Questions tagged [openpgp]
An open source version of the PGP (Pretty Good Privacy) encryption / decryption software. Primarily used for securing email communications.
169
questions
1
vote
1
answer
75
views
Restructure PGP Keys
How do I restructure my keys from current/old setup to new setup?
The new setup would allow better key-management: isolation of primary-key and rotation of sub-keys.
Current/Old Setup:
PrimaryKey - CS
...
- 31
0
votes
1
answer
324
views
Convert PGP key to X.509?
Can I convert a PGP key to X.509, using OpenSSL or GNUPG?
Aren't these only container/wrapper formats?
- 1,783
4
votes
1
answer
810
views
Should one really disable AEAD for recent GnuPG created PGP keys?
Apparently, there are some problems with the new defaults that are set when one creates a PGP key using a recent version of GnuPG (2.4).
I ran into this after generating a new ECC/ED25519 key to ...
- 143
0
votes
0
answers
135
views
Can I Use an OpenPGP Smart Card to Sign a TLS Certificate?
I've been looking around for smart cards with support for Ed25519. More specifically, I'd like to have a TLS CA with the private key on a YubiKey. The latest YubiKey 5 supports secp256k1, secp384r1, ...
- 6,823
0
votes
2
answers
1k
views
Backup GPG private key in KeePassXC
In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field.
Provided that the db file has very good password, is this ...
- 529
0
votes
1
answer
119
views
How can we ensure the best practice with mail pgp when the recipient is not using it?
How can we ensure the best practice with mail pgp when the recipient is not using it?, so when Bob send the vary first email to Alex, Bob signing and encrypted it?
Q1. In that case, Is Alex able to ...
- 17
1
vote
2
answers
179
views
What's the shortest message you need to claim ownership of another message?
Hypothetically, I'd like to demonstrate that I am the owner of a piece of published information. The requirements are the following.
The hash/ characteristic string is compact enough (ideally a few ...
- 121
1
vote
0
answers
222
views
Why does the fingerprint of a GPG key change after it is made a sub key?
I recently consolidated some of my independently GPG keys.
I used the following the command to edit the oldest key
gpg --expert --edit-key <oldest-keygrip>
gpg> add-key --keygrip=<another-...
- 111
1
vote
0
answers
388
views
Which PGP fingerprint to share/publish as my digital identity?
The primary secret key should be stored offline and only be used for creating/signing keys.
There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
- 11
0
votes
3
answers
187
views
Can secret recipients be included in PGP cryptography
Can we be sure that a cleartext message that becomes encrypted by pgp or openpgp which is intended for one-or-more specific recipients doesn't also get secretly decipherable by a third party? Since i ...
- 1
1
vote
0
answers
165
views
Using GPG is there a way to label public keys on my OpenPGP keyring?
I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
- 11
0
votes
1
answer
1k
views
PGP identity for Telegram account
I want to use a Telegram username instead of an email address in a PGP key.
Is there an agreed upon standard for doing this? Do you know a software or service which acts as a bridge to connect a PGP ...
- 121
0
votes
0
answers
156
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
- 142
4
votes
0
answers
471
views
Best practices for GPG user ids and mail extensions / catch-all addresses
Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
- 93
1
vote
1
answer
1k
views
How to fix import private key in GPG?
Since, I am new to gpg I wanted to generate a key pair. So I typed gpg --full-gen-key and inputted the following:
root@kali-linux:~# gpg --full-gen-key
gpg (GnuPG) 2.2.35; Copyright (C) 2022 g10 Code ...
- 113
1
vote
1
answer
729
views
Sub-key or new key-pair? (PGP/GPG Newbie)
I saw a PGP/GPG key of a dude on the internet with different sub-keys.
The reason is that when one sub-key expires, he creates a new one.
Now, from a security protective, is it better to create a new ...
- 31
0
votes
1
answer
650
views
Extract OpenPGP secret key material to use as X.509 root CA's key
At the moment, there are 2 cryptographic setups in place on the devices I use daily:
First, I have an OpenPGP key that I use to sign email, authenticate over SSH, and various other little things. Put ...
- 127
2
votes
0
answers
3k
views
Changing the encryption algorithm used for PGP/GPG private key
I've read a number of posts regarding changing the algorithm used to encrypt my private PGP keys. However, nothing I have tried seems to work. I am using gpg4win:
gpg (GnuPG) 2.3.4
libgcrypt 1.9.4
...
1
vote
1
answer
354
views
How best to cryptographically sign scientific papers?
Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone.
Usually these aren't high-...
- 181
3
votes
1
answer
611
views
Does gpg (or openpgp in general) authenticate symmetrically-encrypted data?
When using gpg --symmetric to encrypt a file/message with a passphrase, is there any cryptographic integrity check to prevent an attacker from modifying the ciphertext? E.g. does gpg (or any other ...
- 50.3k
3
votes
1
answer
4k
views
GnuPG now uses ECC 25519 as default on new key generation - any compatibility issues to worry about?
TL;DR: I'm assuming that if GnuPG made it a default then it should be what we use, but it used "bad" defaults in the past so I'm wondering if there are any tradeoffs to this? More ...
- 33
3
votes
3
answers
3k
views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
- 89
4
votes
1
answer
1k
views
What metadata is exposed by OpenPGP?
Say I have a file encrypted with GnuPG, in isolation (i.e., I don’t have the relevant keys). Can one then establish the recipients of the encryption? That is:
Name/E-Mail/Comment
Key ID
Or is this ...
- 143
0
votes
2
answers
632
views
Any reason why SHA-3 isn't yet present in GnuPG?
