Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
35
votes
1answer
18k views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
76
votes
2answers
21k views

How many OpenPGP keys should I make?

I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
9
votes
2answers
4k views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
12
votes
3answers
2k views

What are you saying when you sign a PGP key?

When you sign a PGP/GPG key, what exactly are you saying to everyone who sees your signature? Are you validating the person, or the email address? To explain what I mean, take the following two ...
39
votes
2answers
11k views

Will encrypting the same file with GnuPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GnuPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
29
votes
2answers
7k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
191
votes
14answers
72k views

Where do you store your personal private GPG key?

So, I want to start using pass, but I need a GPG key for this. This application will store all of my passwords, which means it's very important that I don't lose my private key, once generated. Hard ...
40
votes
3answers
6k views

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

How safe are signed git tags? Especially because git uses SHA-1. There is contradictory information around. So if one verifies a git tag (git tag -v tagname), then checksouts the tag, and checks that ...
3
votes
1answer
210 views

What is the recommended procedure to migrate to a new OpenPGP master key?

I am thinking about starting again with a new master key. My current master key was not compromised, but I had stored it on my private server temporarily, which is against good practices (but I am the ...
35
votes
3answers
17k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
23
votes
3answers
2k views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by using ...
11
votes
4answers
4k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
4
votes
2answers
11k views

How to change default cipher in GnuPG on both Linux and Windows?

How can I change the default symmetric cipher used by GnuPG from CAST5 to another? I'm using GPG4Win on Windows, but would also be interested in a solution for Linux.
8
votes
1answer
3k views

How long do keys stay on keyservers?

Do GPG/PGP keyservers "garbage collect" old keys which have expired, been revoked, or simply haven't been updated in a decade? Or does the server (theoretically) keep every key it has ever seen from ...
5
votes
1answer
363 views

What's the purpose of a PGP transition statement?

PGP key holders occasionally replace their old PGP master keys with newer PGP master keys (for example, to use securer algorithms). When doing this, PGP key holders want their new key to be signed by ...
46
votes
8answers
40k views

How to securely send private keys

What is the recommend way and best-practice to send private keys and SSL private keys? I was thinking of zipping up the files, then using gpg: gpg -c thefile.zip The problem then becomes how do you ...
28
votes
4answers
18k views

How can I encrypt a file using gpg without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
43
votes
7answers
11k views

Is layered encryption more secure than long passwords?

The comments in this question debate about the added security of multi-layered encryption. There seems to be some disagreement, and I thought a proper question would be helpful here. So, to provide ...
10
votes
1answer
6k views

export-secret-key after Yubikey is plugged in

I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to ...
15
votes
2answers
10k views

What exactly is a subkey?

I fairly understand the math behind RSA, Elgamal, AES, SHA but not how things are used in practise. How are subkeys different from master key? I understand its purpose from various websites but How is ...
6
votes
1answer
1k views

Is it possible to assign different UIDs to subkeys for the purpose of having multiple identities?

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different ...
7
votes
2answers
10k views

How secure is GnuPG conventional encryption (with defaults)?

How secure is the encryption of files when using GPG this way? gpg -c personal.zip It will not use any keys or other lines. And how good is it compared to TrueCrypt? Note that I will upload ...
6
votes
4answers
849 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized "feature"...
6
votes
3answers
4k views

GPG keys & SHA-1

I've heard that SHA-1 hashing is becoming less secure, and that most GPG keys are secured with SHA-1. Is there a way to determined if SHA-1 is in my GPG key, and what to do if this is the case?
2
votes
2answers
914 views

With GPG, can you “decrypt” a file that hasn’t been encrypted?

In reading about asymmetric encryption a while ago, I remember reading that you could "decrypt" an unencrypted file with your private key, then others (anyone) could "encrypt" it with your public key ...
2
votes
1answer
127 views

Upgrading OpenPGP public key on key servers?

What is the best way to upgrade an OpenPGP key that was created 11 years ago? It's 1024-bit and is published on the key server. I can create a new key, but what's the proper way to update the ...
5
votes
1answer
574 views

Can OpenPGP private keys ever be secure enough to store publicly?

The OpenPGP (private) key format stores the key symmetrically encrypted. The "iterated and salted" setup derives this key from a passphrase, taking a "octet count" parameter that determines the ...
3
votes
1answer
6k views

How do I convert a GPG certificate to a CRT certificate that can be imported into Windows Certificate Manager?

I have a GPG certificate from someone used for email -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) I would like to import that into Windows Certificate Manager So I ...
3
votes
1answer
202 views

Combating Networks of Forged OpenPGP Keys on Public Keyservers

I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
2
votes
1answer
269 views

How to verify file Integrity?

I have downloaded a software(zipped), from a website: example-linux.gtk.x86_64.zip There is another file given for verification, example-linux.gtk.x86_64.zip.asc, whose content are -----BEGIN PGP ...
41
votes
5answers
9k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread http://...
28
votes
1answer
13k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...
28
votes
7answers
13k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
14
votes
1answer
8k views

Is it possible to export a GPG subkey's public component?

I'm trying to export the public component of my subkey, but all GPG will give me is the public component of my master key. The keyring is set up like this. $ gpg -K /home/alex/.gnupg/secring.gpg -----...
21
votes
5answers
1k views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
32
votes
1answer
29k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
12
votes
1answer
569 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
6
votes
1answer
13k views

GPG why is my trusted key not certified with a trusted signature?

When I run gpg --verify ~/file.asc ~/file I receive the following: gpg: Signature made Tue 10 Dec 2016 05:10:10 AM EST using RSA key ID abcdefgh gpg: Good signature from "Alias (signing key) <...
13
votes
1answer
2k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
27
votes
2answers
4k views

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
19
votes
2answers
1k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
11
votes
3answers
4k views

Best practices for GPG user ids

What is the best practice for choosing GPG user id(s)? I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because ...
6
votes
2answers
5k views

When signing email with GPG, how does verification by the receiver work?

I use GPG to sign my outgoing emails. I understand how it works when I encrypt mail to send to someone else. Then I need his/her public key, encrypt it with that, and only he can decrypt it using ...
23
votes
2answers
26k views

What is the default cipher algorithm for GnuPG?

I know, that one can force GnuPG to use AES256 for encryption with gpg --cipher-algo AES256 or with a special setting in ~/.gnu/gpg.conf. But, what is the default cypher algorithm for GnuPG, if I ...
12
votes
2answers
7k views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
22
votes
3answers
6k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, etc....
17
votes
4answers
22k views

Can I specify a public key file instead of recipient when encrypting with GPG

Can I do something like: gpg --public-key my.pub -e file.txt If I can, any reason that I should not do that? P/s: I think I don't need to know about the recipient because my machine only has one ...
9
votes
1answer
3k views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
9
votes
1answer
522 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
8
votes
2answers
3k views

Does GnuPG use symmetric + public key encryption for large files?

Recently, I have a need to encrypt few large files. I have the option to use the OpenSSL command line utility, however I prefer to use GnuPG. How does GnuPG works under the hood with the --encrypt ...