Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
2
votes
1answer
333 views

One GPG key with multiple user identities for my career?

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs. My understanding is that there are two ways this could be done: Have one main/master GPG ...
1
vote
1answer
407 views

Why does the revocation sent to the OpenPGP keyservers not show up?

I have created a new OpenPGP key pair. So I wish to revoke the former, I have used. Here's what I managed to do so far. This way I found that my email's ID is 3C76732B: gpg --search [email address ...
17
votes
4answers
24k views

Can I specify a public key file instead of recipient when encrypting with GPG

Can I do something like: gpg --public-key my.pub -e file.txt If I can, any reason that I should not do that? P/s: I think I don't need to know about the recipient because my machine only has one ...
2
votes
2answers
165 views

GPG: Change expected card number

I have switched from a YubiKey 4 to a YubiKey 5. Both have the same GPG keys stored. After storing the key on the first YubiKey, I fetched my public key so GPG knows where to look for the private key. ...
4
votes
1answer
133 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
8
votes
1answer
581 views

Preparing to change over to new GPG-key - what to do with my old ones?

I've just created a new off-line GPG-key with a sign/certify master-key and two sub-keys - one for signing and one for encrypting. 5 yr expiration for the master, 2 yr for the subs. My master-key got ...
43
votes
7answers
11k views

Is layered encryption more secure than long passwords?

The comments in this question debate about the added security of multi-layered encryption. There seems to be some disagreement, and I thought a proper question would be helpful here. So, to provide ...
6
votes
4answers
3k views

How to use multiple smart cards with gnupg?

I have two smart cards: SCard1 and SCard2. The same keys are stored on both of them. One of the feature I use the most is SSH authentication to access multiple servers. But I cannot use the second ...
4
votes
3answers
3k views

Where can I find the detailed manual page for gpg --list-secret-keys output

I get confused about the terms used in the output of gpg --list-secret-keys For example what is the meaning of following: sec sec# ssb ssb> there are many codes being used in the output. Can ...
0
votes
0answers
32 views

Know the setting used in creating key pair in GNUPG4Win version 3.15

I am using GNUpg4Win version 3.15. For the last few hours I am trying to figure out what default settings are used for Cipher and Hash during key generation. Basically I want to use AES-128, 3DES ...
12
votes
4answers
6k views

Is there a limit on the layers of encryption a file can have?

Consider symmetric GPG encryption of a given file my_file.txt. Something like (in command line) gpg --symmetric --cipher-algo AES256 my_file.txt After suppying the prompt with the new password, the ...
0
votes
0answers
156 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
2
votes
1answer
158 views

gpg ignores passphrase on my key stored on yubikey 5 nfc

I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A). While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
1
vote
0answers
73 views

Is GPG's AES encryption that much stronger than its RSA headers? [duplicate]

Correct me if I'm wrong at any point of this questino. I understand that AES is a lot cheaper to compute than RSA (or any form of asymmetric encryption) and that that is why GPG and similar programs (...
4
votes
1answer
142 views

How do GnuPG smartcard generate reliable random data?

I'm generating a private key on my new GPG smartcard at this very moment. On linux, the random would be fed by the keystrokes on my keyboard, the network packets, the mouse movements etc. How does ...
1
vote
0answers
83 views

How to display the SHA256 hash while signing or in signature

I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
1answer
109 views

What are a keypair and a public key ring?

The GNU Privacy Handbook says: The command-line option -gen-key is used to create a new primary keypair. gpg --gen-key Does a keypair mean a pair of private key and public key? The book also ...
2
votes
1answer
389 views

Why is GPG-agent still caching my passphrase?

I can not get gpg to prompt me for my passphrase when I want to decrypt a file. I tried including: default-cache-ttl 0 max-cache-ttl 0 (also flipped the bit to 1) within ~/.gnupg/gpg-agent.conf ...
1
vote
1answer
121 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
1answer
26 views

Leaking `.gnupg` directory when private keys are stored on a smart card

What security risks can be caused by leaking .gnupg directory (for example, accidentally committing it to GitHub) when private keys are stored on a smart card?
28
votes
7answers
13k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
4
votes
1answer
1k views

OTP vs. U2F for online banking and email (vs. store key on USB)

Which one among OATH HOTP, OATH TOTP on one side (say in the form of a credit card-sized token) and U2F (say in the form of a USB key) on the other side you think is more secure for purposes like ...
3
votes
0answers
72 views

Import GnuPG Subkey to other Primary Key

Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
2
votes
2answers
267 views

On gpg2's symmetric decryption

According to an answer and comments in a earlier question of mine, when one uses gpg2 to symmetrically encrypt a message, gpg2 randomly generates a one-time encryption key for that message, as well as ...
23
votes
2answers
27k views

What is the default cipher algorithm for GnuPG?

