Skip to main content

Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
1 vote
1 answer
68 views

Restructure PGP Keys

How do I restructure my keys from current/old setup to new setup? The new setup would allow better key-management: isolation of primary-key and rotation of sub-keys. Current/Old Setup: PrimaryKey - CS ...
R G's user avatar
  • 31
0 votes
0 answers
37 views

Types of certificate? [duplicate]

What types of certificates are there? I was checking online and I found several different types, some at the level of the format of the certificate (x509, PEM, DER), and one at the application level (...
anonymous's user avatar
16 votes
5 answers
5k views

Is it possible to sign Git commits on a different computer?

I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
Danya02's user avatar
  • 373
1 vote
1 answer
60 views

Allow one of many encryption/signature algorithms for single public key certificate

Let's say a user creates their primary gpg key pair for User Name <[email protected]> and selects an encryption and signing algorithm that isn't widely available (think goldilocks). For instance, ...
aackmann's user avatar
0 votes
0 answers
22 views

How to recover my password from my file.key [duplicate]

I don't remember my passphrase for my PGP key that was created several years ago. How can I decrypt my file.key to recover it? Or what should I do to recover it from my file.key?
BitCoinsBank's user avatar
0 votes
1 answer
215 views

Convert PGP key to X.509?

Can I convert a PGP key to X.509, using OpenSSL or GNUPG? Aren't these only container/wrapper formats?
Geremia's user avatar
  • 1,783
4 votes
1 answer
594 views

Should one really disable AEAD for recent GnuPG created PGP keys?

Apparently, there are some problems with the new defaults that are set when one creates a PGP key using a recent version of GnuPG (2.4). I ran into this after generating a new ECC/ED25519 key to ...
Tobias Leupold's user avatar
0 votes
0 answers
124 views

These two pgp public keys are the same but different?

I'm doing some research on .onion websites and was trying to verify an onion URL. I got a public key from two different sources: side by side they are identical until about ten lines before the end. ...
pilks7's user avatar
  • 1
0 votes
0 answers
86 views

How does trust work in PGP?

I am trying to understand in detail how does one "express" trust in someone else's public key in PGP. As far as I know, in PGP you associate uids (for simplicity, say that these are emails) ...
Ginswich's user avatar
  • 103
2 votes
1 answer
415 views

PGP expired encryption subkey : renew or replace?

I am in the process of learning PGP (GnuPG more precisely). I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
ChennyStar's user avatar
0 votes
1 answer
124 views

Revoking a digital signature at the cryptographic level

How do I indicate that a specific document or transaction associated with a particular signature should no longer be considered valid? I'm talking of recalling a signed document, not revoking the ...
microwth's user avatar
  • 2,483
0 votes
1 answer
108 views

Does an official IETF-codified URN exist for PGP keys?

I've been able to locate http://www.aaronsw.com/2002/draft-swartz-pgp-urn-00, but it appears to be an unofficial proposal never submitted to the IETF. Does it hold any water?
RokeJulianLockhart's user avatar
4 votes
1 answer
217 views

GPG allows importing an invalid secp256k1 public key

I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
Andreas Tzionis's user avatar
0 votes
1 answer
258 views

Why is ECC (Eliptical Curve) an `--expert` feature in PGP?

Eleptial Curve is now included in PGP. However when I run gpg2 --full-gen-key, I get Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) ...
Evan Carroll's user avatar
  • 2,873
1 vote
1 answer
111 views

With selfhosting email server, selfsigned certificate, does it make a difference with PGP mail, What can be leaked?

If we are self hosting our own email server with mydomain.com with a self sign CA for S/MIME. What are some possible ways that our email content can get leaked? Then if we use PGP email, does it make ...
user294265's user avatar
0 votes
2 answers
887 views

Backup GPG private key in KeePassXC

In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field. Provided that the db file has very good password, is this ...
robertspierre's user avatar
0 votes
1 answer
316 views

What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts

What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts? Use case, both of parties use third party ...
user294265's user avatar
0 votes
1 answer
114 views

How can we ensure the best practice with mail pgp when the recipient is not using it?

How can we ensure the best practice with mail pgp when the recipient is not using it?, so when Bob send the vary first email to Alex, Bob signing and encrypted it? Q1. In that case, Is Alex able to ...
user294265's user avatar
2 votes
1 answer
1k views

PGP key pair - How to set up for multiple users to decrypt messages with Kleopatra

This is my first project of this nature, and I am hoping this is a basic use case for PGP encryption. Please forgive my ignorance! There is a server being configured by a service provider (SP). The SP ...
Clifford Piehl's user avatar
1 vote
0 answers
214 views

Why does the fingerprint of a GPG key change after it is made a sub key?

I recently consolidated some of my independently GPG keys. I used the following the command to edit the oldest key gpg --expert --edit-key <oldest-keygrip> gpg> add-key --keygrip=<another-...
ksinkar's user avatar
  • 111
1 vote
2 answers
664 views

what is the safest way to open/decrypt an encrypted gpg/pgp file in memory | gnu/linux debian?

I would like to open/decrypt an encrypted gpg/pgp file in the main memory without leaving any footprints on the file system including swap,etc. what is the safest option on a gnu/linux debian from ...
Z0OM's user avatar
  • 119
1 vote
0 answers
125 views

Login with self-signed PGP/GPG cert. without security key

Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal ...
Unix's user avatar
  • 13
0 votes
1 answer
113 views

Is my PGP key which I uploaded to sync.net compromised?

