Questions tagged [gnupg]
GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails
614
questions
1
vote
0answers
35 views
GPG - exported secret key with public too
I tried to export public key from my keyring. Then I imported my public key in another keyring. I find the private key too in the 2nd keyring and I can sign files from the 2nd keyring. Why is this ...
0
votes
0answers
48 views
Hardening GnuPG against brute force attacks
I am currently working on a python program that utilizes GnuPG (with symmetric encryption) to store data on the client: User supplies password, gpg file is decrypted, data is loaded, etc.
Say an ...
0
votes
2answers
100 views
Can I use Let's Encrypt to verify my signing key?
I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
7
votes
0answers
165 views
How to verify that Google's apt signing key change is not malicious?
I have an Ansible script that setup google chrome apt repo. I keep Google's signing key together with the scripts (rather than download it every time) because I think it minimizes the chance of ...
0
votes
0answers
28 views
changing passphrase on gpg subkey
Is it possible to change passphrase on a subkey by:
gpg --edit-key sub_key_id passwd
Or will this change the passphrase on the master key as well?
(My idea stems from the fact that master key is ...
2
votes
0answers
56 views
Why does GPG --recipient only pick one (arbitrary) key for identical names, instead of all of them?
I have a recipient with four hardware keys (HKs) that they use interchangeably. These HKs contain different GPG keys that have all been generated inside and have never left the HKs, thus resulting in ...
0
votes
0answers
22 views
Web of trust and signature types? (sig1, sig2, etc)
I have read about The OpenPGP trust model but I don't see any mention of the specific signature types. Are all signature types (sig0 - sig3) treated the same by tools such as gpg or the PGP ...
0
votes
0answers
23 views
How to list signatures of public key file without importing it to keyring?
How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available.
I would like a similar output to gpg --list-signatures <key-id>, but ...
1
vote
1answer
154 views
Is it possible to sign a DVD?
I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an ...
10
votes
1answer
331 views
What gpg defaults can be improved, when performance is not an issue?
gpg has some preset default settings, which I assume were selected as a compromise between speed and security. I understand that these are good enough for most people.
But, in a situation where speed ...
2
votes
1answer
43 views
Is all metadata necessary for decryption included in a symmetrically encrypted GNU Privacy Guard message?
Suppose I symmetrically encrypt a file with a passphrase using GNU Privacy Guard and send it to a friend. I use the latest version and all the defaults, so AES-128 encryption is used, with the salt ...
4
votes
1answer
118 views
What guarantees does GPG-signing a git commit provide?
It's pretty clear that GPG signing and GitHub ssh keys serve different purposes
But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
1
vote
0answers
35 views
Why GPG signature is not considered as made by a trusted key?
When I verify a file signature I get the the following warning:
$ gpg --verify file.sig
gpg: Signature made So 01 Dez 2019 10:08:27 CET
gpg: using RSA key <Pierre's key ID>
gpg: ...
0
votes
1answer
180 views
gpg2: How to get rid of “Please insert card with serial number”, getting the same key from a different card / Yubikey
I have multiple Yubikeys carrying the same GPG secret key. I want to switch from one Yubikey to anohter one on my laptop. The two obviously have different serial numbers.
After switching the keys ...
1
vote
1answer
213 views
Is it possible to decrypt a PGP encrypted file without private key?
I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data.
Recently, my colleagues told ...
4
votes
1answer
165 views
Which tool/key manager to manage people's public keys in organization?
I'm not really an expert on different key types but here it goes. My company never really managed keys. We have an SKS server that was set up to manage GPG keys for a couple of users sending encrypted ...
1
vote
0answers
59 views
How does a GPG Keyserver deal with conflicting signatures?
Part of the web of trust of GPG is the use of Keyservers to publish/distribute versions of public keys. It's encouraged of course to sign public keys you trust so the the web may grow.
How does a ...
0
votes
0answers
91 views
GPG — Synchronisation between machine and “No secret key” problem
I am running "pass: the standard unix password manager" v1.7.3 on Fedora 31.
I create a password for "mysite" via
$ pass generate mysite
It creates an entry in my .password-store folder: mysite....
0
votes
0answers
41 views
Is any key signing party directory - or a mean to facilitate such meetings, exists?
I need to develop my web of trust. I don't live in or near a metropolitan area and as such it is a bit difficult to find possible local people to sign. I assume I must not be alone in that context.
...
0
votes
0answers
50 views
On MacOS, gpg gives “random_seed file is empty” error after I ran out of space for an encryption process?
I tried to encrypt a file on MacOS with gpg, and it turns out that I did not have enough hard drive space to make it. Afterwards, it exited with an error:
gpg: can't write '/Users/myname/.gnupg/...
0
votes
1answer
117 views
Info about gpg setup on MacOS
On Mac OS Mojave:
▶ gpg --list-keys
Warning: Failed to set locale category LC_NUMERIC to en_GR.
Warning: Failed to set locale category LC_TIME to en_GR.
Warning: Failed to set locale category ...
1
vote
0answers
30 views
how to simulate gpg severkey DoS attack?
I tried to simulate this attack in my PC but I could not generate a poison key, I used Linux (Ubuntu 18.04) and GPG software (gpg (GnuPG) 2.2.4). I tried to manipulate public key and import it to ...
0
votes
0answers
74 views
How do I verify a signature by using a OpenPGP public key without User ID (Redacted User IDs)?
