Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
1 vote
0 answers
16 views

Set a default GPG key id for email

If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to? and ditto encrypt from/with, ...
Sandra's user avatar
  • 111
0 votes
0 answers
15 views

Using Gnupg with either a smartcard key or a local key

I added a second signing subkey to my GPG key, which I then moved to a Yubikey: /home/user/.gnupg/pubring.kbx ---------------------------- sec# ed25519/ABCDECAD 2023-11-12 [SC] ...(fingerprint ...
j0057's user avatar
  • 101
3 votes
1 answer
268 views

What exactly is the security model of pass?

Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key. I'm confused at how this is considered secure. The GPG key has a passphrase ...
gomennathan's user avatar
1 vote
0 answers
43 views

Why does GPG seem to parse the whole encrypted file when it can't find the decryption key?

You can try this one for yourself... Generate a new GPG keypair. Create a large junk file. Maybe 5G or 10G in size. Encrypt the file and use the new key as the recipient. Delete the privkey which ...
bitofagoob's user avatar
1 vote
0 answers
22 views

Restricting ubuntu signing keys?

I started reading on apt and the security changes to always use GPG signing keys, but further saw that it by default uses all configured GPG signing keys, this seems like a small but unecessary ...
Xavanteex's user avatar
0 votes
0 answers
42 views

What is the best way to encrypt asymmetric metadata?

As a hobby project I'm thinking about how to write a secure chat where even all metadata are encrypted so that it is impossible to leak any (meta) information by design. My basic idea is right now: ...
rekire's user avatar
  • 133
1 vote
1 answer
66 views

Prove The Identity of Author Using GPG On Demand

Given a situation where I want to be anonymous by default, how can I use GPG to prove that I'm the original author once, on-demand, and for a specific user?
SReza S's user avatar
  • 13
0 votes
1 answer
31 views

Preference of private keys when selecting by UID

I have two private keys with the same UIDs in GnuPG, and would like to use the newer one in preference to the older. When no key is specified, the default-key option takes care of this, but several of ...
Simon Richter's user avatar
4 votes
1 answer
128 views

GPG allows importing an invalid secp256k1 public key

I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
Andreas Tzionis's user avatar
0 votes
0 answers
87 views

How does user activity affect entropy generation process in GnuPG?

Earlier today, I was using gpg to generate keys for work. While doing so, I noticed: We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, ...
Rahul Dixit's user avatar
0 votes
2 answers
343 views

Backup GPG private key in KeePassXC

In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field. Provided that the db file has very good password, is this ...
robertspierre's user avatar
0 votes
1 answer
256 views

Is it possible to distinguish the binary content of a gpg-encrypted file from a random blob of data?

I have encrypted the file some_file to be decipherable by some_recipient with: gpg --encrypt --recipient some_recipient some_file Which results in a file some_file.gpg. My question is: is the content ...
Zorglub29's user avatar
  • 297
1 vote
2 answers
125 views

What's the shortest message you need to claim ownership of another message?

Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following. The hash/ characteristic string is compact enough (ideally a few ...
Boson Bear's user avatar
0 votes
1 answer
255 views

How can I decrypt a text file with gpg?

I want to decrypt a text file (which happens to be an Electrum wallet file) with gpg but I get the error gpg: no valid OpenPGP data found. I have done a quick test by encrypting a small text file and ...
Dan's user avatar
  • 165
2 votes
0 answers
70 views

How to figure out what is requesting access to my yubikey?

I recently set up two yubikeys based on this guide. I also set it up so gpg-agent is my ssh-agent, so I can use the keys for ssh. For some reason, even without me taking any action after plugging in ...
fbence's user avatar
  • 121
1 vote
0 answers
101 views

Why does the fingerprint of a GPG key change after it is made a sub key?

I recently consolidated some of my independently GPG keys. I used the following the command to edit the oldest key gpg --expert --edit-key <oldest-keygrip> gpg> add-key --keygrip=<another-...
ksinkar's user avatar
  • 111
0 votes
2 answers
393 views

Keys vs Certificate & x509 vs GPG

I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG. Where I get lost is how the certificate comes into play and what ...
Arthae's user avatar
  • 3
2 votes
1 answer
811 views

How to provide public key for security.txt?

