Questions tagged [openpgp]

An open source version of the PGP (Pretty Good Privacy) encryption / decryption software. Primarily used for securing email communications.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

How to list signatures of public key file without importing it to keyring?

How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available. I would like a similar output to gpg --list-signatures <key-id>, but ...
1
vote
0answers
37 views

OpenPGP and 3 Yubikeys, Best Practice for Encryption Subkey

New to OpenPGP. I have 3 Yubikeys, one for my laptop, one for my desktop, and one which I plan to keep in cold storage as a backup. My plan was to create a S/E/A subkey for each Yubikey, attached to ...
0
votes
0answers
68 views

How do I verify a signature by using a OpenPGP public key without User ID (Redacted User IDs)?

Background Traditionally, in addition to cryptographic data, an OpenPGP public key contains User IDs and 3rd-party signatures for identification and Web-of-Trust verification, and it's distributed by ...
0
votes
1answer
29 views

Can I resubmit my GPG key to a keyserver?

I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
3
votes
1answer
52 views

Can any private key information be exposed when signing an email? [duplicate]

So I know that PGP encrypted email can be vulnerable to a known-plaintext attack from a known, consistant email footer or greeting (“Hello”, “Yours truly, xxx”, etc), but does the same thing apply to ...
1
vote
1answer
66 views

alternatives to the “PGP pathfinder” [closed]

The author of the PGP pathfinder deceased this year. Shortly after the data was not updated any more. Are there any alternatives known to find signature paths?
0
votes
0answers
10 views

can i not change the pgp encryption expiry once it is set? [duplicate]

how do i fix the encryption status to 'good' I tried changing the expiry date it only changes the 'Cerify/sign' one. can i not change the pgp encryption expiry once it is set?
1
vote
1answer
520 views

How do PGP keys “expire”?

When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
0
votes
0answers
26 views

GPG keys generated with diceware entropy?

Considering the absolutely critical role that entropy plays in the generation of keys, I am wondering if there is an easy way to use diceware (true random numbers) to generate an OpenPGP key with ...
0
votes
1answer
72 views

secp256k1 GPG key?

Given that secp256k1 is used to underpin the entire Bitcoin network (worth $174B as of today) -- it appears to offer demonstrably better security than other EC curves as no one has yet taken the ...
2
votes
3answers
193 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
0
votes
1answer
131 views

Difference between OpenPGP symmetric encryption and AES-256?

I would like to understand the difference between: OpenPGP symmetric encryption and AES-256 using Winzip/7-zip? I mean if you encrypt a file with an OpenPGP program like GnuPG, using AES-256 ...
0
votes
1answer
82 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
115 views

Creating pointers to keys on SmartCard

I am new to OpenPGP and SmartCards but I cannot find how to do a fairly straight-forward task. I am trying to sign a file with a private key stored on a YubiKey device. Here is my session: $ ...
1
vote
0answers
110 views

Should I use the same OpenPGP keys in certificates used to provision the YubiKey PIV slots?

I know PIV and OpenPGP are separate standards and independent applications in the YubiKey, but for newcomers like me they look very similar with their signing, encryption and authentication keys, use ...
1
vote
1answer
1k views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
1
vote
1answer
327 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
0
votes
0answers
138 views

Is gnupg2 --refresh-keys susceptible to any attacks based on fingerprint collisions?

Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys Mallory ensures that Bob uses her keyserver, which offers her own key, which is sharing the 32-bit "short" Key ...
1
vote
0answers
22 views

Can I use my Microsoft Outlook S/MIME certificate with gpgsm.exe

So I work for a large company that has their own internal CA and maintains their own set of S/MIME certificates. We periodically have to re-enroll in S/MIME and import the certificate into Microsoft ...
4
votes
1answer
72 views

Is forward secrecy useful for an application where keeping message history is an integral part?

I am writing a decentralized application that lets certain privileged users post messages to other users. These messages should be encrypted so that only the two of them can read it. Messages are ...
1
vote
0answers
83 views

How to display the SHA256 hash while signing or in signature

I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way ...
1
vote
1answer
121 views

OpenPGP SmartCard: generate revocation certificate on-card?

