The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

60 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
1answer
128 views

Superceding a passphrased key with a token-based key

I've been using a GPG key for awhile (mostly with the pass password manager but also some with mail). Since it's now in use, a few years old, and entering the passphrase is getting tiresome, I ...
5
votes
0answers
451 views

How can I sign an rpm package using a smart card?

I have a smart card (not OpenPGP card), and I am preparing to sign an rpm using this card. After signing, I will get two files: my.rpm.sig, and my_id.cer. How can I sign my rpm using these extra ...
4
votes
0answers
3k views

Which ECC to choose with GPG?

I want to generate a key pair with gpg2 2.1.11 and libgcrypt 1.6.5. I use the command gpg2 --expert --full-key-gen. This allows me to choose an ECC: Please select what kind of key you want: (1) ...
4
votes
0answers
365 views

Sharing subkeys among two master keys

I would like to have a GnuPG identity that I can use both for a long time (so that I can build a wide web of trust) and immediately with as many people as possible. As of today, the second goal is ...
3
votes
0answers
63 views

Import GnuPG Subkey to other Primary Key

Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
3
votes
0answers
183 views

yubikey creating different ssh public key having same GPG

I have 2 yubikeys and both are having the same GPG master key besides 3 subkeys for encrypting, signing and authentication, I can encrypt/decrypt and everything regarding gpg seems to be working fine, ...
3
votes
0answers
432 views

How to securely print private key and protect against attacks on printer itself?

The question is in the title, but below are my thoughts on this. As we know there are various possible attacks on printer, so it is not very secure to print high security things like private keys for ...
3
votes
0answers
352 views

Is it safe to encrypt multiple files with the same strong passphrase?

I use GPG to symmetrically encrypt multiple files, and it would be more convenient if they all had the same strong passphrase. It's possible that someone could gain access to several of these files. ...
3
votes
0answers
611 views

Specify AES key when using gpg

When using gpg to encrypt/decrypt a file with AES-256, is it possible to specify the 256-bit key directly (rather than have it derived from a passphrase)?
2
votes
0answers
88 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
2
votes
1answer
223 views

Use GPG smartcard and gpg-agent to protect multiple SSH keys

I have a Yubikey acting as a GPG smartcard. SSH is configured to use the smart card socket for authentication, and authenticating with the GPG key with Authentication capabilities work fine. ssh-add -...
2
votes
0answers
68 views

Does the output of --export-ssh-key change with different subkeys?

I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
2
votes
0answers
298 views

GPG: how to encrypt using a keyfile? (symmetric)

In Ubuntu this produces a "filename.txt.gpg" file and works: $ gpg --symmetric --passphrase-file keyfile.key filename.txt In debian, I get a popup requesting I enter a password... How do I encrypt ...
2
votes
0answers
287 views

PGP public key block Public-Key (old) - What does the OLD mean?

System: Linux Mint 19. Today I created a new GPG key pair using: gpg --full-generate-key I armor-exported the public key and have run: file *.public As a surprise I found my key or format or ...
2
votes
0answers
61 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
2
votes
0answers
146 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
2
votes
0answers
134 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
2
votes
0answers
263 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
2
votes
0answers
752 views

How to add another UID to key on OpenPGP card?

I have an OpenPGP key on a smart card that I've used for some time. I now wish to add some additional email-addresses to the key. So I insert my card into the reader and execute gpg2 --edit-key for my ...
2
votes
0answers
246 views

OpenPGP (RFC4880) - do you agree with my SimpleS2K (string-to-key) implementation?

Background: I'm writing a GPL Python OpenPGP to JSON parser which I'm testing on files generated with GPG 1.4.16. If given a passphrase, the parser will generate keys using the string-to-key methods ...
1
vote
1answer
67 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
1
vote
0answers
57 views

How to verify a binary correctly even if my github account is hacked by someone

I have a binary file and saved it on github release page. https://github.com/zono/bolt8/releases To allow users to verify it, I saved sha256sum and signature(.asc). However I have a concern that if ...
1
vote
0answers
41 views

--s2k-mode 0 session key from equal-length passphrase

In gpg2, how exactly does --s2k-mode 0 go from the passphrase to the session key in this example: gpg2 --armor --s2k-mode 0 --s2k-digest SHA256 --s2k-cipher-algo CAMELLIA256 --symmetric [file path] ...
1
vote
0answers
67 views

How to display the SHA256 hash while signing or in signature

I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
0answers
95 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
1
vote
0answers
75 views

Does gpg-agent cache passphrases per symmetrically encrypted file?