When generating a security.txt file, it is recommended to digitally sign it. However, security researchers must not assume that the information used in the Encryption field is actually the key used to ...
kolumbus's user avatar
0 votes
0 answers
95 views

GPG2 imported SSH `ecdsa-sha2-nistp256` key can't be set to [Authenticate]

I've imported my existing keys into GnuPG agent (gpg2) using ssh-add and now trying to register them as subkeys of my primary GPG key as outlined in https://opensource.com/article/19/4/gpg-subkeys-ssh....
AnrDaemon's user avatar
  • 101
1 vote
0 answers
230 views

SSH authentication with GPG failing with a new Yubikey with the same gpg keys as the old one

I have a MacBook M1 on which I have been using a Yubikey 5 to authenticate SSH logins to various systems. I recently got a Yubikey 5C so I wouldn't have to use adapters. I moved my keys over to it ...
user28598's user avatar
1 vote
0 answers
44 views

`sig` lines in my GPG key, what are they for, and how to remove?

In this GPG key of mine, there I can see lines: sig sig 4311d0fb042cb88f 2019-03-08T17:59:45Z ____________________ ____________________ [selfsig] sig sig 4311d0fb042cb88f 2019-03-08T17:59:45Z ...
Vlastimil Burián's user avatar
0 votes
0 answers
326 views

Using Yubico Yubikey 5 NFC with NFC in Windows 10

I need to use NFC to run Yubikey, which is running on a USB connection. However, when I try to do so, I get the following error: GPG: > gpg --card-status gpg: selecting card failed: No such device ...
Peyang's user avatar
  • 1
1 vote
3 answers
658 views

Which one is safer for persistent online data? Gpg per file encryption vs gpg encrypted image vs LUKS2 image

3 people need to share some data through cloud. The total amount of data is small (<5gb in total). The update rate is very low, 1 per month. The cloud has very limited security measures so we ...
Wang's user avatar
  • 131
0 votes
2 answers
181 views

gpg -c "file" > when I double click on the file, it is decrypted automatically without asking for a pwd

I used gpg -c filename ... and when I double click on the file, it just decrypts it without asking for a password. I don't know, it feels like the file wasn't encrypted at all. What did I do wrong? Or ...
Fukai Mizumi's user avatar
1 vote
1 answer
48 views

How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?

I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party ...
Murch's user avatar
  • 131
1 vote
0 answers
247 views

Which PGP fingerprint to share/publish as my digital identity?

The primary secret key should be stored offline and only be used for creating/signing keys. There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
fooness's user avatar
  • 11
1 vote
0 answers
98 views

Using GPG is there a way to label public keys on my OpenPGP keyring?

I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
A H's user avatar
  • 11
1 vote
1 answer
492 views

ed25519-sk vs. gpg-agent on Yubikey

According to my understanding of this document, Yubikey is capable of running ed25519-sk and gpg-agent. Which one is more secure? Obviously, ed25519-sk wouldn't work, if the SSH server is old, but ...
Thomas G. Lau's user avatar
2 votes
1 answer
3k views

What are the security implications of using GPG instead of SSH keys for authentication

I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
SomethingSomething's user avatar
0 votes
1 answer
305 views

Get GPG signature without decryption

I use GPG on awsLinux, currently version 2.0.22. Before exchanging a file with someone we exchange public keys, so signatures can be confirmed for the files transmitted. Their public key is imported ...
RunThor's user avatar
  • 103
0 votes
1 answer
262 views

Do git commit signatures reveal key uid if different from git email?

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
ahmedsabriz's user avatar
1 vote
2 answers
158 views

How to securely use `pass`, `sudo`, and `npm` on the same machine

TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store. I use pass as a password manager, on Linux. And like probably all Linux users, I ...
Zwyx's user avatar
  • 113
0 votes
0 answers
125 views

PGP public key flagged as malicious to root. Was ran before

Hello I had used this pgp public key on my win10 OS with pgptool to message someone. Then when i used that same public key in whonix OS console it came back with some type of warning about malicious ...
jowblow's user avatar
2 votes
2 answers
337 views

Is it secure to post a password-secured .asc file in public?

