Questions tagged [pgp]
PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.
703
questions
0
votes
1
answer
48
views
Does an official IETF-codified URN exist for PGP keys?
I've been able to locate http://www.aaronsw.com/2002/draft-swartz-pgp-urn-00, but it appears to be an unofficial proposal never submitted to the IETF. Does it hold any water?
4
votes
1
answer
129
views
GPG allows importing an invalid secp256k1 public key
I came across a PGP public key that seems invalid. The key is a secp256k1 public key that supported by GPG. In fact, GPG allows importing that key even if it has an invalid secp256k1 public key inside....
- 143
0
votes
1
answer
123
views
Why is ECC (Eliptical Curve) an `--expert` feature in PGP?
Eleptial Curve is now included in PGP. However when I run gpg2 --full-gen-key, I get
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
...
- 2,702
1
vote
1
answer
60
views
With selfhosting email server, selfsigned certificate, does it make a difference with PGP mail, What can be leaked?
If we are self hosting our own email server with mydomain.com with a self sign CA for S/MIME. What are some possible ways that our email content can get leaked?
Then if we use PGP email, does it make ...
- 17
0
votes
2
answers
352
views
Backup GPG private key in KeePassXC
In order to keep all my secret in the same place, I would like to store my GPG private key in KeePassXC, under the "Notes" field.
Provided that the db file has very good password, is this ...
- 517
0
votes
1
answer
134
views
What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts
What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts?
Use case, both of parties use third party ...
- 17
0
votes
1
answer
55
views
How can we ensure the best practice with mail pgp when the recipient is not using it?
How can we ensure the best practice with mail pgp when the recipient is not using it?, so when Bob send the vary first email to Alex, Bob signing and encrypted it?
Q1. In that case, Is Alex able to ...
- 17
2
votes
1
answer
533
views
PGP key pair - How to set up for multiple users to decrypt messages with Kleopatra
This is my first project of this nature, and I am hoping this is a basic use case for PGP encryption. Please forgive my ignorance!
There is a server being configured by a service provider (SP). The SP ...
- 123
1
vote
0
answers
102
views
Why does the fingerprint of a GPG key change after it is made a sub key?
I recently consolidated some of my independently GPG keys.
I used the following the command to edit the oldest key
gpg --expert --edit-key <oldest-keygrip>
gpg> add-key --keygrip=<another-...
- 111
1
vote
2
answers
459
views
what is the safest way to open/decrypt an encrypted gpg/pgp file in memory | gnu/linux debian?
I would like to open/decrypt an encrypted gpg/pgp file in the main memory without leaving any footprints on the file system including swap,etc.
what is the safest option on a gnu/linux debian from ...
- 119
1
vote
0
answers
83
views
Login with self-signed PGP/GPG cert. without security key
Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal ...
- 13
0
votes
1
answer
65
views
Is my PGP key which I uploaded to sync.net compromised?
I just accidentally uploaded my PGP key in unencrypted format to rsync.net. As far as I know, nobody but me has access to the account. Is my key compromised?
- 149
3
votes
2
answers
724
views
Brute forcing lost password for PGP encrypted file (symmetric)
I have a file I encrypted with PGP in 2003. It contains some personal data I'd like to regain access to. I have vague idea of the password, but not enough to successfully guess; but I know its ...
- 31
1
vote
1
answer
49
views
How can I use `caff` to sign some keys at cert-level 2 and some at cert-level 3?
I participated in two key sharing parties last week. Upon return, I tried to certify the keys of the participants that I had verified. For creating the signatures, I use caff from the signing-party ...
- 131
1
vote
0
answers
75
views
Can an email address attached to key be traced back to me? [closed]
I used my actual protonmail email address at the start of creating my own key. Can this email address be traced to me?
So when I sign something with my key and it's decrypted, can anyone see the email ...
- 11
1
vote
0
answers
251
views
Which PGP fingerprint to share/publish as my digital identity?
The primary secret key should be stored offline and only be used for creating/signing keys.
There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
- 11
1
vote
1
answer
329
views
What is the purpose of PGP email signatures?
As far as I understand, the only purpose of PGP signatures is to prove your identity. Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email ...
user283321
1
vote
0
answers
99
views
Using GPG is there a way to label public keys on my OpenPGP keyring?
I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
- 11
2
votes
1
answer
3k
views
What are the security implications of using GPG instead of SSH keys for authentication
I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
0
votes
1
answer
645
views
PGP identity for Telegram account
I want to use a Telegram username instead of an email address in a PGP key.
Is there an agreed upon standard for doing this? Do you know a software or service which acts as a bridge to connect a PGP ...
- 121
0
votes
0
answers
126
views
PGP public key flagged as malicious to root. Was ran before
Hello I had used this pgp public key on my win10 OS with pgptool to message someone.
Then when i used that same public key in whonix OS console it came back with some type of warning about malicious ...