I was curious about setting SHA-3 as the preferred hashing algorithm for GPG but that looks like it is not yet supported and the documentation states this:
SHA-3: SHA-3 is a completely new hash ...
- 11
3
votes
1
answer
710
views
GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?
according to https://www.rfc-editor.org/rfc/rfc8032
EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or
114 bytes) for Ed25519 and Ed448, respectively;
But if I sign using Ed25519 in ...
12
votes
0
answers
563
views
PGP security with Thunderbird 78 email client
I have a query regarding best practice of using PGP to sign emails with Thunderbird 78.
Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
- 1,097
0
votes
2
answers
1k
views
No expiry for offline primary PGP key?
Are there benefits to set an expiration date on a PGP primary key which is only used offline?
Is setting an expiration date only on the subkeys enough?
- 493
0
votes
1
answer
246
views
How many keys do you use for signing and encrypting emails? [closed]
Situation
I have a university Gmail email address. I'm trying to migrate away from sending emails with the Gmail web client to one I have more control over like Thunderbird. It's also because Gmail ...
user242984
1
vote
2
answers
2k
views
Create CSR for S/MIME certificate from existing OpenPGP key pair
While increasing my communication security as much as possible, I came across OpenPGP & S/MIME and already use an OpenPGP key pair in both of my mail clients (PC & smartphone).
I believe the ...
- 113
0
votes
1
answer
421
views
keys.openpgp.org keyserver fails to send confirmation mail to an Outlook-address
I uploaded my master key's public part to the keys.openpgp.org-keyserver. It has 4 UIDs set up (4 different e-mail addresses) and each of them are correct and valid e-mail addresses.
The keyserver ...
- 101
4
votes
2
answers
363
views
A solution for the absence of Certifying Subkeys in OpenPGP Certs
As discussed in this answer, gpg does not offer the capacity for subkeys to certify (eg. "sign") other keys, though there may be good reason why it should, and they do sign at least one key. ...
- 398
1
vote
1
answer
1k
views
GnuPG - connecting to specific card reader when multiple reader available
Currently I can use
$ gpg --expert --card-status
to interact with smartcards that run the OpenPGP applet. Through trial-and-error, it seems that only the first card reader will interact with gpg. ...
- 192
0
votes
1
answer
908
views
How long does it take for a gpg key revoke certificate to propagate to all public key servers?
I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
- 3
3
votes
2
answers
900
views
Yubikey PGP migration
I am currently using a Yubikey 4 with my PGP subkeys on it.
My mainkey is stored within Kleopatra.
As I am planning to move over to a new Yubikey 5 I have asked myself if it is possible to still be ...
- 33
0
votes
0
answers
883
views
How to automatically sign a message using PGP in an email?
Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message.
For Example, A wants to send a message to B. A open its email ...
-2
votes
2
answers
4k
views
How does PGP Public and Private Keys work?
I recently tried to understand how PGP works:
I encrypt plaintext with my private key and if I send that encrypted text to others with my public key they can encrypt that with my public key?
- 1
1
vote
0
answers
1k
views
changing passphrase on gpg subkey
Is it possible to change passphrase on a subkey by:
gpg --edit-key sub_key_id passwd
Or will this change the passphrase on the master key as well?
(My idea stems from the fact that master key is ...
- 471
1
vote
1
answer
333
views
Web of trust and signature types? (sig1, sig2, etc)
I have read about The OpenPGP trust model but I don't see any mention of the specific signature types. Are all signature types (sig0 - sig3) treated the same by tools such as gpg or the PGP ...
- 1,710
4
votes
1
answer
808
views
How to list signatures of public key file without importing it to keyring?
How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available.
I would like a similar output to gpg --list-signatures <key-id>, but ...
- 155
1
vote
0
answers
159
views
OpenPGP and 3 Yubikeys, Best Practice for Encryption Subkey
New to OpenPGP. I have 3 Yubikeys, one for my laptop, one for my desktop, and one which I plan to keep in cold storage as a backup. My plan was to create a S/E/A subkey for each Yubikey, attached to ...
- 111
1
vote
1
answer
298
views
Can I resubmit my GPG key to a keyserver?
I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
- 579
3
votes
1
answer
146
views
Can any private key information be exposed when signing an email? [duplicate]
So I know that PGP encrypted email can be vulnerable to a known-plaintext attack from a known, consistant email footer or greeting (“Hello”, “Yours truly, xxx”, etc), but does the same thing apply to ...
- 31
1
vote
1
answer
335
views
alternatives to the "PGP pathfinder" [closed]
The author of the PGP pathfinder deceased this year. Shortly after the data was not updated any more.
Are there any alternatives known to find signature paths?
- 155
5
votes
1
answer
12k
views
How do PGP keys "expire"?
When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
user216316
0
votes
1
answer
589
views
secp256k1 GPG key?
Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
- 1,710
2
votes
3
answers
1k
views
In PGP how can I be sure about the public key?
I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
- 131
1
vote
1
answer
4k
views
Difference between OpenPGP symmetric encryption and AES-256?
I would like to understand the difference between:
OpenPGP symmetric encryption
and
AES-256 using Winzip/7-zip?
I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
- 123
5
votes
1
answer
2k
views
gpg: Every private key export (of the same key-pair) is different
gpg version: 2.2.16 (as part of Gpg4win 3.1.9).
Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
- 51
1
vote
1
answer
497
views
Creating pointers to keys on SmartCard
I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task.
I am trying to sign a file with a private key stored on a YubiKey device.
Here is my session:
$ ...
- 111
5
votes
0
answers
359
views
Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?
I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
- 51