Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
0
votes
0answers
37 views

How to automatically sign a message using PGP in an email?

Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message. For Example, A wants to send a message to B. A open its email ...
2
votes
1answer
73 views

Is it possible for me to somehow verify that the PGP message blob I just generated contains what I intended for it to contain?

I have this text: Would you mind stopping by the local store and buy some baking soda for tomorrow, Betty-Sue? Betty-Sue has given me her public PGP key, which I have imported and now use to encrypt ...
0
votes
0answers
37 views

How to import pgp backup back into smartcard?

I generated a backup of my master key and 3 sub keys following this into these archives: gpg.conf mastersub.key openpgp-recovs.d private-keys-v1.d (contains 4 .key files) pubring.kbx random_seed ...
-2
votes
2answers
96 views

How does PGP Public and Private Keys work?

I recently tried to understand how PGP works: I encrypt plaintext with my private key and if I send that encrypted text to others with my public key they can encrypt that with my public key?
0
votes
1answer
64 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?
53
votes
8answers
17k views

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed: I know Joe's e-mail address: cool_joe@gmail.com. I have a ...
-4
votes
1answer
103 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
0answers
40 views

changing passphrase on gpg subkey

Is it possible to change passphrase on a subkey by: gpg --edit-key sub_key_id passwd Or will this change the passphrase on the master key as well? (My idea stems from the fact that master key is ...
0
votes
0answers
45 views

How to reset a PGP key to work for an old user

We have a scenario where we are locked out of our PGP private key despite 100% certainty we are using the correct passphrase: User1 created a PGP key pairing. The public key was sent to a third party ...
0
votes
0answers
28 views

How to list signatures of public key file without importing it to keyring?

How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available. I would like a similar output to gpg --list-signatures <key-id>, but ...
19
votes
7answers
6k views

Is PGP for user authentication a good idea?

I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication. How I'm doing it right now My current concept is modeled ...
1
vote
0answers
37 views

Why GPG signature is not considered as made by a trusted key?

When I verify a file signature I get the the following warning: $ gpg --verify file.sig gpg: Signature made So 01 Dez 2019 10:08:27 CET gpg: using RSA key <Pierre's key ID> gpg: ...
1
vote
1answer
378 views

Is it possible to decrypt a PGP encrypted file without private key?

I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data. Recently, my colleagues told ...
1
vote
0answers
30 views

how to simulate gpg severkey DoS attack?

I tried to simulate this attack in my PC but I could not generate a poison key, I used Linux (Ubuntu 18.04) and GPG software (gpg (GnuPG) 2.2.4). I tried to manipulate public key and import it to ...
0
votes
0answers
16 views

kbpgp pgp key expiry problem

I have used kbpgp java script library to generate pgp keys. I have set the expiry as "never". But when i check the fingerprint of the public key with gpg it shows like this. this is my pgpkeygen.js ...
1
vote
2answers
99 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
0
votes
1answer
36 views

Can I resubmit my GPG key to a keyserver?

I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
3
votes
1answer
134 views

Is there a secure way to host private PGP keys (is keybase's method secure?)

Keybase's decryption page says "you must host your private key in Keybase's encrypted key store." This really rubs me the wrong way. I was under the impression that your private key should not leave ...
3
votes
1answer
52 views

Can any private key information be exposed when signing an email? [duplicate]

So I know that PGP encrypted email can be vulnerable to a known-plaintext attack from a known, consistant email footer or greeting (“Hello”, “Yours truly, xxx”, etc), but does the same thing apply to ...
0
votes
2answers
97 views

Is it better to encrypt to an untrusted key or not to encrypt at all?

If a public PGP key can be retrieved, but there is no known path of trust from the sender to the receiver: Is is better to encrypt the message using the key on spec or to not encrypt at all?
1
vote
0answers
29 views

How does PGP web of trust handle certificate expiration?

I have certificate that expires in two years. I'll probably try to participate in key signing party so I get to know what it actually looks like. What happens in two years? When my certificate ...
1
vote
1answer
196 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
1
vote
1answer
81 views

alternatives to the “PGP pathfinder” [closed]

The author of the PGP pathfinder deceased this year. Shortly after the data was not updated any more. Are there any alternatives known to find signature paths?
0
votes
0answers
11 views

can i not change the pgp encryption expiry once it is set? [duplicate]

how do i fix the encryption status to 'good' I tried changing the expiry date it only changes the 'Cerify/sign' one. can i not change the pgp encryption expiry once it is set?
1
vote
1answer
909 views

How do PGP keys “expire”?

When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
0
votes
0answers
43 views

Server application to hold PGP private keys and decrypt as requested

I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
0
votes
1answer
436 views

How long would it take to bruteforce a PGP-Encrypted-Mail?

How long would it take to bruteforce a PGP-Encrypted-Mail? If I'm rightly informed, it depends on the bitsize of the encryption Key.
2
votes
3answers
271 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
1
vote
1answer
70 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
0
votes
1answer
129 views

Can a deleted PGP secret key be recovered from private-keys-v1.d directory?

Executing gpg -K --with-keygrip returns one key entry. However the private-keys-v1.d directory has two entries. I assume that one of them belongs to a secret key that has been deleted/removed. Is ...
0
votes
0answers
57 views

create gpg public key from subkey

I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically. For my communication ...
0
votes
0answers
67 views

How is private key encrypted after export?

For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
0
votes
1answer
99 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
79 views

Can a new signature be added to an already signed message?

Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) ...
1
vote
1answer
134 views

Does creating new subkeys change an existing master key?

I have a PGP master public / private key pair. I have created 3 subkeys for it. I want to add 3 more subkeys to this master key. Would doing so change my public and private keys?
1
vote
1answer
61 views

Were PGP/MIME and PGP/Inline equally affected by EFAIL?

I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while ...
0
votes
0answers
48 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
2
votes
1answer
2k views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
2
votes
0answers
141 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
0
votes
1answer
126 views

Verifying PGP Messages

Is it possible to sort of verify a PGP message? Alice sends a PGP Encrypted message to Bob. I know Alice and Bob's public key, and I have their encrypted and plaintext message. Can I confirm that ...
0
votes
1answer
91 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
4
votes
1answer
140 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
0
votes
0answers
194 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
5
votes
1answer
509 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
5
votes
1answer
2k views

Correct way to replace a GPG key

I want to create a new GPG key with a longer key size. What are the best ways to replace the key? My current key is associated with a lot of stuff like GitHub etc. Should I revoke my old key and sign ...
1
vote
0answers
79 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
3
votes
1answer
134 views

Why are passphrases protecting GPG / SSH private keys needed? [duplicate]

SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
2
votes
3answers
280 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
1answer
170 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
173 views

Are there risks to having many uids on my gpg key?

I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...

1
2 3 4 5
13