Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
2
votes
1answer
71 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
0
votes
1answer
57 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
0
votes
1answer
82 views

how does the certificate distributed by the CA work? [closed]

I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender. How does it work? Can you use simple and easily ...
0
votes
1answer
43 views

When changing a PGP passphrase, does it only affect the same key on the other machine?

If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B? Will I still be able to use the PGP key on Computer B ...
0
votes
3answers
87 views

Should I backup a GPG key used for Authentication?

Regarding backups (escrows) of GPG (OpenPGP compliant) keys, I seem to understand that (E)ncryption keys need to be backed up, to prevent data loss, and that (S)igning keys should not be backed up, ...
0
votes
1answer
53 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
0
votes
1answer
129 views

Standard form of email signature

A little bit of background: I want to sign my emails for my own safety. None of my intended recipients are users of digital signatures. If one day someone were to impersonate me, I can prove my own ...
2
votes
1answer
109 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
1
vote
1answer
119 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://tools.ietf.org/html/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0
votes
1answer
41 views

Can I add other key holders to an existing PGP file?

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a ...
2
votes
1answer
104 views

What's the purpose of a key hash when you have the fingerprint?

Looking for "Barack Obama" in Ubuntu's keyserver return these results For example, take the first search result: pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z ...
1
vote
1answer
293 views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
2
votes
1answer
76 views

Is there some way to verify that what I think I encrypted is actually what was encrypted when I don't have the private key? (PGP) [duplicate]

Let's say that Joe gives his PGP public key to Sue so that Sue can send Joe a secret message. Sue opens her PGP/GPG program, types I'm in love with Joe! and encrypts the message with Joe's public key. ...
1
vote
0answers
167 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
2
votes
2answers
146 views

Understanding GnuPG --export-options backup

The GnuPG documentation lists an option called --export-options parameters. One of the possible parameters for this option is backup (aliased export-backup). The description for --export-options ...
2
votes
3answers
112 views

Reading locally-stored emails sent encrypted

As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key). ...
0
votes
0answers
85 views

Do I need to backup my GPG key again after extending its expiry date?

I have just extended the expiry date of my GPG key by following these instructions: Can you extend the expiration date of an already expired GPG key? I have previously backed-up my key. Do I need to ...
1
vote
0answers
109 views

Import secret key into GnuPg doesn't work?

I would like to import a private key into GPG so I did: gpg --allow-secret-key-import --import /path/to/key/key.asc gpg: key 51D5DF493ECAFF88: "John Doe <john.doe@acme.com>" not ...
0
votes
2answers
100 views

No expiry for offline primary PGP key?

Are there benefits to set an expiration date on a PGP primary key which is only used offline? Is setting an expiration date only on the subkeys enough?
0
votes
1answer
441 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
0
votes
2answers
122 views

pgp public key failed to propogate

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
2
votes
1answer
217 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
0answers
102 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
0
votes
1answer
119 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
66 views

What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is?

I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do: Parse the ...
0
votes
1answer
76 views

keys.openpgp.org keyserver fails to send confirmation mail to an Outlook-address

I uploaded my master key's public part to the keys.openpgp.org-keyserver. It has 4 UIDs set up (4 different e-mail addresses) and each of them are correct and valid e-mail addresses. The keyserver ...
1
vote
1answer
190 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
3
votes
2answers
153 views

Is PGP passphrase necessary if I store private key and passphrase in the same place?

I'm building a system that generates PGP key and store private key in secret vault. One thing I'm not fully understanding is the need for passphrase. I can generate a random passphrase during the key ...
0
votes
0answers
152 views

Read and parse PGP keys

Good morning, my goal is to parse pgp keys but I am facing two problems. I don't know how pgp keys are encoded (for starters I deal with pgp keys generated by Rsa only) and nor do I know how to read ...
0
votes
3answers
103 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
1
vote
0answers
74 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
1
vote
0answers
39 views

Format for data & key exchange/storage [duplicate]

Is there a standard format for storing/exchanging encrypted data along with the key needed to decrypt it (data is encrypted with a single use symmetric key and the symmetric key itself is encrypted ...
1
vote
1answer
76 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
46
votes
7answers
10k views

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

I don't have an education in computer science, I've just become interested in information security and encryption lately. I'm struggling to understand why encrypted web browsing using HTTPS has been ...
2
votes
1answer
3k views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
106 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
271 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
0
votes
1answer
283 views

PGP encryption passphrase

We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the ...
0
votes
1answer
283 views

Using GPG or PGP, is there a way to give another user (or key) access to decrypt a file for a limited time only? [duplicate]

I want to share encrypted files with someone else however it's only for a short time only. What is the best way to do this? More background: I'd like to add more people to be able to decrypt the ...
6
votes
1answer
812 views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
0
votes
0answers
130 views

How to automatically sign a message using PGP in an email?

Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message. For Example, A wants to send a message to B. A open its email ...
2
votes
1answer
151 views

Is it possible for me to somehow verify that the PGP message blob I just generated contains what I intended for it to contain?

I have this text: Would you mind stopping by the local store and buy some baking soda for tomorrow, Betty-Sue? Betty-Sue has given me her public PGP key, which I have imported and now use to encrypt ...
-2
votes
2answers
340 views

How does PGP Public and Private Keys work?

I recently tried to understand how PGP works: I encrypt plaintext with my private key and if I send that encrypted text to others with my public key they can encrypt that with my public key?
0
votes
2answers
106 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?
55
votes
8answers
18k views

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed: I know Joe's e-mail address: cool_joe@gmail.com. I have a ...
-4
votes
1answer
137 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
0answers
441 views

changing passphrase on gpg subkey

Is it possible to change passphrase on a subkey by: gpg --edit-key sub_key_id passwd Or will this change the passphrase on the master key as well? (My idea stems from the fact that master key is ...
1
vote
0answers
53 views

How to list signatures of public key file without importing it to keyring?

How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available. I would like a similar output to gpg --list-signatures <key-id>, but ...
21
votes
8answers
7k views

Is PGP for user authentication a good idea?

I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication. How I'm doing it right now My current concept is modeled ...
1
vote
0answers
118 views

Why GPG signature is not considered as made by a trusted key?

When I verify a file signature I get the the following warning: $ gpg --verify file.sig gpg: Signature made So 01 Dez 2019 10:08:27 CET gpg: using RSA key <Pierre's key ID> gpg: ...

1
2 3 4 5
14