As far as I can tell: It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (...
2
votes
3answers
225 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
1answer
159 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
1
vote
0answers
96 views

Help me understand Encryptpad and 7-zip for encryption

I was looking to encrypt some text files (containing sensitive data) so I could safely keep them online (e.g. Google drive). I have found three options: 7-zip, which does AES-256 Encryptpad, which ...
3
votes
2answers
106 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
3
votes
1answer
78 views

How to prevent participants from cheating when establishing an OpenPGP-like structure

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. I also want to make sure that non of the parties can ...
1
vote
1answer
40 views

Share Document within user group

I would like to share documents within groups and make sure that the member of each group can only access the documents shared in his/her group. Situation: There are 5 participants (A, B, C, D). ...
1
vote
2answers
316 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
86 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
1
vote
0answers
749 views

GnuPG “public key decryption failed: Invalid ID” using Yubikey Smartcard

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors: x>gpg -vv --decrypt encrypted.gpg gpg: armor: BEGIN PGP MESSAGE # off=0 ctb=XX ...
1
vote
1answer
316 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
1
vote
3answers
278 views

Should I sign software release keys with my own key?

A good practice is verifying software with a team signing key, to ensure the software hasn't been tampered with. The problem When I verify a download, I usually stumble upon the following message: $...
2
votes
1answer
718 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
3
votes
1answer
348 views

GnuPG sub-keys revocation

My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored ...
2
votes
1answer
92 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
1answer
211 views

Is is safe to use PGP again?

The EFF has issued some instructions enitiled "How To Turn PGP Back On As Safely As Possible". The emphasis there is mine, and that qualifier worries me. Realistically, what risks do I run if I ...
6
votes
1answer
3k views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
-1
votes
1answer
105 views

Will this method allow EFAIL-safe sending of OpenPGP encrypted messages to otherwise EFAIL-unsafe readers?

The proposed method Brief and simplified description of the attack: Any and every single encrypted block B of the encrypted message can be surrounded by Trojan psuedo-encrypted data to give a ...
2
votes
1answer
122 views

In OpenPGP, when encrypting with public key — is it possible to not include the RSA key id?

In OpenPGP, when encrypting with public key -- is it possible to not include the RSA key id as plaintext in the metadata? I need to encrypt messages, but I want it to be impossible to identity the ...
50
votes
5answers
6k views

What actions should I, as an end user, take in response to EFAIL?

There's a lot of talk about EFAIL: The EFAIL attacks exploit vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext of encrypted emails. In a nutshell, EFAIL abuses active ...
0
votes
1answer
136 views

OpenPGP.js deterministic encryption?

I'm encrypting something with a public key generated using the ed25519 curve, with OpenPGP.js. It goes something like this: var options = { data: str, publicKeys: publicKeys, armor: false ...
0
votes
1answer
291 views

GPG key expiration and storage

I hope I came to right place to ask about GPG. I have created secret, public, and sign keys and set expiration dates for all keys in case I lose an access to them or forget a keyphrase, etc. I have ...
1
vote
0answers
36 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
2
votes
1answer
2k views

How to tell if a “PGP PRIVATE KEY BLOCK” is passphrase protected?

I've used gpg4win's Kleopatra tool to create an OpenPGP RSA personal certificate. I want to export the private key for several reasons (import it on another machine, as well as backing it up in ...
1
vote
1answer
62 views

What identifies an entity in PGP?

When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
0
votes
2answers
95 views

Securely transport secret token so it can not be used even if snooped?

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In ...
1
vote
1answer
661 views

When using HMAC-SHA256 do I must save the secret in the databse to verify the sender?

Many API's I found that using same method for authentication: Signature is a HMAC-SHA256 encoded message containing nonce, customer ID (can be found here) and API key. The HMAC-SHA256 code must be ...
2
votes
1answer
80 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
3
votes
1answer
2k views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...