Questions tagged [gnupg]
GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails
785
questions
0
votes
1
answer
87
views
Passing password through terminal when using pass + gpg
I'm planning to use the pass to store passwords for a web service. My service will need to store passwords for many database servers. So my idea is store these passwords with the Linux pass command. I ...
- 3
0
votes
0
answers
10
views
What is the point of a gpg file alongside the hash of a Linux ISO download? [duplicate]
I use linux and tend to distro hop a lot. I've noticed often that the distributions offer that you verify the download with a sha256sum hash and a GPG key.
My understanding is that a file, e.g. a ...
- 1
1
vote
1
answer
76
views
Restructure PGP Keys
How do I restructure my keys from current/old setup to new setup?
The new setup would allow better key-management: isolation of primary-key and rotation of sub-keys.
Current/Old Setup:
PrimaryKey - CS
...
- 31
1
vote
0
answers
76
views
How to verify the downloaded Mozilla Firefox binary? [duplicate]
I'm wondering about the correct steps when you want to download Firefox from their server and validate it has not been tampered with.
Assume you download the latest Firefox tar-bz2-package from https:/...
- 147
1
vote
1
answer
561
views
Now that `sshcontrol` has been deprecated, how to use gpg key for ssh authentication with an agent?
The GnuPG Manual states that:
This [sshcontrol] file is deprecated in favor of the "Use-for-ssh"
attribute in the key files.
What is now the correct way to configure gpg / gpg-agent to use ...
- 133
0
votes
0
answers
47
views
Types of certificate? [duplicate]
What types of certificates are there?
I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
- 127
0
votes
1
answer
182
views
Launch a process with secrets as environment variables
I have a process that needs secret keys to be passed as environment variables. That is for historical reasons.
I have a AWS machine where this process runs but I do not want to store these keys in ...
- 103
0
votes
2
answers
80
views
gpg security on a shared Linux machine
AFAIK, the few ways private information from gpg can get leaked to other users on a shared Linux machine is:
someone with root access can access gpg's files
someone with root access can access gpg's ...
- 29
1
vote
1
answer
215
views
GnuPG (gpg) specify multiple keyservers
Specifying multiple keyservers doesn't seem to work correctly, and gpg always uses just the first key server. I have the following two lines in my dirmngr.conf:
keyserver hkps://keys.openpgp.org
...
- 29
1
vote
1
answer
134
views
GPG deleted key/disassociation
I had a key that I accidentally deleted from the keyring a while ago and I'd like to dissociate my name from it. I still have the key as well as the revocation certificate. I made another keypair ...
1
vote
1
answer
556
views
GPG can't decrypt my data because of an invalid packet
I have an encrypted data containig some of my data that I am unable to decrypt. It is archived with tar, compressed with gzip and encrypted with gnupg. Today I tried to decrypt it with gpg and it ...
- 111
0
votes
1
answer
64
views
Does gpg support storing public keys in encrypted state?
I know this might sound counter-intuitive, but is it possible to configure gpg to store public keys in encrypted state on disks? Such that when encrypting a message to someone, user would be asked to ...
- 29
0
votes
0
answers
22
views
How to recover my password from my file.key [duplicate]
I don't remember my passphrase for my PGP key that was created several years ago.
How can I decrypt my file.key to recover it?
Or what should I do to recover it from my file.key?
0
votes
1
answer
350
views
Convert PGP key to X.509?
Can I convert a PGP key to X.509, using OpenSSL or GNUPG?
Aren't these only container/wrapper formats?
- 1,783
4
votes
1
answer
861
views
Should one really disable AEAD for recent GnuPG created PGP keys?
Apparently, there are some problems with the new defaults that are set when one creates a PGP key using a recent version of GnuPG (2.4).
I ran into this after generating a new ECC/ED25519 key to ...
- 143
1
vote
1
answer
473
views
Safe usage of bitaddress.org
I want to use bitaddress.org to create a wallet. Can you please verify my approach?
