Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

190
votes
14answers
70k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
73
votes
2answers
20k views

How many OpenPGP keys should I make?

I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
43
votes
7answers
11k views

Is layered encryption more secure than long passwords?

The comments in this question debate about the added security of multi-layered encryption. There seems to be some disagreement, and I thought a proper question would be helpful here. So, to provide ...
42
votes
8answers
38k views

How to securely send private keys

What is the recommend way and best-practice to send private keys and SSL private keys? I was thinking of zipping up the files, then using gpg: gpg -c thefile.zip The problem then becomes how do you ...
42
votes
2answers
12k views

Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?

As the title says, do those 4 bytes carry a meaning (I assume they do as apparently the smile changes depending on the key bitness)? The two files below have been encrypted with the different keys, ...
40
votes
5answers
9k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread http://...
40
votes
3answers
6k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
38
votes
2answers
11k views

Will encrypting the same file with GnuPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GnuPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
36
votes
3answers
16k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
33
votes
1answer
16k views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
29
votes
4answers
17k views

How can I encrypt a file using gpg without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
29
votes
4answers
41k views

gpg --encrypt fails

When trying to encrypt files, I get the following error in KGpg editor window: The encryption failed with error code 2 On the command line I get: $ gpg --list-keys /home/user/.gnupg/pubring.gpg -...
28
votes
5answers
11k views

Encrypting a few TB of Data [closed]

I'm planning on encrypting a large media library of mine. Have looked into different solutions, but thought I should ask the community what your thoughts are. I don't want to encrypt each file ...
28
votes
1answer
13k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...
27
votes
2answers
7k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
27
votes
2answers
3k views

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
27
votes
1answer
27k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
26
votes
7answers
12k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
23
votes
3answers
2k views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by using ...
22
votes
2answers
24k views

What is the default cipher algorithm for GnuPG?

I know, that one can force GnuPG to use AES256 for encryption with gpg --cipher-algo AES256 or with a special setting in ~/.gnu/gpg.conf. But, what is the default cypher algorithm for GnuPG, if I ...
22
votes
3answers
6k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, etc....
21
votes
1answer
21k views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
21
votes
5answers
1k views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
19
votes
2answers
1k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
18
votes
3answers
11k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep <sitename&...
17
votes
1answer
2k views

Yubikey / GPG with OpenSSH signed key

I am currently looking into the possibility of using Yubikey (NEO)'s to store the private SSH keys of my users. By searching the internet I've found several places that explain how you can generate a ...
16
votes
2answers
18k views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
15
votes
4answers
20k views

Can I specify a public key file instead of recipient when encrypting with GPG

Can I do something like: gpg --public-key my.pub -e file.txt If I can, any reason that I should not do that? P/s: I think I don't need to know about the recipient because my machine only has one ...
14
votes
1answer
7k views

Is it possible to export a GPG subkey's public component?

I'm trying to export the public component of my subkey, but all GPG will give me is the public component of my master key. The keyring is set up like this. $ gpg -K /home/alex/.gnupg/secring.gpg -----...
14
votes
2answers
1k views

Is PGP secure against a rogue keyserver?

Imagine Eve taking over the keyserver both Alice and Bob are using. By replacing Alice and Bob's public keys with her own, she can do a man-in-the-middle attack decrypting messages and relaying them ...
13
votes
4answers
6k views

Is there a limit on the layers of encryption a file can have?

Consider symmetric GPG encryption of a given file my_file.txt. Something like (in command line) gpg --symmetric --cipher-algo AES256 my_file.txt After suppying the prompt with the new password, the ...
13
votes
3answers
1k views

How do I protect my OpenPGP key on my computer?

How do I protect my OpenPGP key on my computer? If I make a backup of my private key I will keep it secure, but if someone gets access to my computer he/she will can get all my keys through Kleopatra ...
13
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
12
votes
1answer
14k views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
12
votes
3answers
2k views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
12
votes
2answers
8k views

What exactly is a subkey?

I fairly understand the math behind RSA, Elgamal, AES, SHA but not how things are used in practise. How are subkeys different from master key? I understand its purpose from various websites but How is ...
12
votes
2answers
7k views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
12
votes
1answer
3k views

Is there a common best practice for naming public and private PGP keys when exporting them?

Is there a common best practice for naming exported public and private GPG keys when exporting them or otherwise storing them as files? I know that GnuPG doesn’t care what keys are named when you ...
12
votes
1answer
552 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
11
votes
5answers
4k views

Is a part of an encrypted file easier to crack?

After encrypting a file (GPG with AES) and splitting it into chunks (split), is it easier to crack one of the parts compared to the complete file? (Maybe because it may loses some important bits.)
11
votes
5answers
6k views

Smart card + GnuPG: what is stored in my keyring/how to adopt smart card?

I recently bought a Yubikey Neo which can act as a OpenPGP smart card. I'd like to use this to store my private GnuPG key. I've gone through the initial setup and I am able to use the smart card to ...
11
votes
3answers
1k views

Can I expose a passphrase-protected private OpenPGP key? [duplicate]

I have created a 4096-bit key-pair using GnuPG. Can I expose the passphrase-protected private key to an untrusted system? E.g. can I put that key in my Dropbox account or send it to myself as an ...
11
votes
4answers
3k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
11
votes
1answer
762 views

Should I recreate Git tags after revoking a signing key?

Let's say my signing key has been compromised and I have to revoke it. What happens to the changesets and tags already signed? Should I rewrite them with the new signing key?
11
votes
3answers
4k views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
11
votes
2answers
130 views

Is there any information I shouldn't include in questions about GnuPG aside from my private key?

There are many questions I have about GnuPG, but what stops me asking is knowing that I may add output to a question that I shouldn't release publicly. Is it a risk to paste in the result of gpg -K? ...
10
votes
4answers
2k views

Why the symmetric key is added to the message?

Yesterday in my class we learnt how to send a message from Alice to Bob with the achieved goals of confidentiality, integrity and authenticity. In order to have a better performance we use a hybrid ...
10
votes
2answers
1k views

What is the meaning of GnuPG's --list-sigs output?

gpg --list-sigs gives me somethings like the following (I edited the output only to show the interesting/different rows): pub 2048R/4ACE309C 2016-11-01 uid lala_test2 <lala2@...
10
votes
1answer
6k views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
10
votes
3answers
846 views

Is it safe to publish public PGP authentication subkeys?

Suppose I have a PGP key set up as follows: I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys. Then I create three ...