Questions tagged [gnupg]
GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails
-1
votes
1answer
72 views
Is GPG symmetric (decryption) vulnerable?
Suppose a file (say, a text file source.txt) was encrypted into danger.gpg using GPG symmetric encryption on a compromised device. Since the device is compromised, danger.gpg could have been created ...
1
vote
1answer
53 views
How do I delete secret subkeys correctly?
I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead.
I was able to reproduce my mistake with the following commands:
$ ...
0
votes
1answer
26 views
GnuPG can see a card under root user, but not under normal user
When under an unprivileged user:
$ gpg --card-status
gpg: selecting openpgp failed: No such device
gpg: OpenPGP card not available: No such device
With sudo or under a root user:
$ sudo gpg --card-...
2
votes
2answers
93 views
Is it permissible to use GPG without an encryption key?
Will I be disapproved of or get frowned upon a lot if I choose to deploy and use GnuPG without an encryption key? E.g. I generate keys manually and skip the encryption key entirely.
The reason is ...
0
votes
0answers
32 views
Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?
I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...
1
vote
1answer
63 views
How do I create a detached plain text signature?
If I use gpg --detach-sig file, then I get a small file.sig, but it is not plain text, so this is not useful if you wish to send the signature in a plain text format.
If I use gpg --clearsign file, ...
0
votes
0answers
35 views
How to automatically check if key in a gpg file is expired without importing [migrated]
I want to check if key in a gpg file is expired without importing so I tried this :
$ gpg --list-options show-sig-expire my_key.gpg
pub 2048R/8719FCE4 2016-09-28 home:stevenpusser OBS Project <...
0
votes
0answers
59 views
Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?
Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys
Mallory ensures that Bob uses her keyserver, which offers her own key, which
is sharing the 32-bit "short" Key ...
1
vote
1answer
62 views
Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?
I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
1
vote
1answer
71 views
How do I interpret output that produces gpg listing keys?
Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
1
vote
1answer
50 views
Length of a stretched gnupg passphrase that is comparable in strength to an unstretched string of 256 random bits
Assume that we want to encrypt a file with gnupg using AES-256 as the encryption algorithm. (Hence, symmetric encryption.)
In this mode, gnupg requires a passphrase from the user. I understand that ...
2
votes
0answers
49 views
How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?
The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
-1
votes
2answers
155 views
Is that a good idea? - Firefox/Chrome in-content encryption
I'm currently thinking about writing a Firefox/Chrome and Python/PHP/JS plugin to accomplish the following:
Assuming you are on a non-SSL secured site or you simply don't trust any CA like Let's ...
0
votes
1answer
126 views
RSA 4096 vs. ECC Curve 25519
I want to use GPG to encrypt files before storing them as backup in the cloud. I don't care about interoperability or performance/resource consumption during encryption/decription. I only care about ...
0
votes
0answers
39 views
Which encryption algorithm for cloud backup?
I want to backup my data to the cloud. Before that, I want to encrypt it using GPG (gpg (GnuPG) 2.2.11 and libgcrypt 1.8.4).
The backup is just for me, so I don't care about interoperability
I only ...
3
votes
1answer
139 views
Is there a security difference between GPG signing a file directly or its SHA512SUM file?
I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose.
Let me present you with two options:
Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with:
...
1
vote
1answer
39 views
Decrypting gpg2-symmetrically-encrypted files using non-gpg2 tools
If I encrypt a file using gpg2 and specifying AES256 as my encryption algorithm, can I decrypt it with tools other than gpg2?
More generally, does the fact that one tool used AES256 for encrypting a ...
6
votes
2answers
111 views
Is GPG a kind of digital signature?
So I've been using GPG since I've touched Linux&LibreOffice, but I only knew that's its a signature, for identifying the work is created by me. But soon I've been touching some law questions and ...
2
votes
2answers
65 views
GPG: Change expected card number
I have switched from a YubiKey 4 to a YubiKey 5. Both have the same GPG keys stored. After storing the key on the first YubiKey, I fetched my public key so GPG knows where to look for the private key. ...
4
votes
1answer
91 views
I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?
Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
6
votes
1answer
254 views
Preparing to change over to new GPG-key - what to do with my old ones?
I've just created a new off-line GPG-key with a sign/certify master-key and two sub-keys - one for signing and one for encrypting. 5 yr expiration for the master, 2 yr for the subs. My master-key got ...
0
votes
0answers
23 views
Know the setting used in creating key pair in GNUPG4Win version 3.15
I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation.
Basically I want to use AES-128, 3DES ...
43
votes
7answers
11k views
Is layered encryption more secure than long passwords?
The comments in this question debate about the added security of multi-layered encryption. There seems to be some disagreement, and I thought a proper question would be helpful here.
So, to provide ...
13
votes
4answers
6k views
Is there a limit on the layers of encryption a file can have?
Consider symmetric GPG encryption of a given file my_file.txt. Something like (in command line)
gpg --symmetric --cipher-algo AES256 my_file.txt
After suppying the prompt with the new password, the ...
