Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

8
votes
3answers
1k views

GnuPG warning for a signed key with trust level 4

When encrypting a document with a public key I got a warning: $gpg --encrypt -r 6B7F10E4 file.pdf It is NOT certain that the key belongs to the person named in the user ID. If you *really* know ...
4
votes
1answer
291 views

Is an OpenPGP signature made before a key is revoked considered valid?

If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
2
votes
1answer
144 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
2
votes
1answer
797 views

How can I validate imported keys with GPG?

Recently, I downloaded several public keys with gpg, in order to fix Debian package system after upgrading to Stretch. The commands were: # gpg --recv-keys EF0F382A1A7B6500 # gpg --recv-keys ...
3
votes
0answers
374 views

How to securely print private key and protect against attacks on printer itself?

The question is in the title, but below are my thoughts on this. As we know there are various possible attacks on printer, so it is not very secure to print high security things like private keys for ...
5
votes
1answer
540 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
4
votes
1answer
368 views

Priority of GnuPG subkey selection during encryption

I've got the following set of 6 subkeys $ gpg -K ... ssb> rsa2048 2017-10-04 [E] [expires: 2027-10-02] ssb> rsa2048 2017-10-04 [S] [expires: 2027-10-02] ssb> rsa2048 2017-10-04 [A] [...
1
vote
1answer
150 views

Use cases for GnuPG's --(import|export)-options (import|export)-(clean|minimal)

I'm wondering in which scenarios I would make use of GnuPG's non-default --(import|export)-options (import|export)-(clean|minimal)? The only practical use case I can imagine is to export my public ...
3
votes
1answer
496 views

What do these signatures of my PGP key mean?

When I was viewing the key information of my PGP key on a key server, I couldn't understand the meaning of some of the signatures. Here is the key information from the key server(https://pgp.mit.edu/...
0
votes
1answer
761 views

Own password manager. How to store passwords [closed]

I want to play a little bit and create my own little password manager (with gpg) in node.js My question is how I should keep those passwords: In one encrypted file (let's say in json format), ...
4
votes
2answers
2k views

Yubico 4 or Nitrokey as an HSM

Would it be possible to use Yubico or Nitrokey as a HSM that is used infrequently? Both devices seem to prevent users from accessing the private key. Does this seem to be correct? How about if the ...
2
votes
1answer
216 views

How do I change the expiry date of an ElGamal subkey?

I have a GPG key which has an ElGamal subkey (elg2048). Frankly, I don't remember why that is or whether I actually need it - I just have it. Now, I've just changed the expiry date of the key overall, ...
1
vote
0answers
64 views

Does GitHub have an endpoint for reading a users GPG keys? [closed]

Github produces a nice HTTP endpoint to read a users RSA keys. Do they have something like this for GPG keys (without needing additional auth or through the developer API)? If not why and/or when will ...
4
votes
1answer
319 views

Generate subkeys based on less secure OpenPGP primary key

I've been reading about the benefits of using OpenPGP subkeys for different machines. Obviously, it's a much safer practice than copying around the same master key between multiple machines (...
2
votes
1answer
444 views

Can an OpenPGP primary key revoke a subkey of a subkey?

I would like to have the following setup: a main Key, saved in a hardware wallet or paper wallet. Let's call this level 1. The idea is to never have to use this key again, as a sort of last resort. ...
1
vote
1answer
742 views

Securely storing AES key with public key cryptography

Security newbie here I have a bash script that recursively enumerates all files and directories from a given path (say /home/user) and encrypts individual files and stores them into another directory ...
3
votes
1answer
434 views

How can I generate a .gpg file for verifying Putty?

I downloaded the Putty installer from ssh.com, which said To import the signature key into GPG, use: gpg --import putty-release-2015.asc To check the signature of a file, use: gpg -...
0
votes
2answers
113 views

Is sending the same e-mail encrypted and also unencrypted a security risk?

Is it a risk, if I send the same email one time encrypted and to another recipient unencrypted? I wonder if it would be possible to calculate the decryption key (if someone had a copy of both) and ...
3
votes
1answer
126 views

When installing a new software repository, is it required to check the repository key fingerprint?

I'm recording a video about installing some software from a vendor repository. At some point, I download the GPG key for the remote repository and check manually its fingerprint before adding key and ...
2
votes
1answer
116 views

Rationale for subkeys in OpenPGP?

I have seen from different sources that the sole purpose of the master key should really be to generate the subkeys, and that it should be subsequently backed up to an offline location and deleted ...
0
votes
1answer
315 views

Is email published with PGP key?

When I generate key it has my email address attached to it. Does it mean, when I publish my public PGP key people also see my email attached to it? From what public keys I saw so far it seems to me ...
3
votes
2answers
101 views

Concern regarding repeatable text in Git commits reducing namespace and weakening GPG key

I need help with two PGP / GPG issues: Ensuring that my thinking is correct (i.e., I really do need another GPG subkey for my scenario) Ensuring that I create the subkey correctly without ...
0
votes
1answer
156 views

Is gnupg's tsign compatible with S/MIME

GnuPG supports creating trust signatures using the tsign sub-command. (The documentation is not really verbose about this.) By using this option it is possible to create a certificate hierarchy ...
1
vote
1answer
425 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
1
vote
2answers
964 views

RSA Digital signatures vs “encryption with the private key”

I found this statement In RSA crypto, when you generate a key pair, it's completely arbitrary which one you choose to be the public key, and which is the private key. If you encrypt with one, you ...
3
votes
2answers
2k views

How to use YubiKey through GnuPG on remote server?