Background
Traditionally, in addition to cryptographic data, an OpenPGP public key contains User IDs and 3rd-party signatures for identification and Web-of-Trust verification, and it's distributed by ...
1
vote
1answer
71 views
Is it important to use separate GPG keys for signing Git commits and for SSH authentication?
When using GPG to sign Git commits, and as the SSH-agent, is it important to use separate sub-keys for the signing of the Git commits as it is for authentication with the SSH host of the Git server?
...
1
vote
0answers
30 views
How do I check if my key is updated in a keyserver after I resend it with new signatures?
I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures.
The thing is that when ...
2
votes
2answers
96 views
When gpg encrypt is called from the command line, how is a key chosen to do the encryption?
I am using GnuPG. When gpg encrypt is called from the command line, how is a key chosen to do the encryption? It appears to me that -r, or --recipient, supplies a user id and that is the simple answer....
1
vote
1answer
81 views
How to use GPG to pass along encrypted content and double encrypt [closed]
Say I have a document. I want to encrypt it, then give it to my friend, and I don't want them to be able to decrypt it. I want them to encrypt it again using their GPG system. Then to decrypt it my ...
2
votes
0answers
51 views
How do I properly encrypt a document with GPG2 on Mac?
Here is what I have done roughly, starting from scratch:
$ brew install gnupg
$ cat >foo <<EOF
Key-Type: RSA
Key-Length: 4096
Subkey-Type: RSA
Subkey-Length: 4096
Name-Real: ...
0
votes
1answer
22 views
gpg importing public key
I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
0
votes
1answer
46 views
How can I verify the trustworthiness of GPGTools?
Having a hard time verifying the trustworthiness of GPGTools. I really want to trust the project as it adds a lot of convenience on macOS, but can’t figure out if I can without spending a lot of time ...
1
vote
1answer
111 views
Why is Debian not showing the GPG signatures on keys that Arch Linux is?
I downloaded a Qubes OS ISO and I'm trying to verify its legitimacy using this guide. GPG was behaving weirdly, so I created a separate user with a separate keyring to reproduce the issue.
When I try ...
0
votes
1answer
33 views
Can I resubmit my GPG key to a keyserver?
I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
0
votes
1answer
656 views
GPG encryption failed - Unusable public key
I was trying to encrypt a file using a GPG public key.
It's working fine on my test server which is ubuntu 18.04 but when I try to use the same key on my production server (Amazon Linux) it failed ...
2
votes
3answers
224 views
Use RSA key to encrypt/decrypt personal document
Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
1
vote
1answer
138 views
How do i validate that a PGP Public Key the user inputs is valid?
we want to encrypt emails that we send to the user with his public key.
this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
0
votes
0answers
88 views
gpg won't find public key if not in interactive session
How to make imported public key available after logging off?
I have a Powershell process that encrypts the file (recipient was masked):
Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
0
votes
0answers
30 views
GPG keys generated with diceware entropy?
Considering the absolutely critical role that entropy plays in the generation of keys, I am wondering if there is an easy way to use diceware (true random numbers) to generate an OpenPGP key with ...
1
vote
1answer
828 views
Decrypt file using Key and Initialization Vector in Linux
I am Salesforce developer but new to the Security World as well as Linux. We encrypted a file with Key and initialization Vector in Salesforce(only symmetric encryption is possible in Salesforce). No ...
0
votes
1answer
81 views
secp256k1 GPG key?
Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
0
votes
0answers
72 views
What should I do next on my GPG key after my computer is seized by authority?
Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
0
votes
0answers
25 views
GnuPG verify signature *after/while* decrypting does not fail when it should
I'm encrypting and signing data with the PHP function gnupg_encryptsign() (docs) which has the strange behaviour of signing first and encrypting afterwards.
I'm aware of this thread saying this is ...
1
vote
1answer
70 views
What use does verifying a file with a signature downloaded from the same server have? [duplicate]
Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read:
"...
3
votes
1answer
288 views
GPG unattended ECC key and subkey generation
I want to generate an ECC key where the primary key is just for cert and has 3 subkeys for auth, sign, encrypt.
I've found 2 methods to generate it. But I want to use unattended key generation via
...
0
votes
1answer
112 views
Can a deleted PGP secret key be recovered from private-keys-v1.d directory?
Executing gpg -K --with-keygrip returns one key entry. However the private-keys-v1.d directory has two entries. I assume that one of them belongs to a secret key that has been deleted/removed.
Is ...
0
votes
0answers
55 views
create gpg public key from subkey
I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically.
For my communication ...
0
votes
1answer
157 views
Difference between OpenPGP symmetric encryption and AES-256?
I would like to understand the difference between:
OpenPGP symmetric encryption
and
AES-256 using Winzip/7-zip?
I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
0
votes
0answers
66 views
How is private key encrypted after export?
For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
1
vote
1answer
58 views
How can one read the time in GPG's Literal Data Packet?
RFC 4880 says that the Literal Data Packet's time stamp is four octets long. Listing packets shows that it is five octets long, at least in GnuPG 2.2.6.
The time stamp comes after the word "created", ...
0
votes
1answer
89 views
gpg: Every private key export (of the same key-pair) is different
gpg version: 2.2.16 (as part of Gpg4win 3.1.9).
Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
78 views
Can a new signature be added to an already signed message?
Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) ...
