Questions tagged [gnupg]

GNU Privacy Guard (GnuPG or GPG) is an open source implementation of PGP, a file encryption and signature tool widely used for emails

Filter by
Sorted by
Tagged with
3
votes
2answers
260 views

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
2
votes
1answer
277 views

Can I restore gpg private key from raw data to enigmail?

I have recovered data from my local storage. The most valuable for me was to recover the private gpg key. I have found it in raw data files, I did delimitation based on the headers and footers. Now I ...
2
votes
1answer
79 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
2
votes
1answer
76 views

Is it wise to remove redundant self-signatures from my PGP key?

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there: $ gpg --list-sigs AAAAAAAAAAAAAAAA pub 4096R/AAAAAAAA 2014-...
2
votes
0answers
138 views

Is it safe to retrieve GnuPG public/secret key with fs in Node.js?

So there is a Node.js package openpgp which is available for signing documents with GPG, but it requires public/secret key. We all know putting key right into the file is dangerous and not recommend ...
1
vote
0answers
878 views

How to verify certificate fingerprint? [closed]

I downloaded Veracrypt and its sig file. I go ahead and import it into Kleopatra to verify it (using Windows gpg4win). Now i reach this step: It asks me whether i have verified the fingerprint. How ...
1
vote
0answers
31 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
6
votes
1answer
505 views

Forward secrecy with GnuPG

I'd like to know how to implement forward secrecy using GnuPG, and I presume I need some kind of authenticated key exchange. Assuming that I have the following working already: Alice and Bob have ...
-2
votes
1answer
198 views

PGP private key and decryption issues

I have created a private and public key set and encrypted a message to a friend with their public key. I then turned off my machine, and since it is not in persistence mode, my keys were deleted, but ...
32
votes
4answers
46k views

gpg --encrypt fails

When trying to encrypt files, I get the following error in KGpg editor window: The encryption failed with error code 2 On the command line I get: $ gpg --list-keys /home/user/.gnupg/pubring.gpg -...
0
votes
1answer
146 views

How to use master password for GPG encryption after setting up Yubikey? [closed]

I just setup my Yubikey 4 on Windows. How can I use master password for signing/encrypting when I don't have my key? If the yubikey is not inserted I get an error "Please insert the card with serial ...
2
votes
1answer
509 views

Best way to implement PGP company wide [closed]

What is the best way to implement PGP/GnuPGP company wide? Go to each users workstation, create the keys, upload the public key, and move on to the next?
4
votes
1answer
601 views

Revoking signing keys: do they still work afterwards?

Scenario: I have multiple signing subkeys, each for every portable device (i.e laptop). None of them have private master key (it is deleted following the tips in Alex Cabal's post. One of the devices ...
2
votes
1answer
2k views

How can I check the integrity of a Bitcoin tarball with GPG?

I plan on running several so called Full node servers with bitcoind (Bitcoin Core daemon). All servers are running GNU/Linux Debian Stretch. How do I verify integrity of the downloaded tarball with ...
1
vote
0answers
88 views

What does it mean to have an unknown key in my `gpg --list-keys` [closed]

I have just set up GPG for the first time. When I do gpg --list-keys I see a key other than my own (which is also there) about which I have no idea how it got there, what does this mean? (I don't even ...
7
votes
5answers
3k views

How to export my Protonmail private key?

From: https://github.com/scastiel/protonmail-export 1) Open the ProtonMail app and log out completely. You should now see the login screen. 2) Open the dev tools of your browser, and the ...
13
votes
1answer
3k views

GPG encryption subkey on multiple smart cards issue

Is there a way to tell GPG, that if it needs to decrypt something, that it can find the private encryption key on one of two smart cards? My (simplified) setup is as follows: Generated a master key ...
5
votes
1answer
465 views

Best archive format for cryptographic signing?

I want to sign a whole directory of files using GPG, and that entails creating an archive or compressed file, since GPG can only sign a file, not a directory. However, I imagine that some archive ...
9
votes
4answers
14k views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
2
votes
1answer
3k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
4
votes
1answer
110 views

GnuPG - Symmetric crypt with a null key

As the title tells it, is it possible, using GnuPG, to do a symmetric encryption on a file, using a "null" key so when you do a gpg --output doc --decrypt foo, it'll decrypt it without asking for a ...
1
vote
1answer
168 views

Use cases for GnuPG's --(import|export)-options (import|export)-(clean|minimal)

I'm wondering in which scenarios I would make use of GnuPG's non-default --(import|export)-options (import|export)-(clean|minimal)? The only practical use case I can imagine is to export my public ...
6
votes
2answers
2k views

Restore GPG key after exported to a smartcard

After exporting my private key, I moved my private key on a smart card using keytocard. This worked fine, and I could sign and use GnuPG as expected. Now I would like to go back to have the private ...
2
votes
1answer
89 views

Prevent GPG from exposing portion of private key

I have three keys; I'll refer to them as 'foo' [C], 'bar' [SE], and 'baz' [A]. Whenever I run gpg2 --export-private-subkeys baz!, it asks for a password, as it should. However, if I click 'Cancel', ...
4
votes
1answer
854 views

What information is in a gpg cleartext signature?

