Questions tagged [gnupg]
GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails
724
questions
0
votes
0
answers
17
views
why is gpg subkey getting a warning
I just begain studying how GPG works on Linux(Ubuntu20.04) and can't get my head around as why my subkey keeps getting a warning when encypting a file using the GPG command. I have also tried signing ...
0
votes
1
answer
44
views
Secure data (+ private key) storage in an insecure public cloud environment
We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure.
The data should be so secure ...
- 190
1
vote
1
answer
78
views
Can I add an email address to an existing GPG key?
Is it possible to add an email address to an existing GPG key? When I created a key using gpg --gen-key, I left the "Email address" field blank. Now I want to add an email address.
If I have ...
- 583
1
vote
2
answers
49
views
Can you use GPG to decrypt and encrypt with a different key in one step?
I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
- 11
0
votes
0
answers
51
views
Is there an extremely easy way to use SSH with an yubikey? [closed]
Using a yubikey for SSH is pretty difficult: https://github.com/drduh/YubiKey-Guide. I mean, I can totally understand every concept in the tutorial, but I'd like it to be very very simple. Just an ...
- 405
7
votes
1
answer
2k
views
How do GPG smart card devices handle large GPG operations?
How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.
My first 2 pet theories are:
There's some way to chunk up GPG operations or use some ...
- 73
0
votes
0
answers
46
views
PubKey decrypted differences when Sending an encrypted email via a bash script and when sending it via Thunderbird
This is a 2-part question.
When GnuPG is used externally in Thunderbird 91.7.x, i tested email encryption from Account A to Account A, the message was received perfectly encrypted and in the "...
0
votes
0
answers
293
views
Changing the encryption algorithm used for PGP/GPG private key
I've read a number of posts regarding changing the algorithm used to encrypt my private PGP keys. However, nothing I have tried seems to work. I am using gpg4win:
gpg (GnuPG) 2.3.4
libgcrypt 1.9.4
...
0
votes
0
answers
49
views
When using gpg2 to verify Qubes, the pub is different
I'm trying to verify the fingerprint of the Qubes Master signing Key (QMSK) however, I've run into some inconsistent output.
For example:
Qubes Os website & web of trust shows after executing the ...
0
votes
0
answers
80
views
Using GPG from another user (GNU/Linux)
I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output.
Added a sudo rule for user1 to ...
- 635
0
votes
0
answers
93
views
importing private key stub from piv card into gpg on another pc
Sorry for puzzling terminology, I'm very new to field and it's really hard to me to orient in these new things. (maybe, probably, there isn't 'private key stub' I just saw that term used somewhere, ...
- 101
0
votes
2
answers
124
views
Exact meaning of RSA key in `gpg --verify` output
When verifying a pgp signed message using GnuPG, one gets an output similar to the following:
gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg: using RSA key ...
0
votes
0
answers
85
views
GPG passphrase in the cache as a hash?
I understand that nowadays passwords are not stored in plaintext, only as password + salt and hashed (minimum). But I haven't found any exact confirmation that gpg does NOT store (cache, place in RAM) ...
- 635
0
votes
1
answer
67
views
What are the different combinations of public and private keys and what CIA do they provide?
I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
- 1
-1
votes
2
answers
95
views
PGP: how does the owner of a public key generate the fingerprint?
Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
0
votes
0
answers
35
views
Sharing public GPG key: be safe from DNS spoofing attacks [duplicate]
I am going to put a link to my GPG key in the signature of my e-mails.
This would be both a hyperlink in the form of
https://keyserver.ubuntu.com/pks/lookup?op=get&search=XXXXXX
and the command to ...
- 495
0
votes
0
answers
15
views
Publish public GPG key on GitHub [duplicate]
Is it safe to publish your public GPG keys on GitHub?
And link to them in the signature of the e-mails you send, together with the fingerprint after the link?
