PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

3
votes
2answers
36 views

What is the best way to organize OpenPGP keys?

I've always used OpenPGP as a single private/public pair of keys for (S)igning and (E)ncryption. But learning about OpenPGP subkeys, it's recommended to use separate keys for (C)ertification, ...
0
votes
1answer
36 views

Decrypt chunks of pgp encrypted

Suppose I have a very large encrypted .csv file (too large to fit in memory). Is there a way to decrypt N bytes of the cyphertext? My goal is to process each row of the .csv in memory without ever ...
1
vote
2answers
26 views

How to export secret keys from GnuPG including photo IDs?

I'm trying to create an OpenPGP key with a photo ID using GnuPG and then export it, so it can be imported on a different computer. Whatever tests I've done the photo ID never appears after the import ...
0
votes
2answers
52 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
2
votes
1answer
17 views

Purpose of secret-subkeys?

Through output of gpg -k und gpg -K it seems that I always have (as well as create) (sub)keypairs. But, if the purpose of the pub and sub is as it is shown below and the purpose of the secretkey is ...
4
votes
1answer
48 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
3
votes
2answers
149 views

Is there a reason for the assumed ISIS video's OpenPGP encryption key ID being outside base-16?

I was reading an article earlier today about Edward Snowden and ISIS. According to him they faked an encrypted message. He uses the fact that they have an encryption key outside of base-16 as his ...
1
vote
1answer
59 views

How is this OpenPGP key displaying in a non hexedecimal format?

Looking at a GnuPG manual on openskills, I notice that the main key id GEBV933F is in a different format than the usual hexadecimal (G is no hexadecimal digit). How is this done?
3
votes
0answers
22 views

Enigmial does not put the secret key into the secret keyring [migrated]

I've been using Enigmail 1.8.2 on Thunderbird 38.5.0 from the Fedora 23 repository. I generated a key pair by using Enigmail and I can send encrypted and signed emails by using Thunderbird (or even by ...
3
votes
2answers
32 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
4
votes
1answer
31 views

Can I get SSL certificates for my OpenPGP key?

How can I use letsencrypt to get a signed public key for use with OpenPGP? So I can prove in court the key is mine etc., and not have to rely on the OpenPGP web of trust.
3
votes
2answers
21 views

What can I do with the removed Masterkey?

I intend to start using GnuPG respective mail encryption with GnuPG. So I created a key pair with a short expiry date to gain some understanding. I read some stuff about removing the secret masterkey ...
1
vote
4answers
70 views

Use GnuPG to verify if specified user signed file

To verify if file is signed correctly we use command: gpg --verify <file_name> and the output shows if file is signed correctly. And if it is, then signer name is shown. But is there ...
1
vote
1answer
28 views

What are the Consequences of OpenPGP Key Collisions?

In this answer to GPG keys & SHA-1, there's the sentence: However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
4
votes
2answers
158 views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 ...
4
votes
1answer
30 views

Is there something like a portable GnuPG keychain?

When encrypting or decrypting documents on a computer that isn't my daily driver I need to import my key to the keychain, do the encrypt/decrypt then remove the keychain and from the computer. As a ...
2
votes
1answer
91 views

GnuPG + Yubikey 4: How to manually check that all keys are where they belong (on the Yubikey only)?

I created a GnuPG RSA master-key and 3x RSA subkeys (sign,encrypt,authenticate). Of course I want all key material to be stored solely on the Yubikey 4 - as they are only my 3 subkeys. Since I use ...
4
votes
1answer
80 views

Yubikey: How is the OpenPGP key secured by PIN and passphrase?

Using the Yubikey 4 as an OpenPGP smartcard with GnuPG: How is the user PIN and user passphrase secured? In case a sophisticated attacker with physical access to the Yubikey 4 manages to physicaly ...
5
votes
1answer
52 views

GnuPG + Yubikey: Can a trojan extract any secret key or sensitive information?

When using GnuPG with a Yubikey 4 on a Laptop for e-mail communication: Can a trojan extract any secret key or sensitive information? If so, what information would that be?
3
votes
1answer
15 views

Do I need separate revocation certificates for each email address associated with a key?

I just created my first OpenPGP key with GnuPG + Thunderbird + Enigmail. The key is used for two email addresses. Now I created a revocation certificate. There is only on of the email addresses ...
3
votes
1answer
41 views

What are the problems with uploading client-side encrypted keys to keybase.io?

I was just reading some articles about keybase.io: http://www.makeuseof.com/tag/keybase-wants-bring-encryption-masses-heres/ http://blog.lizdenys.com/2014/03/31/refusing-to-verify-myself/ And I'm ...
0
votes
3answers
55 views

Is there use for GPG/PGP for casual people who are simply concerned for their privacy?

GPG seems to be something that would be important to people who communicate to a particular person and have to keep their privacy and/or security. But what if I'm just a casual user who's aware that ...
1
vote
0answers
28 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get ...
4
votes
1answer
51 views

Signing UIDs which do not belong to a RL person with full name

Sometimes I am asked to sign pseudonymous UIDs or see PGP keys which belong to organizations rather than single persons. These, by nature, do not contain the name of a real life person; hence there is ...
13
votes
3answers
992 views

How do I protect my OpenPGP key on my computer?

