Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
3
votes
1answer
52 views

Approval of GPG key strategy

I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now. I've worked out a GPG key strategy and i ...
3
votes
2answers
134 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
0
votes
0answers
34 views

Cross signing practice for PGP package signing keys?

I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019). PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
1
vote
3answers
96 views

Standard for encrypt files before transfer them over internet

I know there are some standards for transferring data securely such as HTTPS for web applications, or SPC & SFTP for secure file transfers. Encrypting files using PGP is a way to encrypt files ...
1
vote
0answers
152 views

Why does ECC not have an encrypt capability in GPG, but RSA does?

I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model. Much of it is following guides which I believe are still considered best practices: https://...
0
votes
1answer
72 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
4
votes
1answer
166 views

How are the PGP keys that Thunderbird 78+ uses encrypted?

With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
2
votes
0answers
67 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
2
votes
2answers
177 views

Why isn't there a protocol to exchange PGP keys?

Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters? I imagine a quite simple process like other established ...
2
votes
1answer
105 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
0
votes
1answer
81 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
0
votes
1answer
95 views

how does the certificate distributed by the CA work? [closed]

I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender. How does it work? Can you use simple and easily ...
0
votes
1answer
62 views

When changing a PGP passphrase, does it only affect the same key on the other machine?

If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B? Will I still be able to use the PGP key on Computer B ...
1
vote
3answers
170 views

Should I backup a GPG key used for Authentication?

Regarding backups (escrows) of GPG (OpenPGP compliant) keys, I seem to understand that (E)ncryption keys need to be backed up, to prevent data loss, and that (S)igning keys should not be backed up, ...
0
votes
1answer
70 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
0
votes
1answer
146 views

Standard form of email signature

A little bit of background: I want to sign my emails for my own safety. None of my intended recipients are users of digital signatures. If one day someone were to impersonate me, I can prove my own ...
2
votes
1answer
189 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
1
vote
1answer
152 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://www.rfc-editor.org/rfc/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0
votes
1answer
55 views

Can I add other key holders to an existing PGP file?

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a ...
2
votes
1answer
125 views

What's the purpose of a key hash when you have the fingerprint?

Looking for "Barack Obama" in Ubuntu's keyserver return these results For example, take the first search result: pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z ...
1
vote
1answer
547 views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
2
votes
1answer
97 views

Is there some way to verify that what I think I encrypted is actually what was encrypted when I don't have the private key? (PGP) [duplicate]

Let's say that Joe gives his PGP public key to Sue so that Sue can send Joe a secret message. Sue opens her PGP/GPG program, types I'm in love with Joe! and encrypts the message with Joe's public key. ...
1
vote
0answers
208 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
2
votes
2answers
211 views

Understanding GnuPG --export-options backup

The GnuPG documentation lists an option called --export-options parameters. One of the possible parameters for this option is backup (aliased export-backup). The description for --export-options ...
2
votes
3answers
125 views

Reading locally-stored emails sent encrypted

As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key). ...
0
votes
0answers
117 views

Do I need to backup my GPG key again after extending its expiry date?

I have just extended the expiry date of my GPG key by following these instructions: Can you extend the expiration date of an already expired GPG key? I have previously backed-up my key. Do I need to ...
1
vote
0answers
161 views

Import secret key into GnuPg doesn't work?

I would like to import a private key into GPG so I did: gpg --allow-secret-key-import --import /path/to/key/key.asc gpg: key 51D5DF493ECAFF88: "John Doe <john.doe@acme.com>" not ...
0
votes
2answers
137 views

No expiry for offline primary PGP key?

Are there benefits to set an expiration date on a PGP primary key which is only used offline? Is setting an expiration date only on the subkeys enough?
0
votes
1answer
508 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
0
votes
2answers
158 views

pgp public key failed to propogate

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
2
votes
1answer
357 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
0answers
138 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
0
votes
1answer
167 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
78 views

What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is?

I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do: Parse the ...
0
votes
1answer
104 views

keys.openpgp.org keyserver fails to send confirmation mail to an Outlook-address

I uploaded my master key's public part to the keys.openpgp.org-keyserver. It has 4 UIDs set up (4 different e-mail addresses) and each of them are correct and valid e-mail addresses. The keyserver ...
1
vote
1answer
231 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
3
votes
2answers
228 views

Is PGP passphrase necessary if I store private key and passphrase in the same place?

I'm building a system that generates PGP key and store private key in secret vault. One thing I'm not fully understanding is the need for passphrase. I can generate a random passphrase during the key ...
0
votes
0answers
202 views

Read and parse PGP keys

Good morning, my goal is to parse pgp keys but I am facing two problems. I don't know how pgp keys are encoded (for starters I deal with pgp keys generated by Rsa only) and nor do I know how to read ...
0
votes
3answers
112 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
1
vote
0answers
93 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
1
vote
0answers
40 views

Format for data & key exchange/storage [duplicate]

Is there a standard format for storing/exchanging encrypted data along with the key needed to decrypt it (data is encrypted with a single use symmetric key and the symmetric key itself is encrypted ...
1
vote
1answer
93 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
46
votes
7answers
10k views

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

I don't have an education in computer science, I've just become interested in information security and encryption lately. I'm struggling to understand why encrypted web browsing using HTTPS has been ...
2
votes
1answer
5k views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
132 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
342 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
0
votes
1answer
392 views

PGP encryption passphrase

We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the ...
0
votes
1answer
365 views

Using GPG or PGP, is there a way to give another user (or key) access to decrypt a file for a limited time only? [duplicate]

I want to share encrypted files with someone else however it's only for a short time only. What is the best way to do this? More background: I'd like to add more people to be able to decrypt the ...
6
votes
1answer
1k views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
0
votes
0answers
203 views

How to automatically sign a message using PGP in an email?

Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message. For Example, A wants to send a message to B. A open its email ...

1
2 3 4 5
14