Change the password of my router and wifi and unplug all devices from the network except my notebook.
Go to https:/...
- 113
0
votes
0
answers
62
views
Whonix Linux Installer bash script signature verification failure
I am verifying the Whonix Linux Installer bash script.
I imported the GPG key first following the instructions from the wiki using the Debian procedure.
I could successfully verify the Virtualbox ...
- 1
3
votes
1
answer
674
views
PGP expired encryption subkey : renew or replace?
I am in the process of learning PGP (GnuPG more precisely).
I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
- 133
1
vote
0
answers
65
views
Is a revocation certificate still valid after updating GPG key's expiration?
When I first generated my GPG key I created a revocation certificate for it as well. Now I've edited my key and its subkeys and updated their expiration. Do I need to generate a new revocation ...
- 78
0
votes
0
answers
117
views
Why doesn't file/folder encryption work the way I imagine it should? Can I have the UX I want? Tell me what's wrong with this idea
I have been looking around at various encryption schemes, and I haven't found anything exactly like what I want in terms of user experience.
If what I want isn't a thing, I assume it's been thought of,...
- 101
1
vote
0
answers
131
views
Set a default GPG key id for email
If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to?
and ditto encrypt from/with, ...
- 111
0
votes
0
answers
86
views
Using Gnupg with either a smartcard key or a local key
I added a second signing subkey to my GPG key, which I then moved to a Yubikey:
/home/user/.gnupg/pubring.kbx
----------------------------
sec# ed25519/ABCDECAD 2023-11-12 [SC]
...(fingerprint ...
- 101
3
votes
1
answer
401
views
What exactly is the security model of pass?
Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key.
I'm confused at how this is considered secure. The GPG key has a passphrase ...
- 181
1
vote
0
answers
104
views
Why does GPG seem to parse the whole encrypted file when it can't find the decryption key?
You can try this one for yourself...
Generate a new GPG keypair.
Create a large junk file. Maybe 5G or 10G in size.
Encrypt the file and use the new key as the recipient.
Delete the privkey which ...
- 345
1
vote
0
answers
68
views
Restricting ubuntu signing keys?
I started reading on apt and the security changes to always use GPG signing keys,
but further saw that it by default uses all configured GPG signing keys,
this seems like a small but unecessary ...
- 23
0
votes
0
answers
99
views
What is the best way to encrypt asymmetric metadata?
As a hobby project I'm thinking about how to write a secure chat where even all metadata are encrypted so that it is impossible to leak any (meta) information by design.
My basic idea is right now:
...
- 133
1
vote
1
answer
141
views
Prove The Identity of Author Using GPG On Demand
Given a situation where I want to be anonymous by default, how can I use GPG to prove that I'm the original author once, on-demand, and for a specific user?
- 13
0
votes
1
answer
105
views
Preference of private keys when selecting by UID
I have two private keys with the same UIDs in GnuPG, and would like to use the newer one in preference to the older.
When no key is specified, the default-key option takes care of this, but several of ...
- 1,532
4
votes
1
answer
225
views
GPG allows importing an invalid secp256k1 public key
I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
- 143
0
votes
2
answers
1k
views
Backup GPG private key in KeePassXC
In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field.
Provided that the db file has very good password, is this ...
- 529
0
votes
1
answer
750
views
Is it possible to distinguish the binary content of a gpg-encrypted file from a random blob of data?
I have encrypted the file some_file to be decipherable by some_recipient with:
gpg --encrypt --recipient some_recipient some_file
Which results in a file some_file.gpg.
My question is: is the content ...
- 317
1
vote
2
answers
180
views
What's the shortest message you need to claim ownership of another message?
Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following.
The hash/ characteristic string is compact enough (ideally a few ...
- 121
0
votes
1
answer
516
views
How can I decrypt a text file with gpg?
I want to decrypt a text file (which happens to be an Electrum wallet file) with gpg but I get the error gpg: no valid OpenPGP data found.
I have done a quick test by encrypting a small text file and ...
