Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

why is gpg subkey getting a warning

I just begain studying how GPG works on Linux(Ubuntu20.04) and can't get my head around as why my subkey keeps getting a warning when encypting a file using the GPG command. I have also tried signing ...
user avatar
0 votes
1 answer
44 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
user avatar
  • 190
1 vote
1 answer
78 views

Can I add an email address to an existing GPG key?

Is it possible to add an email address to an existing GPG key? When I created a key using gpg --gen-key, I left the "Email address" field blank. Now I want to add an email address. If I have ...
user avatar
  • 583
1 vote
2 answers
49 views

Can you use GPG to decrypt and encrypt with a different key in one step?

I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
user avatar
0 votes
0 answers
51 views

Is there an extremely easy way to use SSH with an yubikey? [closed]

Using a yubikey for SSH is pretty difficult: https://github.com/drduh/YubiKey-Guide. I mean, I can totally understand every concept in the tutorial, but I'd like it to be very very simple. Just an ...
user avatar
7 votes
1 answer
2k views

How do GPG smart card devices handle large GPG operations?

How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs. My first 2 pet theories are: There's some way to chunk up GPG operations or use some ...
user avatar
0 votes
0 answers
46 views

PubKey decrypted differences when Sending an encrypted email via a bash script and when sending it via Thunderbird

This is a 2-part question. When GnuPG is used externally in Thunderbird 91.7.x, i tested email encryption from Account A to Account A, the message was received perfectly encrypted and in the "...
user avatar
0 votes
0 answers
293 views

Changing the encryption algorithm used for PGP/GPG private key

I've read a number of posts regarding changing the algorithm used to encrypt my private PGP keys. However, nothing I have tried seems to work. I am using gpg4win: gpg (GnuPG) 2.3.4 libgcrypt 1.9.4 ...
user avatar
0 votes
0 answers
49 views

When using gpg2 to verify Qubes, the pub is different

I'm trying to verify the fingerprint of the Qubes Master signing Key (QMSK) however, I've run into some inconsistent output. For example: Qubes Os website & web of trust shows after executing the ...
user avatar
0 votes
0 answers
80 views

Using GPG from another user (GNU/Linux)

I want to use gpg from another user (user2), so that the primary user (user1) does not have access to the encrypted file, but only to the part the script will output. Added a sudo rule for user1 to ...
user avatar
  • 635
0 votes
0 answers
93 views

importing private key stub from piv card into gpg on another pc

Sorry for puzzling terminology, I'm very new to field and it's really hard to me to orient in these new things. (maybe, probably, there isn't 'private key stub' I just saw that term used somewhere, ...
user avatar
0 votes
2 answers
124 views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
user avatar
0 votes
0 answers
85 views

GPG passphrase in the cache as a hash?

I understand that nowadays passwords are not stored in plaintext, only as password + salt and hashed (minimum). But I haven't found any exact confirmation that gpg does NOT store (cache, place in RAM) ...
user avatar
  • 635
0 votes
1 answer
67 views

What are the different combinations of public and private keys and what CIA do they provide?

I am preparing for the Sec+, currently reading the book, "Mike Meyers .... Certification Passport"(book in question is irrelevant to the problem), In the cryptography chapter, topic-public ...
user avatar
  • 1
-1 votes
2 answers
95 views

PGP: how does the owner of a public key generate the fingerprint?

Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
user avatar
0 votes
0 answers
35 views

Sharing public GPG key: be safe from DNS spoofing attacks [duplicate]

I am going to put a link to my GPG key in the signature of my e-mails. This would be both a hyperlink in the form of https://keyserver.ubuntu.com/pks/lookup?op=get&search=XXXXXX and the command to ...
user avatar
0 votes
0 answers
15 views

Publish public GPG key on GitHub [duplicate]

Is it safe to publish your public GPG keys on GitHub? And link to them in the signature of the e-mails you send, together with the fingerprint after the link?
user avatar
0 votes
1 answer
95 views

How do I import a private key from a hard copy?

I started playing with encrypting some personal files, and I exported the private key as an .asc file, but also on hard copy (plain paper) and can't understand a thing about how it says to import it ...
user avatar
  • 3
0 votes
0 answers
107 views

Could someone bypass a GPG key's expiration date by simply using that key on a computer with an incorrect system time?

I've heard it's good for security to have a shorter expiration time for GPG keys, but I'm still not clear on why that is exactly. Is the purpose of a GPG key mainly to inform the legitimate user that ...
user avatar
3 votes
2 answers
180 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
user avatar
  • 33
1 vote
1 answer
110 views

How does one publish UID revocations in the age of Hagrid?

I have published my gpg key on keys.openpgp.org, keyserver.ubuntu.com, and my own WKDs corresponding to each of the two email addresses on my own domains. Another user updated my public key from my ...
user avatar
  • 111
0 votes
0 answers
135 views

Almost unattended generation of "a pretty good keypair"

I need to generate quite a lot of gpg-keys for different tasks on my Debian Bullseye (Stable) machine. Also I want the highest level of security while being able to automate as much as possible. ...
user avatar
1 vote
1 answer
430 views

Why does ECC not have an encrypt capability in GPG, but RSA does?

I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model. Much of it is following guides which I believe are still considered best practices: https://...
user avatar
  • 111
0 votes
1 answer
101 views

Keeping a whitelist of GPG keys on git server

Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B. They ...
user avatar
  • 121
0 votes
1 answer
109 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
user avatar
  • 547
0 votes
0 answers
108 views

Certbot installation from cloudfront.net epel-release mirror

I'm setting up a website on a Centos7 VPS with certbot and let's encrypt. I am no expert on network security. I checked to see if my epel-release was pulling certbot from a legit mirror. I ran yum ...
user avatar
  • 13
3 votes
0 answers
128 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
user avatar
2 votes
2 answers
262 views

Why isn't there a protocol to exchange PGP keys?

Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters? I imagine a quite simple process like other established ...
user avatar
  • 212
0 votes
0 answers
93 views

Using smart card for gnupg

I want to buy a smart card to store a gpg private key (I have never used any before). However all options seem quite expensive. If you look for ISO 7816 in AliExpress there are much more affordable ...
user avatar
1 vote
2 answers
140 views

How exposed is user data when running PINENTRY_USER_DATA="foo" gpg --change-pin?

When running PINENTRY_USER_DATA="foo" gpg --change-pin in bash, how easy is it for other processes to capture “foo”?
user avatar
4 votes
1 answer
2k views

Where are the symmetric keys stored?

I don't seem to find the option to save symmetric keys. What I want to do is that I simply want to encrypt a file and transfer the file and the symmetric key (which is encrypted with the recipients ...
user avatar
2 votes
1 answer
481 views

AES256 - 7zip Vs GPG

I noticed that 7zip provides an option to encrypt the contents of a folder using AES256 (Screenshot Below) and so does GPG using this command: gpgtar --output <Name_Of_The_Output_File> -v --...
user avatar
  • 606
0 votes
0 answers
59 views

Can GnuPg flag as invalid if it receives a key for a uid (the email) where the email is found on a keyserver, but not with that key?

I created a test key to share with someone for the purpose of debugging a client issue. However, I did not transmit that key to a key server, and it still uses my email. The key server locally that my ...
user avatar
2 votes
1 answer
174 views

Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?

When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other ...
user avatar
  • 38.7k
3 votes
1 answer
488 views

GnuPG now uses ECC 25519 as default on new key generation - any compatibility issues to worry about?

TL;DR: I'm assuming that if GnuPG made it a default then it should be what we use, but it used "bad" defaults in the past so I'm wondering if there are any tradeoffs to this? More ...
user avatar
  • 33
0 votes
1 answer
138 views

AES-256 without key stretching

It is not so difficult to create a password which is exactly 32 characters long. In this question - AES-256 Key Length Importance @Marc writes: you absolutely should not be using a password as the ...
user avatar
  • 357
1 vote
0 answers
148 views

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
user avatar
  • 115
1 vote
0 answers
57 views

GPG - use cached key before prompting for other cards when multiple receivers?

When using gpg 2.2.28 & gpg-agent to decrypt a ciphertext that has been encrypted for (any one of) multiple 'receivers', the default behaviour is that it tries to find and use private keys in some ...
user avatar
  • 123
0 votes
1 answer
129 views

how does the certificate distributed by the CA work? [closed]

I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender. How does it work? Can you use simple and easily ...
user avatar
2 votes
0 answers
138 views

avoiding plaintext on the hard drive

If you decrypt ciphertext to the terminal like this: gpg --output - --armor --encrypt --recipient 23642351 message.txt.pgp ..does it touch the hard drive / ssd or only live in RAM? What about when ...
user avatar
  • 357
1 vote
2 answers
352 views

Why am I able to decrypt the data I send using someone else's public key?

Sorry if this is more of a conceptual question. I was using GPG to send encrypted emails back and forth with a friend and I understand why I am able to decrypt the messages my friend sends me: because ...
user avatar
  • 123
1 vote
2 answers
191 views

How to handle a former employee's public GPG key?

In my keyring I have the public key of a former colleague. I have signed it, because I trusted that it was his key. I still do so, but the fact that he has left the company of course changes the ...
user avatar
0 votes
1 answer
93 views

When changing a PGP passphrase, does it only affect the same key on the other machine?

If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B? Will I still be able to use the PGP key on Computer B ...
user avatar
  • 113
0 votes
0 answers
37 views

OpenPGP: What happens if I have two keys on the same email and try to encrypt a message with that recipient? [duplicate]

Let's assume that I saved two OpenPGP keys(key1 and key2) on the email mail@mail.com. What would happen if I try to encrypt a message with the following command: gpg --encrypt --recipient mail@mail....
user avatar
  • 101
2 votes
0 answers
315 views

Is it possible to encrypt data with a GPG public key that doesn't have the encryption usage flag set?

I have received a public key that does not appear to have the encryption capability enabled: > gpg --list-keys ...
user avatar
  • 190
1 vote
1 answer
262 views

Use local GPG key only as a backup when keycard is not available

My question is essentially the same as this one: How to force GPG to use a Keycard when it is available which asks how to force GPG to use a keycard when one is available. That question was asked in ...
user avatar
  • 146
1 vote
3 answers
279 views

Should I backup a GPG key used for Authentication?

Regarding backups (escrows) of GPG (OpenPGP compliant) keys, I seem to understand that (E)ncryption keys need to be backed up, to prevent data loss, and that (S)igning keys should not be backed up, ...
user avatar
0 votes
0 answers
93 views

Finding information about GPG keys?

I once found out that I can do that here. But I recently tried to find information about: $ gpg --search-key B188E2B695BD4743 gpg: data source: http://hkps.pool.sks-keyservers.net:11371 (1) DEB....
user avatar
  • 257
0 votes
1 answer
110 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
user avatar
4 votes
1 answer
296 views

What metadata is exposed by OpenPGP?

Say I have a file encrypted with GnuPG, in isolation (i.e., I don’t have the relevant keys). Can one then establish the recipients of the encryption? That is: Name/E-Mail/Comment Key ID Or is this ...
user avatar

1
2 3 4 5
15