How do I protect my OpenPGP key on my computer? If I make a backup of my private key I will keep it secure, but if someone gets access to my computer he/she will can get all my keys through Kleopatra ...
2
votes
1answer
17 views

Automatically finding and fetching signature paths from own key to target

This is a question about usage of Web of Trust. Let's suppose I've just generated a key pair and attended one or two Key Signing Parties. That gave me ~10 signatures on my public key, some of which ...
3
votes
1answer
45 views

What happens if an OpenPGP subkey gets compromised?

In my GnuPG keyring, I have a primary key for creating keys and three subkeys: two for encryption and one for signing. All of then have the same password. If a subkey gets compromised, is it possible ...
3
votes
1answer
34 views

Sign GnuPG master key with own X.509 certificate?

Can I use a trusted X.509 digital certificate to facilitate the expansion of my personal web of trust? To be more specific: Can I use my X.509 certificate to sign my personal GnuPG master key? Will ...
0
votes
0answers
20 views

Using 8192 bit keys GPG [duplicate]

I am interested in generating 8192 bit keys out of curiosity. I know that 4096 bit keys is the maximum key strength that is recommended, but I would like to know how to increase the size. I have ...
1
vote
1answer
30 views

Is it a good idea to use an OpenPGP key that has no password?

I'm tarballing and compressing backup files of my system configuration, and other important stuff. The process of tarballing, compressing and encrypting happens every time rsnapshot changes something ...
3
votes
1answer
35 views

Using the middle name instead of first name for OpenPGP?

I'm just getting started with OpenPGP. I've generated a key, talking to (very few) friends involved with the technology. But I have a concern: I go by my middle name (with all emails, friends, etc.) ...
1
vote
3answers
98 views

Best way to keep private PGP keys?

What is the most secure way to store my private PGP keys?
0
votes
1answer
63 views

Receiving mails with strange PGP Key ID

I have received encrypted emails which I can not decrypt because the key used for encryption seems not to be correct. Usually I have a key ID with 8 hex characters. This key can be found on public ...
3
votes
2answers
498 views

Lost my PGP private key, what's next?

I have created a PGP key using GPGTools, and published it a while ago. Things are: I have no longer access to my secret key. Indeed, I unfortunately formatted the wrong drive (encryption was and is ...
2
votes
1answer
39 views

How do we 'initiate' mail exchange with PGP

I am totally new with PGP, and I would like to know how I can initiate a mail exchange with it. I created my public/private keys, and posted my private key on the MIT PGP Public Key Server. I can ...
1
vote
2answers
55 views

Is it possible to protect the emails and calendar in an Exchange server against own Exchange administrators?

We have our Exchange server in a remote site administered by an external provider. We would like to avoid the possibility of provider employees to access the email and calendar of critical accounts in ...
9
votes
2answers
168 views

What's the chance of two PGP keys being exactly identical?

In the real world, millions of PGP keys are created every day, what is the probability (chance) of creating two identical keys? In different places, by different people?
1
vote
1answer
38 views

How is the signing of an OpenPGP public key realized technically?

I recently have signed the public OpenPGP key of a friend of mine. Curious to see, which effect this would have on the actual key, I compared the key before and after signing it. What I found was that ...
-1
votes
1answer
78 views

Why are pgp keys limited to a number of bits?

I am wondering : why does pgp keys have a fixed number of bits. They can be 2048,4096, but why not 56000 or 23 bits ? Is there a specification, or ISO, that was made to limit thoses Keys. Why? If a ...
1
vote
2answers
206 views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
3
votes
1answer
70 views

What would happen if a public key server is compromised?

What would happen if in someway a public key server, let's say the MIT PGP key server, was compromised and some keys would be edited to an attacker's public key? Is this even possible? Would that be ...
0
votes
2answers
81 views

PGP on Dark Net Markets: What threats does it control?

Most Dark Net Markets (Agora, Nucleus, etc.) recommend that customers use PGP when communicating with vendors, particularly when sending their address. The vendor's public key is presented publicly on ...
0
votes
1answer
29 views

PGP Key Servers Verification Mail? [duplicate]

Why do existing PGP key servers not perform e-mail verification? Wouldn't it help the problem of authenticating of public keys? By e-mail verification/confirmation I mean a single e-mail sent to the ...
5
votes
1answer
233 views

GPG (PGP) decryption speed issue

We are new to using GPG and we have a very strange issue with decryption speed when using RSA keypairs, which are generated by using different tools (GPG for Windows, DidiSoft OpenPGP Library for .NET ...
4
votes
1answer
81 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
3
votes
1answer
70 views

Should I revoke & regenerate PGP private keys after computer is serviced by Apple Store?

I recently had an issue with my MacBook where it wouldn't boot. So I took it in to the apple store, and they said that they would need to send it off to a service center to diagnose and repair it. I ...
1
vote
1answer
25 views

PGP's -cw option in GnuPG

I am new to PGP and am going through the book. I have GnuPG on my OS X. I've been through the man pages for GnuPG and to encrypt files the following is instructed: ...
4
votes
2answers
107 views

Should I add picture(s) to my OpenPGP key?

I'm toying with the idea of creating a pair of OpenPGP keys, and I'm wondering if I should include a picture or two. I know it will make my key a lot bigger, but is it still worth it? I'm thinking of ...
1
vote
1answer
29 views

How to verify signature while downloading log4j?

From the log4j download page. The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these ...
4
votes
2answers
63 views

How to verify email addresses in GnuPG UIDs?

I have been reading up on key signing policies and best practices. Something I have been unable to figure out is how to verify the email address attached to a UID of a GnuPG key. I can verify the ...