- 495
0
votes
1
answer
95
views
How do I import a private key from a hard copy?
I started playing with encrypting some personal files, and I exported the private key as an .asc file, but also on hard copy (plain paper) and can't understand a thing about how it says to import it ...
- 3
0
votes
0
answers
107
views
Could someone bypass a GPG key's expiration date by simply using that key on a computer with an incorrect system time?
I've heard it's good for security to have a shorter expiration time for GPG keys, but I'm still not clear on why that is exactly. Is the purpose of a GPG key mainly to inform the legitimate user that ...
3
votes
2
answers
180
views
How can I prove the content of a PGP-encrypted message to a third party?
Imagine this scenario
A StackExchange user sends you a PGP-encrypted message
You decrypt the message and discover that you are being blackmailed
You report the message to the admins but they are ...
- 33
1
vote
1
answer
110
views
How does one publish UID revocations in the age of Hagrid?
I have published my gpg key on keys.openpgp.org, keyserver.ubuntu.com, and my own WKDs corresponding to each of the two email addresses on my own domains.
Another user updated my public key from my ...
- 111
0
votes
0
answers
135
views
Almost unattended generation of "a pretty good keypair"
I need to generate quite a lot of gpg-keys for different tasks on my Debian Bullseye (Stable) machine. Also I want the highest level of security while being able to automate as much as possible.
...
- 11
1
vote
1
answer
430
views
Why does ECC not have an encrypt capability in GPG, but RSA does?
I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model.
Much of it is following guides which I believe are still considered best practices:
https://...
- 111
0
votes
1
answer
101
views
Keeping a whitelist of GPG keys on git server
Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B.
They ...
- 121
0
votes
1
answer
109
views
Is there a use for an MDC even when all messages are signed?
I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
- 547
0
votes
0
answers
108
views
Certbot installation from cloudfront.net epel-release mirror
I'm setting up a website on a Centos7 VPS with certbot and let's encrypt.
I am no expert on network security. I checked to see if my epel-release was pulling certbot from a legit mirror.
I ran yum ...
- 13
3
votes
0
answers
128
views
Move signing subkey to authentication slot on YubiKey (OpenPGP card)?
My PGP primary key is only used for certification—I use a separate subkey for signing. Like this:
sec rsa4096/0x891781D0EDC66456 ...
- 376
2
votes
2
answers
262
views
Why isn't there a protocol to exchange PGP keys?
Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters?
I imagine a quite simple process like other established ...
- 212
0
votes
0
answers
93
views
Using smart card for gnupg
I want to buy a smart card to store a gpg private key (I have never used any before).
However all options seem quite expensive. If you look for ISO 7816 in AliExpress there are much more affordable ...
- 101
1
vote
2
answers
140
views
How exposed is user data when running PINENTRY_USER_DATA="foo" gpg --change-pin?
When running PINENTRY_USER_DATA="foo" gpg --change-pin in bash, how easy is it for other processes to capture “foo”?
- 169
4
votes
1
answer
2k
views
Where are the symmetric keys stored?
I don't seem to find the option to save symmetric keys. What I want to do is that I simply want to encrypt a file and transfer the file and the symmetric key (which is encrypted with the recipients ...
2
votes
1
answer
481
views
AES256 - 7zip Vs GPG
I noticed that 7zip provides an option to encrypt the contents of a folder using AES256 (Screenshot Below) and so does GPG using this command:
gpgtar --output <Name_Of_The_Output_File> -v --...
- 606
0
votes
0
answers
59
views
Can GnuPg flag as invalid if it receives a key for a uid (the email) where the email is found on a keyserver, but not with that key?
I created a test key to share with someone for the purpose of debugging a client issue. However, I did not transmit that key to a key server, and it still uses my email. The key server locally that my ...
- 322
2
votes
1
answer
174
views
Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?
When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other ...
- 38.7k
3
votes
1
answer
488
views
GnuPG now uses ECC 25519 as default on new key generation - any compatibility issues to worry about?
