Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

5
votes
1answer
113 views

Superceding a passphrased key with a token-based key

I've been using a GPG key for awhile (mostly with the pass password manager but also some with mail). Since it's now in use, a few years old, and entering the passphrase is getting tiresome, I ...
1
vote
1answer
130 views

Use GPG smartcard and gpg-agent to protect multiple SSH keys

I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine. ssh-add -...
1
vote
1answer
230 views

Methods to work with offline primary keys

I created a number of profiles with separate subkeys for authentication, signature, and encryption while primary keys are saved on USB Stick. It's working alright but I was wondering if there are some ...
1
vote
1answer
423 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
-2
votes
1answer
91 views

Is GPG symmetric (decryption) vulnerable?

Suppose a file (say, a text file source.txt) was encrypted into danger.gpg using GPG symmetric encryption on a compromised device. Since the device is compromised, danger.gpg could have been created ...
-2
votes
1answer
161 views

PGP private key and decryption issues

I have created a private and public key set and encrypted a message to a friend with their public key. I then turned off my machine, and since it is not in persistence mode, my keys were deleted, but ...
4
votes
0answers
3k views

Which ECC to choose with GPG?

I want to generate a key pair with gpg2 2.1.11 and libgcrypt 1.6.5. I use the command gpg2 --expert --full-key-gen. This allows me to choose an ECC: Please select what kind of key you want: (1) ...
4
votes
0answers
355 views

Sharing subkeys among two master keys

I would like to have a GnuPG identity that I can use both for a long time (so that I can build a wide web of trust) and immediately with as many people as possible. As of today, the second goal is ...
4
votes
0answers
435 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
3
votes
0answers
50 views

Import GnuPG Subkey to other Primary Key

Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
3
votes
0answers
154 views

yubikey creating different ssh public key having same GPG

I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
3
votes
0answers
374 views

How to securely print private key and protect against attacks on printer itself?

The question is in the title, but below are my thoughts on this. As we know there are various possible attacks on printer, so it is not very secure to print high security things like private keys for ...
3
votes
0answers
576 views

Specify AES key when using gpg

When using gpg to encrypt/decrypt a file with AES-256, is it possible to specify the 256-bit key directly (rather than have it derived from a passphrase)?
2
votes
0answers
64 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
2
votes
0answers
44 views

Does the output of --export-ssh-key change with different subkeys?

I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
2
votes
0answers
185 views

GPG: how to encrypt using a keyfile? (symmetric)

In Ubuntu this produces a "filename.txt.gpg" file and works: $ gpg --symmetric --passphrase-file keyfile.key filename.txt In debian, I get a popup requesting I enter a password... How do I encrypt ...
2
votes
0answers
233 views

PGP public key block Public-Key (old) - What does the OLD mean?

System: Linux Mint 19. Today I created a new GPG key pair using: gpg --full-generate-key I armor-exported the public key and have run: file *.public As a surprise I found my key or format or ...
2
votes
0answers
42 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
2
votes
0answers
110 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
2
votes
0answers
115 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
2
votes
0answers
251 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
2
votes
0answers
688 views

How to add another UID to key on OpenPGP card?

I have an OpenPGP key on a smart card that I've used for some time. I now wish to add some additional email-addresses to the key. So I insert my card into the reader and execute gpg2 --edit-key for my ...
2
votes
0answers
242 views

OpenPGP (RFC4880) - do you agree with my SimpleS2K (string-to-key) implementation?

Background: I'm writing a GPL Python OpenPGP to JSON parser which I'm testing on files generated with GPG 1.4.16. If given a passphrase, the parser will generate keys using the string-to-key methods ...
1
vote
0answers
31 views

--s2k-mode 0 session key from equal-length passphrase

In gpg2, how exactly does --s2k-mode 0 go from the passphrase to the session key in this example: gpg2 --armor --s2k-mode 0 --s2k-digest SHA256 --s2k-cipher-algo CAMELLIA256 --symmetric [file path] ...
1
vote
0answers
46 views

How to display the SHA256 hash while signing or in signature

I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
0answers
85 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
1
vote
0answers
58 views

Does gpg-agent cache passphrases per symmetrically encrypted file?