- 165
2
votes
0
answers
125
views
How to figure out what is requesting access to my yubikey?
I recently set up two yubikeys based on this guide. I also set it up so gpg-agent is my ssh-agent, so I can use the keys for ssh. For some reason, even without me taking any action after plugging in ...
- 121
1
vote
0
answers
223
views
Why does the fingerprint of a GPG key change after it is made a sub key?
I recently consolidated some of my independently GPG keys.
I used the following the command to edit the oldest key
gpg --expert --edit-key <oldest-keygrip>
gpg> add-key --keygrip=<another-...
- 111
1
vote
2
answers
1k
views
Keys vs Certificate & x509 vs GPG
I understand a fair bit about keys in regards to what the private key does, and the public key for technologies such as PIV and GPG.
Where I get lost is how the certificate comes into play and what ...
- 13
3
votes
1
answer
2k
views
How to provide public key for security.txt?
When generating a security.txt file, it is recommended to digitally sign it.
However, security researchers must not assume that the information used in the Encryption field is actually the key used to ...
- 31
0
votes
0
answers
193
views
GPG2 imported SSH `ecdsa-sha2-nistp256` key can't be set to [Authenticate]
I've imported my existing keys into GnuPG agent (gpg2) using ssh-add and now trying to register them as subkeys of my primary GPG key as outlined in https://opensource.com/article/19/4/gpg-subkeys-ssh....
- 101
1
vote
0
answers
520
views
SSH authentication with GPG failing with a new Yubikey with the same gpg keys as the old one
I have a MacBook M1 on which I have been using a Yubikey 5 to authenticate SSH logins to various systems. I recently got a Yubikey 5C so I wouldn't have to use adapters. I moved my keys over to it ...
- 11
1
vote
0
answers
100
views
`sig` lines in my GPG key, what are they for, and how to remove?
In this GPG key of mine, there I can see lines:
sig sig 4311d0fb042cb88f 2019-03-08T17:59:45Z ____________________ ____________________ [selfsig]
sig sig 4311d0fb042cb88f 2019-03-08T17:59:45Z ...
- 1,727
1
vote
3
answers
1k
views
Which one is safer for persistent online data? Gpg per file encryption vs gpg encrypted image vs LUKS2 image
3 people need to share some data through cloud. The total amount of data is small (<5gb in total). The update rate is very low, 1 per month. The cloud has very limited security measures so we ...
- 138
0
votes
2
answers
268
views
gpg -c "file" > when I double click on the file, it is decrypted automatically without asking for a pwd
I used gpg -c filename ... and when I double click on the file, it just decrypts it without asking for a password. I don't know, it feels like the file wasn't encrypted at all. What did I do wrong? Or ...
anon
1
vote
1
answer
106
views
How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?
I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party ...
- 131
1
vote
0
answers
393
views
Which PGP fingerprint to share/publish as my digital identity?
The primary secret key should be stored offline and only be used for creating/signing keys.
There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
- 11
1
vote
0
answers
169
views
Using GPG is there a way to label public keys on my OpenPGP keyring?
I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
- 11
1
vote
1
answer
667
views
ed25519-sk vs. gpg-agent on Yubikey
According to my understanding of this document, Yubikey is capable of running ed25519-sk and gpg-agent.
Which one is more secure? Obviously, ed25519-sk wouldn't work, if the SSH server is old, but ...
- 113
5
votes
1
answer
5k
views
What are the security implications of using GPG instead of SSH keys for authentication
I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
0
votes
1
answer
551
views
Get GPG signature without decryption
I use GPG on awsLinux, currently version 2.0.22. Before exchanging a file with someone we exchange public keys, so signatures can be confirmed for the files transmitted. Their public key is imported ...
- 103
0
votes
1
answer
432
views
Do git commit signatures reveal key uid if different from git email?
I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
- 111
1
vote
2
answers
217
views
How to securely use `pass`, `sudo`, and `npm` on the same machine
TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store.
I use pass as a password manager, on Linux. And like probably all Linux users, I ...
- 113