0
votes
0answers
42 views
gpg2 --full-generate-key generated 2 keys with different expiry dates
I was trying to generate a new gpg keypair earlier, so ran:
gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
2
votes
1answer
68 views
gpg ignores passphrase on my key stored on yubikey 5 nfc
I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A).
While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
1
vote
0answers
71 views
Is GPG's AES encryption that much stronger than its RSA headers? [duplicate]
Correct me if I'm wrong at any point of this questino.
I understand that AES is a lot cheaper to compute than RSA (or any form of asymmetric encryption) and that that is why GPG and similar programs (...
1
vote
0answers
40 views
How to display the SHA256 hash while signing or in signature
I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
1answer
63 views
What are a keypair and a public key ring?
The GNU Privacy Handbook says:
The command-line option -gen-key is used to create a new primary
keypair.
gpg --gen-key
Does a keypair mean a pair of private key and public key?
The book also ...
2
votes
1answer
48 views
Why is GPG-agent still caching my passphrase?
I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including:
default-cache-ttl 0
max-cache-ttl 0
(also flipped the bit to 1)
within ~/.gnupg/gpg-agent.conf ...
1
vote
1answer
24 views
Leaking `.gnupg` directory when private keys are stored on a smart card
What security risks can be caused by leaking .gnupg directory (for example, accidentally committing it to GitHub) when private keys are stored on a smart card?
0
votes
1answer
65 views
OpenPGP SmartCard: generate revocation certificate on-card?
As far as I can tell:
It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
1answer
82 views
Use GPG smartcard and gpg-agent to protect multiple SSH keys
I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine.
ssh-add -...
0
votes
2answers
34 views
Confused about GitHub's GPG key association and authenticity
I'm not sure I understand GPG, and something on GitHub has left me wondering.
In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
2
votes
1answer
90 views
Is it safe to share an encrypted GPG private key?
I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
3
votes
0answers
42 views
Import GnuPG Subkey to other Primary Key
Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
2
votes
2answers
113 views
On gpg2's symmetric decryption
According to an answer and comments in a earlier question of mine, when one uses gpg2 to symmetrically encrypt a message, gpg2 randomly generates a one-time encryption key for that message, as well as ...
3
votes
1answer
71 views
How do GnuPG smartcard generate reliable random data?
I'm generating a private key on my new GPG smartcard at this very moment.
On linux, the random would be fed by the keystrokes on my keyboard, the network packets, the mouse movements etc.
How does ...
1
vote
1answer
52 views
On the use of gpg2 for long-term encryption
I am looking for tools/libraries for symmetrically encrypting millions of files (many terabytes' worth of content).
In particular, I am exploring the possibility of using gpg2 for this1.
One concern ...
0
votes
1answer
149 views
The passphrase in gnupg's symmetric vs asymmetric encryption schemes
This question is admittedly artificial. Its purpose is only to help me understand aspects of gnupg that I can't figure out from reading the documentation.
One thing that puzzles me about gnupg is ...
0
votes
1answer
84 views
I can't get gpg-zip to work. What am I doing wrong?
I haven't used gpg-zip before. I am trying to compress and encrypt a directory with more than 200 files. I did a test run with a smaller directory containing just a dozen PDFs in it, a folder I'll ...
0
votes
0answers
75 views
What are the possible ways to manage gpg keys over period of 10 years?
What key curation can be applied to a personal gpg keypair over a period of time (e.g. 10 years) if I also want to use the keypair for professional use? What are the measures that I need to take to ...
1
vote
1answer
110 views
One GPG key with multiple user identities for my career?
I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.
My understanding is that there are two ways this could be done:
Have one main/master GPG ...
4
votes
1answer
277 views
Correct way to replace a GPG key
I want to create a new GPG key with a longer key size.
What are the best ways to replace the key ?
My current key is associated with a lot of stuff like GitHub etc.
Should I revoke my old key and sign ...
3
votes
1answer
37 views
Can I use 3 same subkeys to 2 different GPG Smartcards?
Generated keys on an air-gapped PC.
Backed-up my .gpg folder on a USB.
Imported keys to smartcard 1.
Keys deleted
Replaced .pgp folder with .pgp from USB
Imported keys to smartcard 2.
Is this setup ...
2
votes
0answers
36 views
Does the output of --export-ssh-key change with different subkeys?
I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
2
votes
3answers
113 views
With GPG, can 3rd party verify that message has been encrypted by specific public key?
Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext).
Later Alice claims that Bob made a mistake and the ciphertext was not ...
1
vote
1answer
126 views
Why can GPG sign messages but not keys?
I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
2
votes
1answer
123 views
How to verify file Integrity?
I have downloaded a software(zipped), from a website: example-linux.gtk.x86_64.zip
There is another file given for verification, example-linux.gtk.x86_64.zip.asc, whose content are
-----BEGIN PGP ...
0
votes
1answer
43 views
Downloads and GPG singnatures [duplicate]
I've recently installed Kleopatra in order to use GPG for confirming the validity of downloads. I've downloaded the following (32-bit verison):
https://www.claws-mail.org/win32/
I also downloaded the ...
