Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
2
votes
2answers
137 views

Can the GPG master secret key be stored as read-only?

Once you have generated your master PGP key, will the "data" in the private key ever change? For instance, if you add another subkey, uid, or any other data to the master key, do these changes need ...
6
votes
2answers
4k views

How to Conceal/Detect PGP Symmetric Algorithm Used

When Symmetrically encrypting a file, (not signing, not an asymmetric encryption question), is it possible to conceal the encryption algorithm used, or is it already concealed, but just showing on ...
0
votes
2answers
89 views

Attaching the same file to two separate email, does it compromise security of the “message”

When using (Thunderbird and) GnuPG to send a PGP/MIME message to two separate recipients, with the text body different in both messages, but the same file attached to both of them, does this give an ...
1
vote
1answer
1k views

GPG encryption and signing

Why don't the commands gpg2 --armor --sign file.txt and gpg2 --clearsign file.txt have the same output? Also when I use just --sign I get a bunch of binary gibberish surrounding the message in ...
1
vote
1answer
130 views

Security of sending information to stdout

By default, something like gpg -d file.gpg sends it's output to stdout. What happens to input that is sent to stdout? Is it possible to recover this?
0
votes
1answer
894 views

Linux SSH and GPG

Can anyone please give me a quick crash course on SSH and GPG? SSH: What is the difference between public and private keys? Should I back up my ~/.ssh/ directory, what are the security implications ...
0
votes
3answers
695 views

What is the technical rationale behind intermediary email servers?

EFF's Survelliance Self-Defense (SSD) project has an illustration of how email over SMTP goes through intermediate mail exchange servers: AFAIK each intermediate servers is expected to add its own ...
2
votes
1answer
2k views

GPG Different Passphrase for Subkey

Is it possible to have a different passphrase for a GPG subkey? The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files. Since I want run ...
1
vote
1answer
398 views

Encrypt a textfile with gnupg on the console [closed]

It is easy to decrypt an encrypted textfile with: gpg --decrypt /tmp/message But how can I encrypt my own textfile?
5
votes
1answer
899 views

Utility of multiple signing subkeys when we're restricted to a single encryption subkey in GnuPG (PGP)

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a ...
0
votes
1answer
1k views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
2
votes
1answer
363 views

GnuPG/OpenPGP in the corporate world

Is GnuPG/OpenPGP a good solution to protect internal company email communication? With PRISM and previous major company hacking news stories, I'm looking for a solid way to protect company ...
3
votes
1answer
389 views

Can I reencrypt my GPG private key with more password rounds?

As noted elsewhere, SSH private keys can be reencrypted (in different formats) with more rounds of iteration in the password-derivation function. Is there a way to do something similar for an already ...
6
votes
1answer
2k views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
12
votes
1answer
14k views

Why is GPG file encryption so much slower than other AES implementations?

Correct me if I'm wrong: When encrypting a file, GPG creates a one-off AES encryption key and encrypts that key using RSA. This is supposedly to take advantage of AES's superior performance when ...
10
votes
2answers
2k views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
1
vote
0answers
1k views

Location of passphrase digest in opengpg secring.gpg

I'm trying to understand the file format of the secring.gpg file. I couldn't really find any official documentation of the file format so I decided to create a new key-pair and use the S2K (string-to-...
1
vote
1answer
1k views

How does gpg know that a passphrase is bad in symmetric encryption?

Following from, What information is leaked from an OpenPGP encrypted file?, which was very helpful, I'd like to ask a similar question regarding symmetric encryption. For example, in a file encrypted ...
2
votes
2answers
1k views

How can I verify the GPG signature is valid?

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I ...
1
vote
1answer
1k views

Twofish gpg:WARNING: message was not integrity protected [closed]

I get this warning while I decrypt a Twofish-encrypted file in GPG. WARNING: message was not integrity protected. From what I found online, this warning should only come up for CAST5, not for ...
3
votes
1answer
357 views

Should generating gpg keys ever result in an identical key to an older key?

I recently had a situation where I lost an old private key (write error; realized this too late). In regenerating keys and replacing the public keys on various sites, I noticed that the public keys ...
5
votes
1answer
3k views

One user ID of a trusted key has unknown trust

I observed today that Thunderbird/Enigmail (24.2.0/1.6) does not allow me to select a key for encrypting mails to one of the addresses associated with the key, even though others work. Help sites ...
2
votes
3answers
253 views

Is it a good practice to include a download URL of my GPG public key in my email signature?

I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature. Is this a good practice? If not, what's a good alternative?
6
votes
1answer
1k views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
7
votes
2answers
746 views

GPG key trust after a signing party

I might be totally misunderstanding the concept of web-of-trust, but imagine the following scenario: I generate my key, then go to a key signing party, and after, I import all the keys which ...
2
votes
2answers
399 views

Using 1-day expiration GPG keys only… any disadvantages?

From the thread Does OpenPGP key expiration add to security? , we know that the faster the keys expire, the greater our security. The minimum expiration for a GPG key seems to be 1 day. Thus, isn't it ...
0
votes
1answer
984 views

In regards to GPG4Win, what does “use NAME as default secret key”?

1- what does "use NAME as default secret key" do in Kleopatra tool options? The reason why I ask this, is I have a looooong password for my certificate. And apparently this becomes a hassle when ...
0
votes
2answers
328 views

Sending messages using OTR & and GPG — is it detectable?

If I send messages using OTR & GPG, will my ISP or some surveillance agencies know that I'm using them? "Look, he's sending an encrypted message. He must have some important secret. Let's go ...
0
votes
0answers
66 views

What is the impact of the recent GPG acoustic key sniffing research? [duplicate]

I heard of the recent research that claims to have made possible the sniffing of even 4096-bit GPG keys under certain conditions. What is the impact of this vulnerability for home users? If this is a ...
5
votes
1answer
172 views

How do I sign another person's key and make the signature expire?

I'm using gnupg and I've just seen that people can sign keys with an expiration attached. The expiration of individual signatures can be seen in gpg --list-sigs <KEY> when setting this in your ....
0
votes
1answer
584 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
2
votes
1answer
1k views

GnuPG inner workings (encryption scheme, mode of operation, ciphers)

I have some questions concerning how GnuPG operates when encrypting and signing messages. By default: Which cipher and mode-of-operation is used for symmetric encryption? What encryption scheme is ...
0
votes
2answers
173 views

pgp decryption on public pc

When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible? I found tools to run from an USB stick ...
1
vote
1answer
368 views

I copied my .gnupg folder from Mac OS X, and now Seahorse lets me sign my own key. Is this normal?

I have a dual-boot setup with Mac OS X Mountain Lion and Debian GNU/Linux Sid (fully up-to-date). I installed gpg in OS X by executing brew install gpg. I then generated a keypair for myself to use. ...
4
votes
1answer
285 views

Speed of key generation - Is old hardware safer?

I'm currently generating a new gpg cryptographic key, and I'm using a new laptop for this. I can notice that the key generation step, which involves the random generation, is extremely quick, while I ...
11
votes
3answers
3k views

API message verification without storing private key?

I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
9
votes
2answers
8k views

How to use a Yubikey NEO (or any OpenPGP card or GnuPG in general) to sign X.509 CSRs?

Since the Yubikey NEO can be used as an OpenPGP card (see here) with three 2048 bit RSA keys, I thought about creating a CA from one of its public keys. Since the private key cannot be extracted (...
5
votes
3answers
1k views

Are private keys generated by different software packages compatible?

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, ...