Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openpgp]

An open source version of the PGP (Pretty Good Privacy) encryption / decryption software. Primarily used for securing email communications.

4
votes
1answer
48 views

Is forward secrecy useful for an application where keeping message history is an integral part?

I am writing a decentralized application that lets certain privileged users post messages to other users. These messages should be encrypted so that only the two of them can read it. Messages are ...
0
votes
0answers
42 views

PGP file Decryption with gpg command [closed]

I am trying to decrypt pgp encrypted files. I had both public and private keys and I created two files like pub.key and sec.key and imported them using gpg --import pub.key gpg --import sec.key and ...
1
vote
0answers
34 views

How to display the SHA256 hash while signing or in signature

I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
0
votes
1answer
57 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
1
vote
3answers
91 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
2
votes
1answer
69 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
1
vote
0answers
73 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
3
votes
2answers
102 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
3
votes
1answer
73 views

How to prevent participants from cheating when establishing an OpenPGP-like structure

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. I also want to make sure that non of the parties can ...
1
vote
1answer
36 views

Share Document within user group

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. Situation: There are 5 participants (A, B, C, D). ...
1
vote
2answers
55 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
48 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
1
vote
0answers
280 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
0
votes
1answer
127 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
1
vote
3answers
178 views

Should I sign software release keys with my own key?

A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with. The problem When I verify a download, I usually stumble upon the following message: $...
1
vote
1answer
207 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
1
vote
1answer
82 views

GnuPG sub-keys revocation

My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored ...
2
votes
1answer
73 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
1answer
184 views

Is is safe to use PGP again?

The EFF has issued some instructions enitiled "How To Turn PGP Back On As Safely As Possible". The emphasis there is mine, and that qualifier worries me. Realistically, what risks do I run if I ...
3
votes
1answer
944 views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
-1
votes
1answer
97 views

Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?

The proposed method Brief and simplified description of the attack: Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
2
votes
1answer
73 views

In OpenPGP, when encrypting with public key — is it possible to not include the RSA key id?

In OpenPGP, when encrypting with public key -- is it possible to not include the RSA key id as plaintext in the metadata? I need to encrypt messages, but I want it to be impossible to identity the ...
49
votes
5answers
6k views

What actions should I, as an end user, take in response to EFAIL?

There's a lot of talk about EFAIL: The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...
0
votes
1answer
84 views

OpenPGP.js deterministic encryption?

I'm encrypting something with a public key generated using the ed25519 curve, with OpenPGP.js. It goes something like this: var options = { data: str, publicKeys: publicKeys, armor: false ...
0
votes
1answer
164 views

GPG key expiration and storage

I hope I came to right place to ask about GPG. I have created secret, public, and sign keys and set expiration dates for all keys in case I lose an access to them or forget a keyphrase, etc. I have ...
1
vote
0answers
32 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
2
votes
1answer
1k views

How to tell if a “PGP PRIVATE KEY BLOCK” is passphrase protected?

I've used gpg4win's Kleopatra tool to create an OpenPGP RSA personal certificate. I want to export the private key for several reasons (import it on another machine, as well as backing it up in ...
1
vote
1answer
50 views

What identifies an entity in PGP?

When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
0
votes
2answers
92 views

Securely transport secret token so it can not be used even if snooped?

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In ...
1
vote
1answer
444 views

When using HMAC-SHA256 do I must save the secret in the databse to verify the sender?

Many API's I found that using same method for authentication: Signature is a HMAC-SHA256 encoded message containing nonce, customer ID (can be found here) and API key. The HMAC-SHA256 code must be ...
2
votes
1answer
71 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
2
votes
1answer
1k views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
0
votes
3answers
181 views

Do I need a PGP key?

I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind: Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ...
3
votes
1answer
1k views

Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey

I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...
2
votes
1answer
2k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
2
votes
1answer
150 views

What are the consequences of revoking OpenPGP subkeys and generating new ones?

I almost feel stupid for asking this, but I have some trouble understanding subkeys, and what to do if a subkey gets compromised. Let's say my "main" private key is used for certification only. I ...
23
votes
2answers
3k views

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
1
vote
2answers
127 views

Is it possilbe to use an OpenPGP private key to sign a file via OpenSSL?

Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL? I've tried this: $ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key $ openssl rsautl -sign -in testfile ...
2
votes
1answer
72 views

Is it responsible to sign an OpenPGP key without verifying person's identity?

I frequently use GPG to verify downloads. By doing that I implicitly put trust in a key provided by the author. At least I trust the key enough to run software verified using the given key on my ...
4
votes
1answer
234 views

Is an OpenPGP signature made before a key is revoked considered valid?

If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
3
votes
1answer
59 views

Is it practical and/or secure to get my friends to remotely sign my OpenPGP public key?

My best friends would trust who I am and I would also trust who they are, without looking at our government-issued IDs. We went to the same schools and same classes for many years. However, they now ...
5
votes
1answer
462 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
1
vote
1answer
332 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
2
votes
1answer
198 views

How to get my OpenPGP keys signed?

I was wondering if anyone has any recommendations for getting my OpenPGP key signed by others. I live in the middle of nowhere, and there aren't meetup groups within 50 miles of me ever. How to get ...
0
votes
1answer
135 views

Are GPG Tools Keys Just Plains GnuPG Keys?

I generated a key pair with GPG Tools for Mac and exported the public and private key to a safe place. I assume that I can decrypt my stuff with this USB in any OS (e.g. Linux) and any GnuPG software....
2
votes
1answer
1k views

Forgot OpenPGP key's passphrase, can I recover key or files somehow?

I had two OpenPGP key files on two separate TAILS OS USB flash drives, but the most recent one fails to boot up. Then I discovered that I don't remember the old keys passphrase on the first USB flash ...
4
votes
1answer
105 views

Is my OpenPGP key rubbish because of bad entropy?

I had problems generating an OpenPGP key on my XUbuntu machine, because GnuPG did not get enough entropy. After some time of browsing and doing stupid stuff to generate more entropy, still nothing ...
3
votes
1answer
204 views

Does it defeat the purpose to create an OpenPGP authentication subkey that is not password-protected?

I'd like to be able to log into and out of my ssh servers freely without entering a password. Previously, I did this with ssh-keygen, storing the key file under my ~/.ssh directory. Since I also have ...
5
votes
1answer
293 views

What's the purpose of a PGP transition statement?

PGP key holders occasionally replace their old PGP master keys with newer PGP master keys (for example, to use securer algorithms). When doing this, PGP key holders want their new key to be signed by ...
3
votes
2answers
94 views

Is it possible to detect OpenPGP mails in TLS encrypted connections?

Regarding to the second point of 15 reasons not to start using PGP: Thanks to its easily detectable OpenPGP Message Format it is an easy exercise for any manufacturer of Deep Packet Inspection ...