TL;DR: I'm assuming that if GnuPG made it a default then it should be what we use, but it used "bad" defaults in the past so I'm wondering if there are any tradeoffs to this? More ...
- 33
0
votes
1
answer
138
views
AES-256 without key stretching
It is not so difficult to create a password which is exactly 32 characters long.
In this question - AES-256 Key Length Importance @Marc writes:
you absolutely should not be using a password as the ...
- 357
1
vote
0
answers
148
views
What are the best practices pertaining to signing your git commits on GitHub?
On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits.
However, in the scenario that the private key is exposed, the only option GitHub offers is ...
- 115
1
vote
0
answers
57
views
GPG - use cached key before prompting for other cards when multiple receivers?
When using gpg 2.2.28 & gpg-agent to decrypt a ciphertext that has been encrypted for (any one of) multiple 'receivers', the default behaviour is that it tries to find and use private keys in some ...
- 123
0
votes
1
answer
129
views
how does the certificate distributed by the CA work? [closed]
I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender.
How does it work?
Can you use simple and easily ...
2
votes
0
answers
138
views
avoiding plaintext on the hard drive
If you decrypt ciphertext to the terminal like this:
gpg --output - --armor --encrypt --recipient 23642351 message.txt.pgp
..does it touch the hard drive / ssd or only live in RAM?
What about when ...
- 357
1
vote
2
answers
352
views
Why am I able to decrypt the data I send using someone else's public key?
Sorry if this is more of a conceptual question. I was using GPG to send encrypted emails back and forth with a friend and I understand why I am able to decrypt the messages my friend sends me: because ...
- 123
1
vote
2
answers
191
views
How to handle a former employee's public GPG key?
In my keyring I have the public key of a former colleague. I have signed it, because I trusted that it was his key. I still do so, but the fact that he has left the company of course changes the ...
- 113
0
votes
1
answer
93
views
When changing a PGP passphrase, does it only affect the same key on the other machine?
If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B?
Will I still be able to use the PGP key on Computer B ...
- 113
0
votes
0
answers
37
views
OpenPGP: What happens if I have two keys on the same email and try to encrypt a message with that recipient? [duplicate]
Let's assume that I saved two OpenPGP keys(key1 and key2) on the email mail@mail.com.
What would happen if I try to encrypt a message with the following command:
gpg --encrypt --recipient mail@mail....
- 101
2
votes
0
answers
315
views
Is it possible to encrypt data with a GPG public key that doesn't have the encryption usage flag set?
I have received a public key that does not appear to have the encryption capability enabled:
> gpg --list-keys ...
- 190
1
vote
1
answer
262
views
Use local GPG key only as a backup when keycard is not available
My question is essentially the same as this one:
How to force GPG to use a Keycard when it is available
which asks how to force GPG to use a keycard when one is available. That question was asked in ...
- 146
1
vote
3
answers
279
views
Should I backup a GPG key used for Authentication?
Regarding backups (escrows) of GPG (OpenPGP compliant) keys, I seem to understand that (E)ncryption keys need to be backed up, to prevent data loss, and that (S)igning keys should not be backed up, ...
0
votes
0
answers
93
views
Finding information about GPG keys?
I once found out that I can do that here. But I recently tried to find information about:
$ gpg --search-key B188E2B695BD4743
gpg: data source: http://hkps.pool.sks-keyservers.net:11371
(1) DEB....
- 257
0
votes
1
answer
110
views
How to enumerate PGP keyring e-mails related to a specific ccTLD
I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp
Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
4
votes
1
answer
296
views
What metadata is exposed by OpenPGP?
Say I have a file encrypted with GnuPG, in isolation (i.e., I don’t have the relevant keys). Can one then establish the recipients of the encryption? That is:
Name/E-Mail/Comment
Key ID
Or is this ...
- 143