I have used the following command to symmetrically encrypt different files, all with the same passphrase: $ gpg -c --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-count 65536 some_file.txt ...
1
vote
0answers
681 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
1
vote
0answers
27 views

Generating new E and S subkeys for a key that has been moved to card

I accidentally messed up months ago by keytocard'ing a seret key before making an offline locked-away backup of it. I failed at reading comprehension and did not know that this would delete the key ...
1
vote
0answers
88 views

Primary uid of Key is not changeable

Recently I had to revoke one of my UIDs and add a new one in my main GPG Key. As I expected the new UID became primary and I tried to change it back to the original one (it's not the revoked one). ...
1
vote
1answer
265 views

Methods to work with offline primary keys

I created a number of profiles with separate subkeys for authentication, signature, and encryption while primary keys are saved on USB Stick. It's working alright but I was wondering if there are some ...
1
vote
0answers
36 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
1
vote
0answers
30 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
1
vote
1answer
522 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
1
vote
0answers
287 views

Unattended generation of “the perfect keypair”

I'm trying to generate a "perfect keypair" akin to https://linuxich.wordpress.com/short-manual-for-a-perfect-gpg-keypair-using-gpg-v2/ but I want to do it semi-automatized, in gpg2 terms that would be ...
1
vote
0answers
462 views

What is the best way of encrypting large files for a corporate use case?

We are creating backups that contain user information. Even though it is created in a closed environment, if there is a breach in our backup systems we would like to make it harder to use the stolen ...
1
vote
0answers
927 views

gpg 2.0 command line option to create UTF-8 data

With echo text | gpg2 --sign --textmode -a I can create messages with a one pass signature containing a Literal Data packet in TEXT ('t') format. If I skip the --textmode option it will generate ...
1
vote
0answers
133 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get to ...
1
vote
0answers
1k views

GPG based on-the-fly folder encryption

I am trying to find a good way to combine Owncloud with client-side encryption. Ideally, the requirements are: encryption relatively transparent (mostly text/.odt files) and cross-platform (Win, OS ...
1
vote
0answers
815 views

`gpg --keyserver subkeys.pgp.net` triggers error `armor-keys-failed`

$ gpg --keyserver subkeys.pgp.net --recv-key 0xXXXXXXXXXXXXXXXX gpg: requesting key FDXXXXXX from hkp server subkeys.pgp.net gpg: DBG: armor-keys-...
1
vote
0answers
1k views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K (string-to-...
0
votes
0answers
37 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
0
votes
0answers
20 views

GPG keys generated with diceware entropy?

Considering the absolutely critical role that entropy plays in the generation of keys, I am wondering if there is an easy way to use diceware (true random numbers) to generate an OpenPGP key with ...
0
votes
0answers
68 views

What should I do next on my GPG key after my computer is seized by authority?

Unfortunately, although my keys are protected by password, I am afraid it is not strong enough. I assume I lost control of all my private keys now. I still have backup of my private keys, what I want ...
0
votes
0answers
23 views

GnuPG verify signature *after/while* decrypting does not fail when it should

I'm encrypting and signing data with the PHP function gnupg_encryptsign() (docs) which has the strange behaviour of signing first and encrypting afterwards. I'm aware of this thread saying this is ...
0
votes
0answers
71 views

GPG unattended ECC key and subkey generation

I wanna generate a ECC key which primary key is just for cert and has 3 subkeys for auth, sign, encrypt. I've found 2 methods to generate it. But I wanna unattended key generation via gpg —-batch —...
0
votes
0answers
46 views

create gpg public key from subkey

I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically. For my communication ...
0
votes
0answers
63 views

How is private key encrypted after export?

For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
0
votes
0answers
37 views

How can I input a raw session key into GnuPG?

How can I input a raw session key into GnuPG? I presume that I will have to use --sk2-cipher-algo and --sk2-digest-algo at the same time so as to accommodate the length of my chosen session key. ...
0
votes
0answers
40 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
0
votes
0answers
109 views

Import ssh keys into gpg (openpgp) as mutliple authentication subkeys?

I have successfully converted ssh keys to gpg primary keys and then converted them to authentication subkeys using pem2openpgp. Unfortunately there is only one primary key and only one authentication ...