What information does a gpg2 signature contain? If you clearsign an empty file, the signature looks like this: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 -----BEGIN PGP SIGNATURE----- Version: ...
0
votes
3answers
325 views

Do I need a PGP key?

I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind: Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ...
10
votes
3answers
951 views

Is it safe to publish public PGP authentication subkeys?

Suppose I have a PGP key set up as follows: I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys. Then I create three ...
2
votes
1answer
988 views

How can I validate imported keys with GPG?

Recently, I downloaded several public keys with gpg, in order to fix Debian package system after upgrading to Stretch. The commands were: # gpg --recv-keys EF0F382A1A7B6500 # gpg --recv-keys ...
3
votes
1answer
622 views

What do these signatures of my PGP key mean?

When I was viewing the key information of my PGP key on a key server, I couldn't understand the meaning of some of the signatures. Here is the key information from the key server(https://pgp.mit.edu/...
8
votes
1answer
1k views

pubring.gpg and pubring.gpg~ at install - why?

I've just installed GPG Suit and have pubring.gpg and pubring.gpg~ in ~/.gnupg. Why? Thank you. ~ cd .gnupg/ ~/.gnupg ls -a . .. gpg-agent.conf gpg.conf pubring.gpg pubring.gpg~ secring.gpg ...
5
votes
1answer
827 views

One public key contains all subkeys?

I've created a keypair with gpg2 --gen-key Then I created a subkey only for signing. If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypting and one for ...
5
votes
1answer
610 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
1
vote
1answer
811 views

With private keys and public keys which is used for which: encrypt, sign, verify, and decrypt?

I understand the functions of PGP key-pairs as: Public key is used to encrypt files so only the private key holder can read them Private key is used to decrypt files that were encrypted using the ...
30
votes
2answers
7k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
4
votes
1answer
175 views

GPG key handling with Server

I'm using a VPS as a development machine and need gpg a) for signing git commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel ...
2
votes
1answer
122 views

Rationale for subkeys in OpenPGP?

I have seen from different sources that the sole purpose of the master key should really be to generate the subkeys, and that it should be subsequently backed up to an offline location and deleted ...
5
votes
3answers
1k views

How to decrypt a file encrypted under multiple public keys GPG

According to https://www.gnupg.org/gph/en/manual/x110.html To decrypt a message the option --decrypt is used. You need the private key to which the message was encrypted. Similar to the ...
4
votes
1answer
348 views

Generate subkeys based on less secure OpenPGP primary key

I've been reading about the benefits of using OpenPGP subkeys for different machines. Obviously, it's a much safer practice than copying around the same master key between multiple machines (...
1
vote
2answers
183 views

Is it possilbe to use an OpenPGP private key to sign a file via OpenSSL?

Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL? I've tried this: $ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key $ openssl rsautl -sign -in testfile ...
1
vote
2answers
54 views

Are these gpg commands identical?

I've found gpg -c < unencrypted_file > encrypted_file this command from https://askubuntu.com/questions/27770/is-there-a-tool-to-encrypt-a-file-or-directory this page, but in gpg manual it says ...
2
votes
1answer
113 views

Including GPG Transition statement as a signing policy

Assume that I am transitioning from key A to key B by signing key B with key A and then revoking key A. What do you guys think of including a link to my online transition statement in my signature of ...
2
votes
2answers
85 views

Analysis of gpg2 packets

I want to mentally visualize or just understand a gpg-signature. When running $ gpg2 --list-packets --verbose < test.sig the output is # off=0 ctb=89 tag=2 hlen=3 plen=540 :signature packet: ...
-2
votes
1answer
395 views

How does GPG2 --verify knows who signed a file and how? [closed]

When I (clear)sign a file, the output is something like this. $ gpg2 --clearsign test $ cat test.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This is a test! -----BEGIN PGP SIGNATURE----- ...
11
votes
5answers
4k views

Is a part of an encrypted file easier to crack?

After encrypting a file (GPG with AES) and splitting it into chunks (split), is it easier to crack one of the parts compared to the complete file? (Maybe because it may loses some important bits.)
3
votes
1answer
278 views

Does “Armoring” an encrypted string always produce the same length output if plaintext was same length?

I plan on encrypting numerous plain text strings which all have the same initial length. I plan on encrypting with AES-128 bit key using GPG. I plan on "armoring" the output into alphanumeric ...
3
votes
1answer
544 views

Strong password for GPG key or encrypt password database with GPG key?

I have a password database, that can be secured by a passphrase or by providing a GPG key. I have a GPG key that can be secured via a good password that I can remember, or via a great password that I ...
5
votes
2answers
608 views

Is it more secure encrypting 3 times with GPG?

Let's say we are using 3 different length passphrases and 3 different algos to encrypt sensitive data, e.g: gpg --symmetric --cipher-algo CAMELLIA256 < input.zip > output1 (random 100 ...
4
votes
1answer
346 views

Is an OpenPGP signature made before a key is revoked considered valid?

If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
8
votes
3answers
1k views

GnuPG warning for a signed key with trust level 4

When encrypting a document with a public key I got a warning: $gpg --encrypt -r 6B7F10E4 file.pdf It is NOT certain that the key belongs to the person named in the user ID. If you *really* know ...
2
votes
1answer
205 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...