Questions tagged [openpgp]

An open source version of the PGP (Pretty Good Privacy) encryption / decryption software. Primarily used for securing email communications.

Filter by
Sorted by
Tagged with
1
vote
1answer
111 views

How do PGP keys “expire”?

When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
0
votes
0answers
19 views

GPG keys generated with diceware entropy?

Considering the absolutely critical role that entropy plays in the generation of keys, I am wondering if there is an easy way to use diceware (true random numbers) to generate an OpenPGP key with ...
0
votes
1answer
46 views

secp256k1 GPG key?

Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
2
votes
3answers
164 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
0
votes
1answer
85 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
0
votes
1answer
59 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
99 views

Creating pointers to keys on SmartCard

I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task. I am trying to sign a file with a private key stored on a YubiKey device. Here is my session: $ ...
1
vote
0answers
89 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
1
vote
1answer
565 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
1
vote
1answer
200 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
0
votes
0answers
115 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
1
vote
0answers
21 views

Can I use my Microsoft Outlook S/MIME certificate with gpgsm.exe

So I work for a large company that has their own internal CA and maintains their own set of S/MIME certificates. We periodically have to re-enroll in S/MIME and import the certificate into Microsoft ...
4
votes
1answer
68 views

Is forward secrecy useful for an application where keeping message history is an integral part?

I am writing a decentralized application that lets certain privileged users post messages to other users. These messages should be encrypted so that only the two of them can read it. Messages are ...
1
vote
0answers
61 views

How to display the SHA256 hash while signing or in signature

I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
1answer
100 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
2
votes
3answers
181 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
1answer
132 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
1
vote
0answers
93 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
3
votes
2answers
105 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
3
votes
1answer
75 views

How to prevent participants from cheating when establishing an OpenPGP-like structure

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. I also want to make sure that non of the parties can ...
1
vote
1answer
38 views

Share Document within user group

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. Situation: There are 5 participants (A, B, C, D). ...
1
vote
2answers
205 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
86 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
1
vote
0answers
658 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
1
vote
1answer
261 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
1
vote
3answers
254 views

Should I sign software release keys with my own key?

A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with. The problem When I verify a download, I usually stumble upon the following message: $...
2
votes
1answer
537 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
3
votes
1answer
282 views

GnuPG sub-keys revocation

My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored ...
2
votes
1answer
83 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
1answer
204 views

Is is safe to use PGP again?

The EFF has issued some instructions enitiled "How To Turn PGP Back On As Safely As Possible". The emphasis there is mine, and that qualifier worries me. Realistically, what risks do I run if I ...
7
votes
1answer
2k views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
-1
votes
1answer
102 views

Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?

The proposed method Brief and simplified description of the attack: Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
2
votes
1answer
110 views

In OpenPGP, when encrypting with public key — is it possible to not include the RSA key id?

In OpenPGP, when encrypting with public key -- is it possible to not include the RSA key id as plaintext in the metadata? I need to encrypt messages, but I want it to be impossible to identity the ...
50
votes
5answers
6k views

What actions should I, as an end user, take in response to EFAIL?

There's a lot of talk about EFAIL: The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...
0
votes
1answer
116 views

OpenPGP.js deterministic encryption?

I'm encrypting something with a public key generated using the ed25519 curve, with OpenPGP.js. It goes something like this: var options = { data: str, publicKeys: publicKeys, armor: false ...
0
votes
1answer
267 views

GPG key expiration and storage

I hope I came to right place to ask about GPG. I have created secret, public, and sign keys and set expiration dates for all keys in case I lose an access to them or forget a keyphrase, etc. I have ...
1
vote
0answers
36 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
2
votes
1answer
2k views

How to tell if a “PGP PRIVATE KEY BLOCK” is passphrase protected?

I've used gpg4win's Kleopatra tool to create an OpenPGP RSA personal certificate. I want to export the private key for several reasons (import it on another machine, as well as backing it up in ...
1
vote
1answer
60 views

What identifies an entity in PGP?

When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
0
votes
2answers
94 views

Securely transport secret token so it can not be used even if snooped?

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In ...
1
vote
1answer
587 views

When using HMAC-SHA256 do I must save the secret in the databse to verify the sender?

Many API's I found that using same method for authentication: Signature is a HMAC-SHA256 encoded message containing nonce, customer ID (can be found here) and API key. The HMAC-SHA256 code must be ...
2
votes
1answer
76 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
3
votes
1answer
2k views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
0
votes
3answers
283 views

Do I need a PGP key?

I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind: Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ...
3
votes
1answer
2k views

Windows GnuPG - GPG - Smart Card Status - Not Detecting Yubikey

I have a Yubikey 4. On a Windows 7 64 bit machine I installed Gpg4Win which includes GnugPG. I was able to successfully import public keys. I plugged in the Yubikey 4 and Windows correctly ...
2
votes
1answer
2k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
2
votes
1answer
183 views

What are the consequences of revoking OpenPGP subkeys and generating new ones?

I almost feel stupid for asking this, but I have some trouble understanding subkeys, and what to do if a subkey gets compromised. Let's say my "main" private key is used for certification only. I ...
27
votes
2answers
4k views

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab What is going on here?
1
vote
2answers
173 views

Is it possilbe to use an OpenPGP private key to sign a file via OpenSSL?

Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL? I've tried this: $ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key $ openssl rsautl -sign -in testfile ...
2
votes
1answer
75 views

Is it responsible to sign an OpenPGP key without verifying person's identity?

I frequently use GPG to verify downloads. By doing that I implicitly put trust in a key provided by the author. At least I trust the key enough to run software verified using the given key on my ...