PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

2
votes
1answer
41 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
4
votes
1answer
49 views

Explanation of modern PGP?

wikipedia states that OpenPGP is currently defined with RFC 4880 which defines a very simple process that doesn't seem like it represents modern RSA + AES encrypted email: The sender creates a ...
3
votes
1answer
60 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
5
votes
1answer
85 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
1
vote
1answer
26 views

Create revocation certificate for all user IDs

My OpenPGP key consists of three identities and two subkeys. I now would like to create a revocation certificate for the master key. pub 4096R/2J9F2349 2016-05-10 [expires: 2016-11-06] uid ...
3
votes
2answers
59 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: ...
0
votes
2answers
54 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
2
votes
1answer
80 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
1
vote
0answers
56 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
3
votes
1answer
21 views

Does it matter what version of GnuPG I use to create revocation certificates?

Today I am about to create a bunch of revocation certificates for all of my emails. Why? Because it already happened to me in the past, that I lost my private key, or my computer was compromised. It ...
6
votes
1answer
86 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
1
vote
1answer
19 views

Why does the revocation sent to the OpenPGP keyservers not show up?

I have created a new OpenPGP key pair. So I wish to revoke the former I used. Here's what I managed to do so far: This way I found that email's ID = 3C76732B gpg --search ...
2
votes
1answer
26 views

What is the purpose and meaning of the --sig-notation and --cert-notation options in GnuPG?

What is the purpose of the --sig-notation and --cert-notation options in GnuPG? What are the intended use cases? In the first part the a @ character is used, so I guess the options are for providing ...
2
votes
1answer
25 views

How to import primary secret key from backup into GnuPG?

I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1. Even if I delete my entire ...
2
votes
2answers
155 views

Is the RSA private key useless without the password?

I notice whenever I generate a new gpg key (using pgp) I always have to assign a password to it, which makes perfect sense. But if I'm not mistaken, gpg is based on prime numbers. How is this ...
1
vote
1answer
36 views

Spam protection for public GPG keys?

Public keys published to a server almost always contain emails. Is there any sort of protection against bot harvesters that will use that email for spam?
2
votes
1answer
36 views

Revoking signing keys: do they still work afterwards?

Scenario: I have multiple signing subkeys, each for every portable device (i.e laptop). None of them have private master key (it is deleted following the tips in Alex Cabal's post. One of the devices ...
0
votes
1answer
38 views

PGP/GPG: Do I need more encrypton subkeys?

As far as I know after reading several tutorials, it's reasonable to create one subkey for signing per each device I use, especially one that can be stolen, like laptop. However, having multiple ...
2
votes
2answers
55 views

How does GnuPG encrypt secret keys?

When creating a secret key with GnuPG, you are asked for a password to protect it. Which encryption algorithm is used to achieve this? The handbook only says that a symmetric encryption algorithm is ...
3
votes
2answers
91 views

Is there any benefit to encrypting messages with PGP that will be trasmitted over SSL to a REST server?

Would there be any benefit at all to encrypting a message using PGP before sending it to a REST server over SSL, or is this completely redundant and a waste of processing time? For example, could a ...
3
votes
2answers
73 views

How does PGP grant authenticity?

I'm using the website https://www.igolder.com/PGP/encryption/ to encrypt/decrypt PGP messages and create public/private key pairs. I get that when I send somebody my encrypted message only he can ...
1
vote
1answer
32 views

How to properly use PGP for e-mail encryption/signature (key generation, key rollover, etc.) [duplicate]

To improve my privacy, I would like to use PGP to encrypt/sign my e-mails. How should I proceed to use PGP in a secure fashion? I am trying to think about how to do it properly. From what I found, ...
2
votes
1answer
50 views

Signing web forum messages

I maintain web forum software, which is accessible via NNTP and e-mail (as mailing lists). Since NNTP by design allows anyone to spoof their e-mail address, message signing can be used instead to ...
4
votes
1answer
24 views

Best practice: Should I revoke an identity self-signed using SHA1?

When I first created by PGP keypair, my identity was unfortunatly self-signed using SHA1. I later signed again using SHA512. Does it make sense to revoke the SHA1 signature now or will that just ...
1
vote
0answers
13 views

Multiple email addresses connected to same PGP identity [duplicate]

I am setting up PGP (using GPGTools GPG Suite for OS X) and I use multiple email addresses daily. It appears I have several choices on how to do this, and I am wondering what is most secure/most ...
3
votes
2answers
103 views

Why does my private OpenPGP key look different between devices?

Something I noticed, when I use gpg --export-secret-keys -a on different computers: My private key looks different, even though they are the same key pair. Is that normal or does this indicate ...
3
votes
1answer
23 views

How to get GnuPG fingerpints only for specified key name, not for substring matches?

I have few GnuPG keys: test, test2, some test. When I invoke gpg --fingerprint test, fingerprints of all keys are listed. When I run gpg --fingerprint test2, only test2 key fingerprint is printed. How ...
6
votes
2answers
363 views

Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation?