I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
4
votes
1answer
153 views

GPG key handling with Server

I'm using a VPS as a development machine and need gpg a) for signing git commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel ...
2
votes
1answer
210 views

How to get my OpenPGP keys signed?

I was wondering if anyone has any recommendations for getting my OpenPGP key signed by others. I live in the middle of nowhere, and there aren't meetup groups within 50 miles of me ever. How to get ...
2
votes
1answer
303 views

Use one subkey for signing + encrypting

I'm phasing out my old OpenPGP key and am creating a new one. I plan to lock away the main key and do daily work only with subkeys. The subkeys will be valid for a year and I'll add new ones after ...
6
votes
4answers
2k views

How to use multiple smart cards with gnupg?

I have two smart cards: SCard1 and SCard2. The same keys are stored on both of them. One of the feature I use the most is SSH authentication to access multiple servers. But I cannot use the second ...
0
votes
1answer
146 views

Are GPG Tools Keys Just Plains GnuPG Keys?

I generated a key pair with GPG Tools for Mac and exported the public and private key to a safe place. I assume that I can decrypt my stuff with this USB in any OS (e.g. Linux) and any GnuPG software....
1
vote
1answer
587 views

Is it possible to create GnuPG keys from a x509 cert/key pair?

I have a digital cert issued by my organization for signing email. It's imported into Thunderbird and the key and cert can be exported to a .p12 from within Thunderbird. I'd like to use the .p12 to ...
0
votes
1answer
299 views

Does gpg --digest-algo have any effect when verifying a signature?

It seems that --digest-algo is only used when generating signatures and ignored when used with --verify, but I find the documentation unclear: --digest-algo name Use name as the message digest ...
4
votes
1answer
119 views

Is my OpenPGP key rubbish because of bad entropy?

I had problems generating an OpenPGP key on my XUbuntu machine, because GnuPG did not get enough entropy. After some time of browsing and doing stupid stuff to generate more entropy, still nothing ...
3
votes
1answer
239 views

Does it defeat the purpose to create an OpenPGP authentication subkey that is not password-protected?

I'd like to be able to log into and out of my ssh servers freely without entering a password. Previously, I did this with ssh-keygen, storing the key file under my ~/.ssh directory. Since I also have ...
28
votes
5answers
11k views

Encrypting a few TB of Data [closed]

I'm planning on encrypting a large media library of mine. Have looked into different solutions, but thought I should ask the community what your thoughts are. I don't want to encrypt each file ...
5
votes
1answer
334 views

What's the purpose of a PGP transition statement?

PGP key holders occasionally replace their old PGP master keys with newer PGP master keys (for example, to use securer algorithms). When doing this, PGP key holders want their new key to be signed by ...
8
votes
2answers
3k views

gpg --fingerprint prints out completely different fingerprint

When displaying the full fingerprint of an OpenPGP key, it get a completely different one compared to the ID. For this specific key: $ gpg --list-keys --fingerprint D72AF3448CC2B034 pub rsa4096 ...
1
vote
3answers
2k views

Where can I find the detailed manual page for gpg --list-secret-keys output

I get confused about the terms used in the output of gpg --list-secret-keys For example what is the meaning of following: sec sec# ssb ssb> there are many codes being used in the output. Can ...
5
votes
1answer
983 views

How can I tell what cipher was used by python-gnupg?

I'm encrypting a file using the python-gnupg module like this. Ultimately, I want to use the AES256 cipher for encryption: status = gpg.encrypt_file(fin, recipients=['root@frarakee'], output='foo.bin....
2
votes
0answers
253 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
0
votes
1answer
665 views

Importing secret subkey to a Key

We are a group and each member have an independent PGPKey, but we want to read messages encrypted for the group. I create a pair with an only one key only for encryption, but I don't want to share ...
8
votes
2answers
2k views

Does GnuPG use symmetric + public key encryption for large files?

Recently, I have a need to encrypt few large files. I have the option to use the OpenSSL command line utility, however I prefer to use GnuPG. How does GnuPG works under the hood with the --encrypt ...
3
votes
2answers
450 views

how to update GPG private key that Pass uses

I've setup up Pass with a GPG key. That key expires at some point in the future. In preparation for this event, how would I update Pass to use a new Key? Do I just manually update the key id and ...
4
votes
1answer
977 views

How does a private OpenPGP key's passphrase add to its security?

I am a novice user of OpenPGP. I use GPGTools for OS X. I have several connected questions, but difficult to find direct answers on the Internet. When I create a key-pair, the password I enter is a ...
3
votes
1answer
193 views

Combating Networks of Forged OpenPGP Keys on Public Keyservers

I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
4
votes
0answers
3k views

Which ECC to choose with GPG?

I want to generate a key pair with gpg2 2.1.11 and libgcrypt 1.6.5. I use the command gpg2 --expert --full-key-gen. This allows me to choose an ECC: Please select what kind of key you want: (1) ...
1
vote
1answer
513 views

Where is Enigmail's keyring stored?

I have a GPG public/private key to send email with Enigmail and Thunderbird. I received an encrypted email but Enigmail did not recognize it. I tried to use the command line, but gpg complains gpg: ...
1
vote
0answers
181 views

Encrypting same large iso file with gpg and openssl [duplicate]

test.iso is a large file ,almost as large as 3G. ls -al test.iso -rw-r--r-- 1 debian8 debian8 3076767744 Apr 21 10:56 test.iso 1.Encrypting with gpg. I created pub key and provate key for person1. ...
4
votes
3answers
404 views

Use USB TRNG as source of randomness for OpenSSL key generation

I have an idquantique TRNG (USB). On my Debian machine, I can easily create a file on my disk coming from that TRNG filled with some random content. Is it possible to make OpenSSL and GnuPG (for key ...