Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

Is any key signing party directory - or a mean to facilitate such meetings, exists?

I need to develop my web of trust. I don't live in or near a metropolitan area and as such it is a bit difficult to find possible local people to sign. I assume I must not be alone in that context. ...
0
votes
0answers
21 views

On MacOS, gpg gives “random_seed file is empty” error after I ran out of space for an encryption process?

I tried to encrypt a file on MacOS with gpg, and it turns out that I did not have enough hard drive space to make it. Afterwards, it exited with an error: gpg: can't write '/Users/myname/.gnupg/...
0
votes
1answer
37 views

Info about gpg setup on MacOS

On Mac OS Mojave: ▶ gpg --list-keys Warning: Failed to set locale category LC_NUMERIC to en_GR. Warning: Failed to set locale category LC_TIME to en_GR. Warning: Failed to set locale category ...
1
vote
0answers
28 views

how to simulate gpg severkey DoS attack?

I tried to simulate this attack in my PC but I could not generate a poison key, I used Linux (Ubuntu 18.04) and GPG software (gpg (GnuPG) 2.2.4). I tried to manipulate public key and import it to ...
0
votes
0answers
48 views

How do I verify a signature by using a OpenPGP public key without User ID (Redacted User IDs)?

Background Traditionally, in addition to cryptographic data, an OpenPGP public key contains User IDs and 3rd-party signatures for identification and Web-of-Trust verification, and it's distributed by ...
1
vote
1answer
52 views

Is it important to use separate GPG keys for signing Git commits and for SSH authentication?

When using GPG to sign Git commits, and as the SSH-agent, is it important to use separate sub-keys for the signing of the Git commits as it is for authentication with the SSH host of the Git server? ...
1
vote
0answers
26 views

How do I check if my key is updated in a keyserver after I resend it with new signatures?

I'm working in a task for class where I need to sign my public key with 3 signatures. After I got them, I need to send my key back to the keyserver with these 3 new signatures. The thing is that when ...
2
votes
2answers
81 views

When gpg encrypt is called from the command line, how is a key chosen to do the encryption?

I am using GnuPG. When gpg encrypt is called from the command line, how is a key chosen to do the encryption? It appears to me that -r, or --recipient, supplies a user id and that is the simple answer....
1
vote
1answer
72 views

How to use GPG to pass along encrypted content and double encrypt [closed]

Say I have a document. I want to encrypt it, then give it to my friend, and I don't want them to be able to decrypt it. I want them to encrypt it again using their GPG system. Then to decrypt it my ...
2
votes
0answers
47 views

How do I properly encrypt a document with GPG2 on Mac?

Here is what I have done roughly, starting from scratch: $ brew install gnupg $ cat >foo <<EOF Key-Type: RSA Key-Length: 4096 Subkey-Type: RSA Subkey-Length: 4096 Name-Real: ...
0
votes
1answer
20 views

gpg importing public key

I'm trying to follow this: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Step_by_Step_Guide/s1-gnupg-import.html to import a key.asc using gpg --import key.asc, so that ...
0
votes
1answer
41 views

How can I verify the trustworthiness of GPGTools?

Having a hard time verifying the trustworthiness of GPGTools. I really want to trust the project as it adds a lot of convenience on macOS, but can’t figure out if I can without spending a lot of time ...
1
vote
1answer
74 views

Why is Debian not showing the GPG signatures on keys that Arch Linux is?

I downloaded a Qubes OS ISO and I'm trying to verify its legitimacy using this guide. GPG was behaving weirdly, so I created a separate user with a separate keyring to reproduce the issue. When I try ...
0
votes
1answer
24 views

Can I resubmit my GPG key to a keyserver?

I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
0
votes
1answer
246 views

GPG encryption failed - Unusable public key

I was trying to encrypt a file using a GPG public key. It's working fine on my test server which is ubuntu 18.04 but when I try to use the same key on my production server (Amazon Linux) it failed ...
2
votes
3answers
157 views

Use RSA key to encrypt/decrypt personal document

Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
1
vote
1answer
89 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
0
votes
0answers
58 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
0
votes
0answers
24 views

GPG keys generated with diceware entropy?

Considering the absolutely critical role that entropy plays in the generation of keys, I am wondering if there is an easy way to use diceware (true random numbers) to generate an OpenPGP key with ...
1
vote
1answer
459 views

Decrypt file using Key and Initialization Vector in Linux

I am Salesforce developer but new to the Security World as well as Linux. We encrypted a file with Key and initialization Vector in Salesforce(only symmetric encryption is possible in Salesforce). No ...
0
votes
1answer
61 views

secp256k1 GPG key?

Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
0
votes
0answers
72 views

What should I do next on my GPG key after my computer is seized by authority?

Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
0
votes
0answers
24 views

GnuPG verify signature *after/while* decrypting does not fail when it should

I'm encrypting and signing data with the PHP function gnupg_encryptsign() (docs) which has the strange behaviour of signing first and encrypting afterwards. I'm aware of this thread saying this is ...
1
vote
1answer
70 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
1
vote
0answers
131 views

GPG unattended ECC key and subkey generation

I wanna generate a ECC key which primary key is just for cert and has 3 subkeys for auth, sign, encrypt. I've found 2 methods to generate it. But I wanna unattended key generation via gpg —-batch —...
0
votes
1answer
80 views

Can a deleted PGP secret key be recovered from private-keys-v1.d directory?

Executing gpg -K --with-keygrip returns one key entry. However the private-keys-v1.d directory has two entries. I assume that one of them belongs to a secret key that has been deleted/removed. Is ...
0
votes
0answers
51 views

create gpg public key from subkey

I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically. For my communication ...
0
votes
1answer
110 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
0
votes
0answers
64 views

How is private key encrypted after export?

For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
1
vote
1answer
53 views

How can one read the time in GPG's Literal Data Packet?

RFC 4880 says that the Literal Data Packet's time stamp is four octets long. Listing packets shows that it is five octets long, at least in GnuPG 2.2.6. The time stamp comes after the word "created", ...
0
votes
1answer
73 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
75 views

Can a new signature be added to an already signed message?

Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) ...
1
vote
0answers
61 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
-6
votes
1answer
341 views

How can I get rid of the MDC packet in OpenPGP?

I want to get rid of the MDC packet in OpenPGP because I view SHA1 as a catastrophic threat. If one can invert SHA1, then all plaintext in OpenGPG is ... open. If one tries to go back to RFC 2440 ...
0
votes
0answers
40 views

How can I input a raw session key into GnuPG?

How can I input a raw session key into GnuPG? I presume that I will have to use --sk2-cipher-algo and --sk2-digest-algo at the same time so as to accommodate the length of my chosen session key. ...
5
votes
1answer
133 views

Superceding a passphrased key with a token-based key

I've been using a GPG key for awhile (mostly with the pass password manager but also some with mail). Since it's now in use, a few years old, and entering the passphrase is getting tiresome, I ...
1
vote
0answers
43 views

--s2k-mode 0 session key from equal-length passphrase

In gpg2, how exactly does --s2k-mode 0 go from the passphrase to the session key in this example: gpg2 --armor --s2k-mode 0 --s2k-digest SHA256 --s2k-cipher-algo CAMELLIA256 --symmetric [file path] ...
0
votes
2answers
185 views

Should I delete lost GPG key from GitHub?

I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don'...
0
votes
0answers
41 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
-2
votes
1answer
155 views

Is GPG symmetric (decryption) vulnerable?

Suppose a file (say, a text file source.txt) was encrypted into danger.gpg using GPG symmetric encryption on a compromised device. Since the device is compromised, danger.gpg could have been created ...
1
vote
1answer
952 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
1
vote
1answer
277 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
2
votes
2answers
311 views

Is it permissible to use GPG without an encryption key?

Will I be disapproved of or get frowned upon a lot if I choose to deploy and use GnuPG without an encryption key? E.g. I generate keys manually and skip the encryption key entirely. The reason is ...
0
votes
0answers
117 views

Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?

I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...
1
vote
1answer
257 views

How do I create a detached plain text signature?

If I use gpg --detach-sig file, then I get a small file.sig, but it is not plain text, so this is not useful if you wish to send the signature in a plain text format. If I use gpg --clearsign file, ...
0
votes
0answers
130 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
1
vote
1answer
185 views

Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?

I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
2
votes
1answer
524 views

How do I interpret output that produces gpg listing keys?

Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the ...
2
votes
1answer
113 views

Length of a stretched gnupg passphrase that is comparable in strength to an unstretched string of 256 random bits

Assume that we want to encrypt a file with gnupg using AES-256 as the encryption algorithm. (Hence, symmetric encryption.) In this mode, gnupg requires a passphrase from the user. I understand that ...
2
votes
0answers
104 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...