I often use GnuPG to encrypt files with a passphrase. I'm very paranoid, and afraid that the key derivation used by GnuPG isn't slow enough. For this reason, I've decided to do my own key derivation ...
3
votes
1answer
33 views

Critical sub-packets in OpenPGP not used

OpenPGP in RFC4880 allow to tag signature sub packets as "critical" by setting the high bit 7 in the packet type. I checked a few keys generated with GnuPG2 and all the sub packets are not critical, ...
3
votes
2answers
46 views

Specifying my key name while encrypting file to some receiver using GnuPG

I would like to make sure of one thing. When I am encrypting file, the only needed key to specify is --recipient, because I only need to specify key to encrypt (receiver key)? I don't need to specify ...
2
votes
1answer
59 views

What is the recommended procedure to migrate to a new OpenPGP master key?

I am thinking about starting again with a new master key. My current master key was not compromised, but I had stored it on my private server temporarily, which is against good practices (but I am the ...
2
votes
0answers
37 views

GPG Public Key changes after removing master key [closed]

Why does my gpg public key change after removing my master key (leaving just my subkeys) from the gpg key ring? I'm doing this so i can move my daily use keys (subkeys) to my online machine while ...
0
votes
1answer
51 views

How to decrypt a message using only session key?

I can view a session key to the encrypted data using option gpg --show-session-key <file>. Knowing the session key, how can i decrypt the data without using my private key?
1
vote
1answer
41 views

Can an OpenPGP master key decrypt something encrypted for a subkey?

When creating OpenPGP subkeys, the master key signs and certifies that a subkey belongs to that master key. Can be used master key to decrypt something encrypted using an encryption subkey? I guess ...
1
vote
1answer
33 views

OpenPGP master key with certificate and authentication capabilities (on a smartcard)

After researching about OpenPGP and smartcards, I came to a dilemma. The usual setup I've seen more widely is a master key (with SC capabilities) and 3 subkeys (with S, E, A each): pub ...
0
votes
1answer
84 views

How can I get someone to use PGP in emails [closed]

I do my part and ready to use PGP. There is a another user who is new to PGP.I have windows running, I did some installations to get PGP running.How can I get that user start using PGP ? what happens ...
0
votes
2answers
55 views

Using PGP in emails - is there to find the key?

Suppose both the receiver and sender use PGP. Suppose someone send from the sender an email and sent it to the receiver. Now he gets the content of the email at the receiver. Can he know now the keys ...
2
votes
1answer
52 views

What are the advantages to OpenPGP “subkeys”?

I'm trying to get started with OpenPGP encryption. I understand the concept of keeping your master key safe, and using other keys signed by that key (which can be revoked if stolen) for encryption and ...
3
votes
0answers
32 views

Does using the client keep the Keybase server honest even if you also use the web interface?

According to Keybase's documentation: [The] keybase clients in the wild play a crucial role in keeping the Keybase server honest. They check the integrity of user signature chains, and can find ...
0
votes
2answers
76 views

How can an MD5-encrypted OpenPGP key be exported without entering the passphrase?

I'm studying cryptography and I have a question about the GnuPG tool for Windows. From what I understand a passphrase is used to hash with MD5 the private RSA key. But when I use the Kleopatra tool ...
3
votes
2answers
63 views

What is the best way to organize OpenPGP keys?

I've always used OpenPGP as a single private/public pair of keys for (S)igning and (E)ncryption. But learning about OpenPGP subkeys, it's recommended to use separate keys for (C)ertification, ...
0
votes
2answers
104 views

Decrypt chunks of pgp encrypted

Suppose I have a very large encrypted .csv file (too large to fit in memory). Is there a way to decrypt N bytes of the cyphertext? My goal is to process each row of the .csv in memory without ever ...
1
vote
2answers
68 views

How to export secret keys from GnuPG including photo IDs?

I'm trying to create an OpenPGP key with a photo ID using GnuPG and then export it, so it can be imported on a different computer. Whatever tests I've done the photo ID never appears after the import ...
0
votes
2answers
66 views

PGP vs Hash functions

What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)? Isn't pgp less secure as the verifier must trust the ...
3
votes
1answer
32 views

Purpose of secret-subkeys?

Through output of gpg -k und gpg -K it seems that I always have (as well as create) (sub)keypairs. But, if the purpose of the pub and sub is as it is shown below and the purpose of the secretkey is ...
4
votes
1answer
59 views

What does an OpenPGP signature consist of?

I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address and my public key. Additionally, a digital ...
3
votes
2answers
165 views

Is there a reason for the assumed ISIS video's OpenPGP encryption key ID being outside base-16?

I was reading an article earlier today about Edward Snowden and ISIS. According to him they faked an encrypted message. He uses the fact that they have an encryption key outside of base-16 as his ...
1
vote
1answer
67 views

How is this OpenPGP key displaying in a non hexedecimal format?

Looking at a GnuPG manual on openskills, I notice that the main key id GEBV933F is in a different format than the usual hexadecimal (G is no hexadecimal digit). How is this done?
3
votes
2answers
55 views

Comparing allegedly identical OpenPGP keys published through different channels

tldr version: When I try to compare public keys that are supposed to be for the same entity the versions I get through different channels are NOT the same and the ones that I download as a file like ...
4
votes
1answer
45 views

Can I get SSL certificates for my OpenPGP key?

How can I use letsencrypt to get a signed public key for use with OpenPGP? So I can prove in court the key is mine etc., and not have to rely on the OpenPGP web of trust.