- 1
0
votes
0
answers
85
views
Create "bare" pgp private key / Make private key without being able to generate the public key from it
How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
- 142
3
votes
0
answers
302
views
Best practices for GPG user ids and mail extensions / catch-all addresses
Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
- 83
0
votes
1
answer
318
views
deleted a subkey and can now no longer decrypt
My public key had expired so I tried to edit the expiry date with
gpg --edit-key
It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
- 379
2
votes
1
answer
644
views
Best practices for verifying authenticity of public key
When one desires to share their public key openly, besides sharing just the key itself:
How does one verify that the key belongs to who it claims to be owned by?
What is the use case of the key's ...
- 123
2
votes
1
answer
381
views
Why a public key must be signed with its private pair in PGP
I know about the trust web in PGP. When you sign a key, everybody that trusts you will trust the person with that key. But what is the point of self-signing a key when anybody else can do that with ...
- 121
3
votes
1
answer
139
views
Why are key IDs typically the *last* digits of the key hash?
With PGP for example, the "properties" of the following key are:
pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02]
6713B62DC36CE36403C724B1FFD641CF2BD6571B
uid [...
- 33
1
vote
1
answer
533
views
Sub-key or new key-pair? (PGP/GPG Newbie)
I saw a PGP/GPG key of a dude on the internet with different sub-keys.
The reason is that when one sub-key expires, he creates a new one.
Now, from a security protective, is it better to create a new ...
- 31
0
votes
2
answers
126
views
Secure data (+ private key) storage in an insecure public cloud environment
We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure.
The data should be so secure ...
- 244
2
votes
2
answers
341
views
Can you use GPG to decrypt and encrypt with a different key in one step?
I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
- 21
7
votes
4
answers
3k
views
Why trust a PGP signature if it is distributed along with the data being verified?
Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
- 181
10
votes
1
answer
2k
views
How do GPG smart card devices handle large GPG operations?
How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.
My first 2 pet theories are:
There's some way to chunk up GPG operations or use some ...
- 103
2
votes
2
answers
2k
views
Can I use Yubikey to encrypt a file without PGP?
I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it.
I know you can save a PGP key onto Yubikey and use it ...
- 29
0
votes
1
answer
257
views
PGP "real" encryption with private key
When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
- 163
0
votes
1
answer
3k
views
PGP - Use Public key to Decrypt ? (or how that is totally wrong)
I was given a PGP encrypted file, and have been told I can decrypt it using a public key. I don't think that will work.
Can anyone that knows for sure how PGP works confirm that what I've been told is ...
- 337
3
votes
2
answers
1k
views
Exact meaning of RSA key in `gpg --verify` output
When verifying a pgp signed message using GnuPG, one gets an output similar to the following:
gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg: using RSA key ...
-1
votes
1
answer
225
views
Prevent server MITM attack
I want to create a secure messaging application such that you don't have to trust the server.
Register with username and password. ->
Generate a pair of PGP keys (RSA). ->
Encrypt the private ...
- 1
-1
votes
2
answers
388
views
PGP: how does the owner of a public key generate the fingerprint?
Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
4
votes
1
answer
404
views
Approval of GPG key strategy
I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now.
I've worked out a GPG key strategy and i ...
- 183
3
votes
2
answers
240
views
How can I prove the content of a PGP-encrypted message to a third party?
Imagine this scenario
A StackExchange user sends you a PGP-encrypted message
You decrypt the message and discover that you are being blackmailed
You report the message to the admins but they are ...
- 33
0
votes
0
answers
122
views
Cross signing practice for PGP package signing keys?
I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019).
PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
- 123
1
vote
3
answers
744
views
Standard for encrypt files before transfer them over internet
I know there are some standards for transferring data securely such as HTTPS for web applications, or SPC & SFTP for secure file transfers.
Encrypting files using PGP is a way to encrypt files ...
- 185
1
vote
1
answer
2k
views
Why does ECC not have an encrypt capability in GPG, but RSA does?
I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model.
Much of it is following guides which I believe are still considered best practices:
https://...
- 111
0
votes
1
answer
152
views
Is there a use for an MDC even when all messages are signed?
I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
- 567
6
votes
1
answer
986
views
How are the PGP keys that Thunderbird 78+ uses encrypted?
With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
- 567
3
votes
0
answers
285
views
Move signing subkey to authentication slot on YubiKey (OpenPGP card)?
My PGP primary key is only used for certification—I use a separate subkey for signing. Like this:
sec rsa4096/0x891781D0EDC66456 ...
- 396
2
votes
2
answers
406
views
Why isn't there a protocol to exchange PGP keys?
Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters?
I imagine a quite simple process like other established ...
- 212
3
votes
1
answer
491
views
How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?
Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include:
Hosting the website under HTTPS;
...
- 5,747
0
votes
1
answer
209
views
Enlighten Me Please Regarding PGP Encryption [duplicate]
I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
- 103
0
votes
1
answer
208
views
how does the certificate distributed by the CA work? [closed]
I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender.
How does it work?
Can you use simple and easily ...
