Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
2
votes
1answer
103 views

How to single key decrypt pgp encrypted mails in a multi key/multi identitiy setup?

For pgp encryption I'd like to combine short expiry terms for public signing and email encryption with (convenient) long term decryption possibilities of my mailbox mails. I'm using several mail ...
1
vote
1answer
132 views

GPG - limit who can add and remove from pubring

I'm working on a project where we use git-secret for hiding information. This is backed by gpg, and adding people to git-secret (http://git-secret.io/) is done by adding a public key to a pubring.gpg. ...
3
votes
1answer
2k views

Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey

I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...
2
votes
1answer
2k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
1
vote
1answer
770 views

With private keys and public keys which is used for which: encrypt, sign, verify, and decrypt?

I understand the functions of PGP key-pairs as: Public key is used to encrypt files so only the private key holder can read them Private key is used to decrypt files that were encrypted using the ...
3
votes
2answers
344 views

Using primary public-key to verify message signed by subkey

Let's assume this scenario: I sign a message using my subkey I send the signed message to someone who has my master public key Is recipient be able to verify my message? Or do I have to provide my ...
1
vote
2answers
53 views

Are these gpg commands identical?

I've found gpg -c < unencrypted_file > encrypted_file this command from https://askubuntu.com/questions/27770/is-there-a-tool-to-encrypt-a-file-or-directory this page, but in gpg manual it says ...
2
votes
1answer
107 views

Including GPG Transition statement as a signing policy

Assume that I am transitioning from key A to key B by signing key B with key A and then revoking key A. What do you guys think of including a link to my online transition statement in my signature of ...
27
votes
2answers
4k views

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
2
votes
2answers
79 views

Analysis of gpg2 packets

I want to mentally visualize or just understand a gpg-signature. When running $ gpg2 --list-packets --verbose < test.sig the output is # off=0 ctb=89 tag=2 hlen=3 plen=540 :signature packet: ...
-2
votes
1answer
352 views

How does GPG2 --verify knows who signed a file and how? [closed]

When I (clear)sign a file, the output is something like this. $ gpg2 --clearsign test $ cat test.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This is a test! -----BEGIN PGP SIGNATURE----- ...
1
vote
2answers
173 views

Is it possilbe to use an OpenPGP private key to sign a file via OpenSSL?

Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL? I've tried this: $ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key $ openssl rsautl -sign -in testfile ...
11
votes
5answers
4k views

Is a part of an encrypted file easier to crack?

After encrypting a file (GPG with AES) and splitting it into chunks (split), is it easier to crack one of the parts compared to the complete file? (Maybe because it may loses some important bits.)
3
votes
1answer
269 views

Does “Armoring” an encrypted string always produce the same length output if plaintext was same length?

I plan on encrypting numerous plain text strings which all have the same initial length. I plan on encrypting with AES-128 bit key using GPG. I plan on "armoring" the output into alphanumeric ...
3
votes
1answer
523 views

Strong password for GPG key or encrypt password database with GPG key?

I have a password database, that can be secured by a passphrase or by providing a GPG key. I have a GPG key that can be secured via a good password that I can remember, or via a great password that I ...
5
votes
2answers
583 views

Is it more secure encrypting 3 times with GPG?

Let's say we are using 3 different length passphrases and 3 different algos to encrypt sensitive data, e.g: gpg --symmetric --cipher-algo CAMELLIA256 < input.zip > output1 (random 100 ...
8
votes
3answers
1k views

GnuPG warning for a signed key with trust level 4

When encrypting a document with a public key I got a warning: $gpg --encrypt -r 6B7F10E4 file.pdf It is NOT certain that the key belongs to the person named in the user ID. If you *really* know ...
4
votes
1answer
319 views

Is an OpenPGP signature made before a key is revoked considered valid?

If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
2
votes
1answer
188 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
2
votes
1answer
880 views

How can I validate imported keys with GPG?

Recently, I downloaded several public keys with gpg, in order to fix Debian package system after upgrading to Stretch. The commands were: # gpg --recv-keys EF0F382A1A7B6500 # gpg --recv-keys ...
3
votes
0answers
423 views

How to securely print private key and protect against attacks on printer itself?

The question is in the title, but below are my thoughts on this. As we know there are various possible attacks on printer, so it is not very secure to print high security things like private keys for ...
5
votes
1answer
584 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
5
votes
1answer
421 views

Priority of GnuPG subkey selection during encryption

I've got the following set of 6 subkeys $ gpg -K ... ssb> rsa2048 2017-10-04 [E] [expires: 2027-10-02] ssb> rsa2048 2017-10-04 [S] [expires: 2027-10-02] ssb> rsa2048 2017-10-04 [A] [...
1
vote
1answer
160 views

Use cases for GnuPG's --(import|export)-options (import|export)-(clean|minimal)

I'm wondering in which scenarios I would make use of GnuPG's non-default --(import|export)-options (import|export)-(clean|minimal)? The only practical use case I can imagine is to export my public ...
3
votes
1answer
570 views

What do these signatures of my PGP key mean?