I know, that one can force GnuPG to use AES256 for encryption with gpg --cipher-algo AES256 or with a special setting in ~/.gnu/gpg.conf. But, what is the default cypher algorithm for GnuPG, if I ...
1
vote
1answer
166 views

On the use of gpg2 for long-term encryption

I am looking for tools/libraries for symmetrically encrypting millions of files (many terabytes' worth of content). In particular, I am exploring the possibility of using gpg2 for this1. One concern ...
0
votes
1answer
440 views

The passphrase in gnupg's symmetric vs asymmetric encryption schemes

This question is admittedly artificial. Its purpose is only to help me understand aspects of gnupg that I can't figure out from reading the documentation. One thing that puzzles me about gnupg is ...
3
votes
1answer
573 views

How can I generate a .gpg file for verifying Putty?

I downloaded the Putty installer from ssh.com, which said To import the signature key into GPG, use: gpg --import putty-release-2015.asc To check the signature of a file, use: gpg -...
0
votes
1answer
337 views

I can't get gpg-zip to work. What am I doing wrong?

I haven't used gpg-zip before. I am trying to compress and encrypt a directory with more than 200 files. I did a test run with a smaller directory containing just a dozen PDFs in it, a folder I'll ...
0
votes
0answers
103 views

What are the possible ways to manage gpg keys over period of 10 years?

What key curation can be applied to a personal gpg keypair over a period of time (e.g. 10 years) if I also want to use the keypair for professional use? What are the measures that I need to take to ...
3
votes
1answer
47 views

Can I use 3 same subkeys to 2 different GPG Smartcards?

Generated keys on an air-gapped PC. Backed-up my .gpg folder on a USB. Imported keys to smartcard 1. Keys deleted Replaced .pgp folder with .pgp from USB Imported keys to smartcard 2. Is this setup ...
2
votes
3answers
225 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
0answers
74 views

Does the output of --export-ssh-key change with different subkeys?

I use gpg --export-ssh-key to generate a public RSA key I can add to my authorized_keys file for the purposes of accessing my server via SSH. I have two Yubikeys (Yubikey 5 NFC) with the same subkeys ...
2
votes
1answer
352 views

Why can GPG sign messages but not keys?

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am ...
2
votes
1answer
345 views

How to verify file Integrity?

I have downloaded a software(zipped), from a website: example-linux.gtk.x86_64.zip There is another file given for verification, example-linux.gtk.x86_64.zip.asc, whose content are -----BEGIN PGP ...
0
votes
1answer
48 views

Downloads and GPG singnatures [duplicate]

I've recently installed Kleopatra in order to use GPG for confirming the validity of downloads. I've downloaded the following (32-bit verison): https://www.claws-mail.org/win32/ I also downloaded the ...
3
votes
1answer
159 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
120 views

Are there risks to having many uids on my gpg key?

I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
1
vote
1answer
65 views

Making a offline GNUPG2-key - should I make Master-key S&E or S only?

I want to make an offline-key in GNUPG2 - ie. a "Master-key" to which I'll add one or more sub-keys for daily use, before storing the whole thing on an USB. I will then remove the secret part of the ...
3
votes
1answer
2k views

Generating a GPG key with a expiration date

I'm looking a way to generate a GPG key with a given expiration date. In GPG/GPG2, when you create a new key you can set a date only in signature, but the key expiration date is always set to zero. :...
3
votes
1answer
2k views

Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey

I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...
1
vote
0answers
96 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
1
vote
1answer
19 views

Listing available hashes in GNUPG2?

I want to use the setpref command (under --edit-key ) to set a key's prefered hash-algorithms in gnupg2, and was wondering if there is a way to list which hashes my version of gpg supports?
0
votes
2answers
390 views

Openssl / OpenPGP file encryption - security advise [duplicate]

I am planning to use Openssl to encrypt our weekly offsite backups using a keyfile (symmetrical encryption) and after some research I found the following GnuPGP command: base64 -w0 <keyfile.jpg | ...
1
vote
0answers
47 views

Response to a gpg fingerprint collision [duplicate]

I recently updated my gpg key and extended its expiration date for another year. Unlike prior years, I decided to 'look myself up' on http://keys.gnupg.net, and was shocked to find my name and email ...
1
vote
1answer
2k views

openssl vs gpg for file based encryption? Pros vs cons for security?

I want to encrypt a tar archive and optionally a block file system (akin to DMG image). Does anyone know the pros vs cons of encrypting each with OpenSSL vs GPG? I ask because some have stated that ...
1
vote
2answers
315 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
0answers
81 views

Does gpg-agent cache passphrases per symmetrically encrypted file?

I have used the following command to symmetrically encrypt different files, all with the same passphrase: $ gpg -c --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-count 65536 some_file.txt ...
1
vote
0answers
744 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
2
votes
0answers
336 views

GPG: how to encrypt using a keyfile? (symmetric)

In Ubuntu this produces a "filename.txt.gpg" file and works: $ gpg --symmetric --passphrase-file keyfile.key filename.txt In debian, I get a popup requesting I enter a password... How do I encrypt ...