I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
Someone's user avatar
  • 169
3 votes
2 answers
1k views

Brute forcing lost password for PGP encrypted file (symmetric)

I have a file I encrypted with PGP in 2003. It contains some personal data I'd like to regain access to. I have vague idea of the password, but not enough to successfully guess; but I know its ...
mdw's user avatar
  • 31
1 vote
1 answer
101 views

How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?

I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party ...
Murch's user avatar
  • 131
1 vote
0 answers
115 views

Can an email address attached to key be traced back to me? [closed]

I used my actual protonmail email address at the start of creating my own key. Can this email address be traced to me? So when I sign something with my key and it's decrypted, can anyone see the email ...
Mitch's user avatar
  • 11
1 vote
0 answers
379 views

Which PGP fingerprint to share/publish as my digital identity?

The primary secret key should be stored offline and only be used for creating/signing keys. There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
fooness's user avatar
  • 11
1 vote
1 answer
489 views

What is the purpose of PGP email signatures?

As far as I understand, the only purpose of PGP signatures is to prove your identity. Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email ...
user avatar
1 vote
0 answers
163 views

Using GPG is there a way to label public keys on my OpenPGP keyring?

I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
A H's user avatar
  • 11
4 votes
1 answer
5k views

What are the security implications of using GPG instead of SSH keys for authentication

I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
SomethingSomething's user avatar
0 votes
1 answer
931 views

PGP identity for Telegram account

I want to use a Telegram username instead of an email address in a PGP key. Is there an agreed upon standard for doing this? Do you know a software or service which acts as a bridge to connect a PGP ...
stefd's user avatar
  • 121
0 votes
0 answers
174 views

PGP public key flagged as malicious to root. Was ran before

Hello I had used this pgp public key on my win10 OS with pgptool to message someone. Then when i used that same public key in whonix OS console it came back with some type of warning about malicious ...
jowblow's user avatar
0 votes
0 answers
145 views

Create "bare" pgp private key / Make private key without being able to generate the public key from it

How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
Myzel394's user avatar
  • 142
4 votes
0 answers
446 views

Best practices for GPG user ids and mail extensions / catch-all addresses

Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
Felix Stupp's user avatar
0 votes
1 answer
456 views

deleted a subkey and can now no longer decrypt

My public key had expired so I tried to edit the expiry date with gpg --edit-key It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
cardamom's user avatar
  • 379
3 votes
1 answer
1k views

Best practices for verifying authenticity of public key

When one desires to share their public key openly, besides sharing just the key itself: How does one verify that the key belongs to who it claims to be owned by? What is the use case of the key's ...
a79ce734e1's user avatar
2 votes
1 answer
601 views

Why a public key must be signed with its private pair in PGP

I know about the trust web in PGP. When you sign a key, everybody that trusts you will trust the person with that key. But what is the point of self-signing a key when anybody else can do that with ...
Fish_n_Chips's user avatar
3 votes
1 answer
191 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
Turysaz's user avatar
  • 33
1 vote
1 answer
708 views

Sub-key or new key-pair? (PGP/GPG Newbie)

I saw a PGP/GPG key of a dude on the internet with different sub-keys. The reason is that when one sub-key expires, he creates a new one. Now, from a security protective, is it better to create a new ...
The Bad One's user avatar
0 votes
2 answers
164 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
Munchkin's user avatar
  • 264
2 votes
2 answers
655 views

Can you use GPG to decrypt and encrypt with a different key in one step?

I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
Lindylead's user avatar
7 votes
4 answers
3k views

Why trust a PGP signature if it is distributed along with the data being verified?

Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
iwab's user avatar
  • 181
10 votes
1 answer
2k views

How do GPG smart card devices handle large GPG operations?

How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs. My first 2 pet theories are: There's some way to chunk up GPG operations or use some ...
VixieTSQ's user avatar
  • 103
3 votes
2 answers
3k views

Can I use Yubikey to encrypt a file without PGP?

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it. I know you can save a PGP key onto Yubikey and use it ...
Sergei Fomin's user avatar
0 votes
1 answer
432 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
Danya02's user avatar
  • 373
0 votes
1 answer
5k views

PGP - Use Public key to Decrypt ? (or how that is totally wrong)

I was given a PGP encrypted file, and have been told I can decrypt it using a public key. I don't think that will work. Can anyone that knows for sure how PGP works confirm that what I've been told is ...
joedotnot's user avatar
  • 337
3 votes
2 answers
2k views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
Maximilian Keßler's user avatar
-1 votes
1 answer
286 views

Prevent server MITM attack

I want to create a secure messaging application such that you don't have to trust the server. Register with username and password. -> Generate a pair of PGP keys (RSA). -> Encrypt the private ...
LemN82's user avatar
  • 1
-1 votes
2 answers
597 views

PGP: how does the owner of a public key generate the fingerprint?

Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
user271748's user avatar
4 votes
1 answer
550 views

Approval of GPG key strategy

I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now. I've worked out a GPG key strategy and i ...
ieggel's user avatar
  • 225

1
2 3 4 5
15