When I was viewing the key information of my PGP key on a key server, I couldn't understand the meaning of some of the signatures. Here is the key information from the key server(https://pgp.mit.edu/...
0
votes
1answer
822 views

Own password manager. How to store passwords [closed]

I want to play a little bit and create my own little password manager (with gpg) in node.js My question is how I should keep those passwords: In one encrypted file (let's say in json format), ...
4
votes
2answers
2k views

Yubico 4 or Nitrokey as an HSM

Would it be possible to use Yubico or Nitrokey as a HSM that is used infrequently? Both devices seem to prevent users from accessing the private key. Does this seem to be correct? How about if the ...
2
votes
1answer
294 views

How do I change the expiry date of an ElGamal subkey?

I have a GPG key which has an ElGamal subkey (elg2048). Frankly, I don't remember why that is or whether I actually need it - I just have it. Now, I've just changed the expiry date of the key overall, ...
1
vote
0answers
66 views

Does GitHub have an endpoint for reading a users GPG keys? [closed]

Github produces a nice HTTP endpoint to read a users RSA keys. Do they have something like this for GPG keys (without needing additional auth or through the developer API)? If not why and/or when will ...
4
votes
1answer
336 views

Generate subkeys based on less secure OpenPGP primary key

I've been reading about the benefits of using OpenPGP subkeys for different machines. Obviously, it's a much safer practice than copying around the same master key between multiple machines (...
2
votes
1answer
474 views

Can an OpenPGP primary key revoke a subkey of a subkey?

I would like to have the following setup: a main Key, saved in a hardware wallet or paper wallet. Let's call this level 1. The idea is to never have to use this key again, as a sort of last resort. ...
1
vote
1answer
779 views

Securely storing AES key with public key cryptography

Security newbie here I have a bash script that recursively enumerates all files and directories from a given path (say /home/user) and encrypts individual files and stores them into another directory ...
3
votes
1answer
495 views

How can I generate a .gpg file for verifying Putty?

I downloaded the Putty installer from ssh.com, which said To import the signature key into GPG, use: gpg --import putty-release-2015.asc To check the signature of a file, use: gpg -...
0
votes
2answers
113 views

Is sending the same e-mail encrypted and also unencrypted a security risk?

Is it a risk, if I send the same email one time encrypted and to another recipient unencrypted? I wonder if it would be possible to calculate the decryption key (if someone had a copy of both) and ...
3
votes
1answer
131 views

When installing a new software repository, is it required to check the repository key fingerprint?

I'm recording a video about installing some software from a vendor repository. At some point, I download the GPG key for the remote repository and check manually its fingerprint before adding key and ...
2
votes
1answer
120 views

Rationale for subkeys in OpenPGP?

I have seen from different sources that the sole purpose of the master key should really be to generate the subkeys, and that it should be subsequently backed up to an offline location and deleted ...
0
votes
1answer
394 views

Is email published with PGP key?

When I generate key it has my email address attached to it. Does it mean, when I publish my public PGP key people also see my email attached to it? From what public keys I saw so far it seems to me ...
3
votes
2answers
104 views

Concern regarding repeatable text in Git commits reducing namespace and weakening GPG key

I need help with two PGP / GPG issues: Ensuring that my thinking is correct (i.e., I really do need another GPG subkey for my scenario) Ensuring that I create the subkey correctly without ...
0
votes
1answer
172 views

Is gnupg's tsign compatible with S/MIME

GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy ...
1
vote
1answer
501 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
2
votes
2answers
1k views

RSA Digital signatures vs “encryption with the private key”

I found this statement In RSA crypto, when you generate a key pair, it's completely arbitrary which one you choose to be the public key, and which is the private key. If you encrypt with one, you ...
3
votes
2answers
2k views

How to use YubiKey through GnuPG on remote server?

I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
4
votes
1answer
167 views

GPG key handling with Server

I'm using a VPS as a development machine and need gpg a) for signing git commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel ...
2
votes
1answer
219 views

How to get my OpenPGP keys signed?

I was wondering if anyone has any recommendations for getting my OpenPGP key signed by others. I live in the middle of nowhere, and there aren't meetup groups within 50 miles of me ever. How to get ...
2
votes
1answer
324 views

Use one subkey for signing + encrypting

I'm phasing out my old OpenPGP key and am creating a new one. I plan to lock away the main key and do daily work only with subkeys. The subkeys will be valid for a year and I'll add new ones after ...
6
votes
4answers
3k views

How to use multiple smart cards with gnupg?

I have two smart cards: SCard1 and SCard2. The same keys are stored on both of them. One of the feature I use the most is SSH authentication to access multiple servers. But I cannot use the second ...
0
votes
1answer
154 views

Are GPG Tools Keys Just Plains GnuPG Keys?

I generated a key pair with GPG Tools for Mac and exported the public and private key to a safe place. I assume that I can decrypt my stuff with this USB in any OS (e.g. Linux) and any GnuPG software....
1
vote
1answer
694 views

Is it possible to create GnuPG keys from a x509 cert/key pair?

I have a digital cert issued by my organization for signing email. It's imported into Thunderbird and the key and cert can be exported to a .p12 from within Thunderbird. I'd like to use the .p12 to ...
0
votes
1answer
338 views

Does gpg --digest-algo have any effect when verifying a signature?

It seems that --digest-algo is only used when generating signatures and ignored when used with --verify, but I find the documentation unclear: --digest-algo name Use name as the message digest ...
4
votes
1answer
126 views

Is my OpenPGP key rubbish because of bad entropy?

I had problems generating an OpenPGP key on my XUbuntu machine, because GnuPG did not get enough entropy. After some time of browsing and doing stupid stuff to generate more entropy, still nothing ...