I have used the following command to symmetrically encrypt different files, all with the same passphrase: $ gpg -c --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-count 65536 some_file.txt ...
1
vote
0answers
547 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
1
vote
0answers
27 views

Generating new E and S subkeys for a key that has been moved to card

I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
1
vote
0answers
70 views

Primary uid of Key is not changeable

Recently I had to revoke one of my UIDs and add a new one in my main GPG Key. As I expected the new UID became primary and I tried to change it back to the original one (it's not the revoked one). ...
1
vote
0answers
34 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
1
vote
0answers
28 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
1
vote
0answers
261 views

Unattended generation of “the perfect keypair”

I'm trying to generate a "perfect keypair" akin to https://linuxich.wordpress.com/short-manual-for-a-perfect-gpg-keypair-using-gpg-v2/ but I want to do it semi-automatized, in gpg2 terms that would be ...
1
vote
0answers
426 views

What is the best way of encrypting large files for a corporate use case?

We are creating backups that contain user information. Even though it is created in a closed environment, if there is a breach in our backup systems we would like to make it harder to use the stolen ...
1
vote
0answers
840 views

gpg 2.0 command line option to create UTF-8 data

With echo text | gpg2 --sign --textmode -a I can create messages with a one pass signature containing a Literal Data packet in TEXT ('t') format. If I skip the --textmode option it will generate ...
1
vote
0answers
125 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get to ...
1
vote
0answers
951 views

GPG based on-the-fly folder encryption

I am trying to find a good way to combine Owncloud with client-side encryption. Ideally, the requirements are: encryption relatively transparent (mostly text/.odt files) and cross-platform (Win, OS ...
1
vote
0answers
778 views

`gpg --keyserver subkeys.pgp.net` triggers error `armor-keys-failed`

$ gpg --keyserver subkeys.pgp.net --recv-key 0xXXXXXXXXXXXXXXXX gpg: requesting key FDXXXXXX from hkp server subkeys.pgp.net gpg: DBG: armor-keys-...
1
vote
0answers
1k views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K (string-to-...
0
votes
0answers
27 views

How can I input a raw session key into GnuPG?

How can I input a raw session key into GnuPG? I presume that I will have to use --sk2-cipher-algo and --sk2-digest-algo at the same time so as to accommodate the length of my chosen session key. ...
0
votes
0answers
26 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
0
votes
0answers
52 views

Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?

I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...
0
votes
0answers
81 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
0
votes
0answers
51 views

Which encryption algorithm for cloud backup?

I want to backup my data to the cloud. Before that, I want to encrypt it using GPG (gpg (GnuPG) 2.2.11 and libgcrypt 1.8.4). The backup is just for me, so I don't care about interoperability I only ...
0
votes
0answers
25 views

Know the setting used in creating key pair in GNUPG4Win version 3.15

I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation. Basically I want to use AES-128, 3DES ...
0
votes
0answers
70 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
0
votes
0answers
79 views

What are the possible ways to manage gpg keys over period of 10 years?

What key curation can be applied to a personal gpg keypair over a period of time (e.g. 10 years) if I also want to use the keypair for professional use? What are the measures that I need to take to ...
0
votes
0answers
36 views

Which encryption and hash is best to use in GNUPG2?

Okay, I know this has been asked before (but it changes over time)... and I know there perhaps are no good answers... but here goes... I want to create a new key-set for myself using gnupg2, but I ...
0
votes
0answers
152 views

Compatibility advantages of RSA-4096 over RSA-3072

I am targeting a security level of 128 bits for GnuPG, so I am using SHA-256 and AES-128. Now I need to choose between RSA-3072 and RSA-4096. According to multiple sources RSA-3072 security level is ...
0
votes
0answers
222 views

How should I organize my keys?

Suppose I have a set of computers with variegate level of trust (for example): I fully trust my own desktop pc at home I trust a bit also my smartphone, but I know it could be stolen I trust a bit ...