Using GPG, I have created a key pair. I clicked on "Protect the generated key with a passphrase". I have created a .asc file to backup this key pair. Is it safe to publish this .asc file in ...
J Eti's user avatar
  • 23
0 votes
1 answer
107 views

GnuPG: gpa.exe hangs when I click on "smartcards" AND scdaemon cannot recognise SC-HSM 4K

https://dev.gnupg.org/T6097 I am trying to get GnuPG to work with my SmartCard-HSM 4K on Windows, using the GP4Win bundle. Kleopatra doesn't recognise the SC-HSM 4K at all, even though, it does ...
ARGYROU MINAS's user avatar
0 votes
0 answers
39 views

Changing encryption scheme utilized in GNU Privacy Guard (GPG)

I am currently trying to implement my own cryptographic IBE scheme within GPG. I understand that rolling one's own crypto is frowned upon, yet, this is for research purposes only. Is there an easy ...
Ezequiel's user avatar
3 votes
0 answers
300 views

Best practices for GPG user ids and mail extensions / catch-all addresses

Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
Felix Stupp's user avatar
0 votes
1 answer
468 views

How to generate an expired key with gpg?

For testing purposes, I need a PGP key for a specific uid that has already expired. Using gpg --full-generate-key only gives me the following options: Please specify how long the key should be valid. ...
not2savvy's user avatar
  • 752
1 vote
1 answer
90 views

can these encryption methods for a text file protect against physical access to machine by adversary?

My threat model is that, the adversary has physical access to the machine and root access. I don't care about any data on the system other than a couple python scripts that contain sensitive ...
an0nhi11's user avatar
0 votes
1 answer
316 views

deleted a subkey and can now no longer decrypt

My public key had expired so I tried to edit the expiry date with gpg --edit-key It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
cardamom's user avatar
  • 379
1 vote
1 answer
785 views

How to fix import private key in GPG?

Since, I am new to gpg I wanted to generate a key pair. So I typed gpg --full-gen-key and inputted the following: root@kali-linux:~# gpg --full-gen-key gpg (GnuPG) 2.2.35; Copyright (C) 2022 g10 Code ...
Machinexa's user avatar
  • 111
1 vote
3 answers
125 views

Is it normal, that some companies just sign the txt file which contains the sha value of the program?

Scenario A: Suppose I have an .exe file, the provider offers a sha1 txt file with hash value and this txt file is gpg signed. So I check if the hash value matches the exe file and then download the ...
iwab's user avatar
  • 181
2 votes
1 answer
628 views

Best practices for verifying authenticity of public key

When one desires to share their public key openly, besides sharing just the key itself: How does one verify that the key belongs to who it claims to be owned by? What is the use case of the key's ...
a79ce734e1's user avatar
2 votes
1 answer
378 views

Why a public key must be signed with its private pair in PGP

I know about the trust web in PGP. When you sign a key, everybody that trusts you will trust the person with that key. But what is the point of self-signing a key when anybody else can do that with ...
Fish_n_Chips's user avatar
3 votes
1 answer
139 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
Turysaz's user avatar
  • 33
2 votes
0 answers
667 views

Can't sign commit with yubikey, GPG missing something

I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got: gpg --list-keys /home/lz/.gnupg/pubring.kbx ----------...
Rafaelo's user avatar
  • 31
1 vote
1 answer
531 views

Sub-key or new key-pair? (PGP/GPG Newbie)

I saw a PGP/GPG key of a dude on the internet with different sub-keys. The reason is that when one sub-key expires, he creates a new one. Now, from a security protective, is it better to create a new ...
The Bad One's user avatar
3 votes
1 answer
625 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
J Atkin's user avatar
  • 131
1 vote
1 answer
252 views

why is gpg subkey getting a warning

I just begain studying how GPG works on Linux(Ubuntu20.04) and can't get my head around as why my subkey keeps getting a warning when encypting a file using the GPG command. I have also tried signing ...
Madara Uchiha's user avatar
0 votes
2 answers
126 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
Munchkin's user avatar
  • 244

1
2 3 4 5
16