt asymmetric metadata?

As a hobby project I'm thinking about how to write a secure chat where even all metadata are encrypted so that it is impossible to leak any (meta) information by design. My basic idea is right now: ...
rekire's user avatar
  • 133
1 vote
1 answer
123 views

Prove The Identity of Author Using GPG On Demand

Given a situation where I want to be anonymous by default, how can I use GPG to prove that I'm the original author once, on-demand, and for a specific user?
SReza S's user avatar
  • 13
0 votes
1 answer
81 views

Preference of private keys when selecting by UID

I have two private keys with the same UIDs in GnuPG, and would like to use the newer one in preference to the older. When no key is specified, the default-key option takes care of this, but several of ...
Simon Richter's user avatar
4 votes
1 answer
202 views

GPG allows importing an invalid secp256k1 public key

I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
Andreas Tzionis's user avatar
0 votes
0 answers
174 views

How does user activity affect entropy generation process in GnuPG?

Earlier today, I was using gpg to generate keys for work. While doing so, I noticed: We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, ...
Rahul Dixit's user avatar
0 votes
2 answers
788 views

Backup GPG private key in KeePassXC

In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field. Provided that the db file has very good password, is this ...
robertspierre's user avatar
0 votes
1 answer
541 views

Is it possible to distinguish the binary content of a gpg-encrypted file from a random blob of data?

I have encrypted the file some_file to be decipherable by some_recipient with: gpg --encrypt --recipient some_recipient some_file Which results in a file some_file.gpg. My question is: is the content ...
Zorglub29's user avatar
  • 307
1 vote
2 answers
172 views

What's the shortest message you need to claim ownership of another message?

Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following. The hash/ characteristic string is compact enough (ideally a few ...
Boson Bear's user avatar
0 votes
1 answer
443 views

How can I decrypt a text file with gpg?

I want to decrypt a text file (which happens to be an Electrum wallet file) with gpg but I get the error gpg: no valid OpenPGP data found. I have done a quick test by encrypting a small text file and ...
Dan's user avatar
  • 165
2 votes
0 answers
114 views

How to figure out what is requesting access to my yubikey?

I recently set up two yubikeys based on this guide. I also set it up so gpg-agent is my ssh-agent, so I can use the keys for ssh. For some reason, even without me taking any action after plugging in ...
fbence's user avatar
  • 121
1 vote
0 answers
201 views

Why does the fingerprint of a GPG key change after it is made a sub key?

I recently consolidated some of my independently GPG keys. I used the following the command to edit the oldest key gpg --expert --edit-key <oldest-keygrip> gpg> add-key --keygrip=<another-...
ksinkar's user avatar
  • 111
1 vote
2 answers
756 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
Arthae's user avatar
  • 13
2 votes
1 answer
2k views

How to provide public key for security.txt?

When generating a security.txt file, it is recommended to digitally sign it. However, security researchers must not assume that the information used in the Encryption field is actually the key used to ...
kolumbus's user avatar
0 votes
0 answers
165 views

GPG2 imported SSH `ecdsa-sha2-nistp256` key can't be set to [Authenticate]

I've imported my existing keys into GnuPG agent (gpg2) using ssh-add and now trying to register them as subkeys of my primary GPG key as outlined in https://opensource.com/article/19/4/gpg-subkeys-ssh....
AnrDaemon's user avatar
  • 101
1 vote
0 answers
421 views

SSH authentication with GPG failing with a new Yubikey with the same gpg keys as the old one

I have a MacBook M1 on which I have been using a Yubikey 5 to authenticate SSH logins to various systems. I recently got a Yubikey 5C so I wouldn't have to use adapters. I moved my keys over to it ...
user28598's user avatar
1 vote
0 answers
92 views

`sig` lines in my GPG key, what are they for, and how to remove?

In this GPG key of mine, there I can see lines: sig sig 4311d0fb042cb88f 2019-03-08T17:59:45Z ____________________ ____________________ [selfsig] sig sig 4311d0fb042cb88f 2019-03-08T17:59:45Z ...
Vlastimil Burián's user avatar
1 vote
3 answers
1k views

Which one is safer for persistent online data? Gpg per file encryption vs gpg encrypted image vs LUKS2 image

3 people need to share some data through cloud. The total amount of data is small (<5gb in total). The update rate is very low, 1 per month. The cloud has very limited security measures so we ...
Wang's user avatar
  • 128
0 votes
2 answers
245 views

gpg -c "file" > when I double click on the file, it is decrypted automatically without asking for a pwd

I used gpg -c filename ... and when I double click on the file, it just decrypts it without asking for a password. I don't know, it feels like the file wasn't encrypted at all. What did I do wrong? Or ...
user avatar
1 vote
1 answer
93 views

How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?

I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party ...
Murch's user avatar
  • 131
1 vote
0 answers
363 views

Which PGP fingerprint to share/publish as my digital identity?

The primary secret key should be stored offline and only be used for creating/signing keys. There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
fooness's user avatar
  • 11
1 vote
0 answers
151 views

Using GPG is there a way to label public keys on my OpenPGP keyring?

I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
A H's user avatar
  • 11
1 vote
1 answer
605 views

ed25519-sk vs. gpg-agent on Yubikey

According to my understanding of this document, Yubikey is capable of running ed25519-sk and gpg-agent. Which one is more secure? Obviously, ed25519-sk wouldn't work, if the SSH server is old, but ...
Thomas G. Lau's user avatar
4 votes
1 answer
4k views

What are the security implications of using GPG instead of SSH keys for authentication

I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
SomethingSomething's user avatar
0 votes
1 answer
476 views

Get GPG signature without decryption

I use GPG on awsLinux, currently version 2.0.22. Before exchanging a file with someone we exchange public keys, so signatures can be confirmed for the files transmitted. Their public key is imported ...
RunThor's user avatar
  • 103
0 votes
1 answer
362 views

Do git commit signatures reveal key uid if different from git email?

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
ahmedsabriz's user avatar
1 vote
2 answers
203 views

How to securely use `pass`, `sudo`, and `npm` on the same machine

TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store. I use pass as a password manager, on Linux. And like probably all Linux users, I ...
Zwyx's user avatar
  • 113
0 votes
0 answers
166 views

PGP public key flagged as malicious to root. Was ran before

Hello I had used this pgp public key on my win10 OS with pgptool to message someone. Then when i used that same public key in whonix OS console it came back with some type of warning about malicious ...
jowblow's user avatar
2 votes
2 answers
432 views

Is it secure to post a password-secured .asc file in public?

Using GPG, I have created a key pair. I clicked on "Protect the generated key with a passphrase". I have created a .asc file to backup this key pair. Is it safe to publish this .asc file in ...
J Eti's user avatar
  • 123

1
2 3 4 5
16