Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
1
vote
2answers
914 views

Does Thunderbird Enigmail plugin decrypt attached files?

From my research I have found out that you can easily send encrypted messages to one another using Enigmail. If first I encrypted a file,then attached it to an email, sending it through Enigmail to a ...
0
votes
0answers
30 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
1
vote
1answer
2k views

How can I decrypt a file with gpg to screen and not write to disk?

I currently use a script to decrypt a file, but it writes it to disk. I then use wipe to clear it. Is there a way to write it to screen so it never writes it to disk? I use the command $ echo ...
0
votes
0answers
7 views

No secret key error [migrated]

Im using Control-m to facilitate a transfer from a vendor. I use Kleopatra to generate a key pair and then give the public key to the vendor to encrypt and send us files. Every time I test ...
1
vote
1answer
501 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
1
vote
1answer
261 views

Methods to work with offline primary keys

I created a number of profiles with separate subkeys for authentication, signature, and encryption while primary keys are saved on USB Stick. It's working alright but I was wondering if there are some ...
0
votes
1answer
46 views

secp256k1 GPG key?

Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
1
vote
1answer
70 views

Decrypt file using Key and Initialization Vector in Linux

I am Salesforce developer but new to the Security World as well as Linux. We encrypted a file with Key and initialization Vector in Salesforce(only symmetric encryption is possible in Salesforce). No ...
0
votes
0answers
19 views

GPG keys generated with diceware entropy?

Considering the absolutely critical role that entropy plays in the generation of keys, I am wondering if there is an easy way to use diceware (true random numbers) to generate an OpenPGP key with ...
6
votes
4answers
837 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized "feature"...
0
votes
0answers
67 views

What should I do next on my GPG key after my computer is seized by authority?

Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
0
votes
0answers
21 views

GnuPG verify signature *after/while* decrypting does not fail when it should

I'm encrypting and signing data with the PHP function gnupg_encryptsign() (docs) which has the strange behaviour of signing first and encrypting afterwards. I'm aware of this thread saying this is ...
76
votes
2answers
21k views

How many OpenPGP keys should I make?

I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
1
vote
1answer
65 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
0
votes
0answers
56 views

GPG unattended ECC key and subkey generation

I wanna generate a ECC key which primary key is just for cert and has 3 subkeys for auth, sign, encrypt. I've found 2 methods to generate it. But I wanna unattended key generation via gpg —-batch —...
0
votes
1answer
52 views

Can a deleted PGP secret key be recovered from private-keys-v1.d directory?

Executing gpg -K --with-keygrip returns one key entry. However the private-keys-v1.d directory has two entries. I assume that one of them belongs to a secret key that has been deleted/removed. Is ...
0
votes
0answers
44 views

create gpg public key from subkey

I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically. For my communication ...
0
votes
1answer
85 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
1
vote
1answer
75 views

Can a new signature be added to an already signed message?

Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) ...
0
votes
0answers
61 views

How is private key encrypted after export?

For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
5
votes
1answer
127 views

Superceding a passphrased key with a token-based key

I've been using a GPG key for awhile (mostly with the pass password manager but also some with mail). Since it's now in use, a few years old, and entering the passphrase is getting tiresome, I ...
1
vote
1answer
49 views

How can one read the time in GPG's Literal Data Packet?

RFC 4880 says that the Literal Data Packet's time stamp is four octets long. Listing packets shows that it is five octets long, at least in GnuPG 2.2.6. The time stamp comes after the word "created", ...
0
votes
1answer
59 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
2
votes
1answer
198 views

Use GPG smartcard and gpg-agent to protect multiple SSH keys

I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine. ssh-add -...
1
vote
0answers
57 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
-6
votes
1answer
216 views

How can I get rid of the MDC packet in OpenPGP?

I want to get rid of the MDC packet in OpenPGP because I view SHA1 as a catastrophic threat. If one can invert SHA1, then all plaintext in OpenGPG is ... open. If one tries to go back to RFC 2440 ...
3
votes
1answer
252 views

Does it defeat the purpose to create an OpenPGP authentication subkey that is not password-protected?

I'd like to be able to log into and out of my ssh servers freely without entering a password. Previously, I did this with ssh-keygen, storing the key file under my ~/.ssh directory. Since I also have ...
0
votes
0answers
35 views

How can I input a raw session key into GnuPG?

How can I input a raw session key into GnuPG? I presume that I will have to use --sk2-cipher-algo and --sk2-digest-algo at the same time so as to accommodate the length of my chosen session key. ...
1
vote
0answers
40 views

--s2k-mode 0 session key from equal-length passphrase

In gpg2, how exactly does --s2k-mode 0 go from the passphrase to the session key in this example: gpg2 --armor --s2k-mode 0 --s2k-digest SHA256 --s2k-cipher-algo CAMELLIA256 --symmetric [file path] ...
0
votes
2answers
127 views

Should I delete lost GPG key from GitHub?

I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don'...
6
votes
1answer
344 views

When should I sign a PGP key with a non-revocable signature?

GnuPG allows the user to sign a key with a non-revocable signature. I have done this when I’m signing one of my own keys—signing my personal key with my work key, for instance. Is there any other ...
5
votes
2answers
343 views

How can I verify signed commits made by other people?

As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
1
vote
1answer
201 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
4
votes
1answer
230 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
1
vote
2answers
71 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
0
votes
0answers
39 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
40
votes
3answers
6k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
31
votes
1answer
29k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
2
votes
1answer
432 views

gpg --armor --export-secret-key differ on last 4 characters

I created a backup of a gpg key by doing: gpg -a --export-secret-keys foo@bar > private.key gpg -a --export foo@bar > public.key Then on another system, I import them: gpg --import private....
1
vote
1answer
566 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
6
votes
1answer
2k views

How to encrypt, sign and decrypt a file with gpg?

I am using gpg to encrypt and decrypt a file. Here are the steps I am doing taking reference from this question: # Sender gpg --encrypt --recipient recipient@gmail.com --output confidential.pgp ...
2
votes
2answers
228 views

Is it permissible to use GPG without an encryption key?

Will I be disapproved of or get frowned upon a lot if I choose to deploy and use GnuPG without an encryption key? E.g. I generate keys manually and skip the encryption key entirely. The reason is ...
8
votes
2answers
1k views

Multiple encryption subkeys on hardware smart cards

I've created a PGP key set which consists of the following: A master RSA key with only signing capabilities, stored offline. Multiple OpenPGP cards, each with three RSA keys: An encryption key A ...
-2
votes
1answer
122 views

Is GPG symmetric (decryption) vulnerable?

Suppose a file (say, a text file source.txt) was encrypted into danger.gpg using GPG symmetric encryption on a compromised device. Since the device is compromised, danger.gpg could have been created ...
2
votes
1answer
342 views

How do I interpret output that produces gpg listing keys?

Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
0
votes
0answers
99 views

Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?

I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...
1
vote
1answer
197 views

How do I create a detached plain text signature?

If I use gpg --detach-sig file, then I get a small file.sig, but it is not plain text, so this is not useful if you wish to send the signature in a plain text format. If I use gpg --clearsign file, ...
1
vote
1answer
130 views

Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?

I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
7
votes
2answers
3k views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
0
votes
0answers
116 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...