Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

How does pretty good privacy works for authentication and confidentiality?

I needed to study about these 2 topics. So I picked up a keyword "pretty good privacy" "authentication" "confidentiality" and searched for books in libgen google books I ...
user avatar
  • 1
0 votes
1 answer
13 views

Sub-key or new key-pair? (PGP/GPG Newbie)

I saw a PGP/GPG key of a dude on the internet with different sub-keys. The reason is that when one sub-key expires, he creates a new one. Now, from a security protective, is it better to create a new ...
user avatar
0 votes
0 answers
13 views

Can I use ssh-rsa AAA...== cardno:000123456 to import my yubikey public key into open gpg?

I made a private key and sent to my yubikey. However, I lost the public key file corresponding to it, but I have the ssh-rsa AAA...== cardno:000123456 thing. How can I import this public key to my ...
user avatar
  • 121
0 votes
0 answers
8 views

PGP certify key redundancy

The whole issue is caused by my usage openpgp cards I have 3 cards where I am using one as a Master card with Certify key on it and the second one as a daily runner. The third card was meant to be ...
user avatar
  • 101
0 votes
2 answers
78 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
user avatar
  • 200
1 vote
2 answers
50 views

Can you use GPG to decrypt and encrypt with a different key in one step?

I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
user avatar
7 votes
4 answers
2k views

Why trust a PGP signature if it is distributed along with the data being verified?

Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
user avatar
  • 71
7 votes
1 answer
2k views

How do GPG smart card devices handle large GPG operations?

How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs. My first 2 pet theories are: There's some way to chunk up GPG operations or use some ...
user avatar
0 votes
1 answer
88 views

Can I use Yubikey to encrypt a file without PGP?

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it. I know you can save a PGP key onto Yubikey and use it ...
user avatar
0 votes
1 answer
59 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
user avatar
  • 131
0 votes
1 answer
124 views

PGP - Use Public key to Decrypt ? (or how that is totally wrong)

I was given a PGP encrypted file, and have been told I can decrypt it using a public key. I don't think that will work. Can anyone that knows for sure how PGP works confirm that what I've been told is ...
user avatar
  • 307
0 votes
2 answers
134 views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
user avatar
-1 votes
1 answer
114 views

Prevent server MITM attack

I want to create a secure messaging application such that you don't have to trust the server. Register with username and password. -> Generate a pair of PGP keys (RSA). -> Encrypt the private ...
user avatar
  • 1
-1 votes
2 answers
101 views

PGP: how does the owner of a public key generate the fingerprint?

Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
user avatar
3 votes
1 answer
171 views

Approval of GPG key strategy

I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now. I've worked out a GPG key strategy and i ...
user avatar
  • 133
3 votes
2 answers
180 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
user avatar
  • 33
0 votes
0 answers
74 views

Cross signing practice for PGP package signing keys?

I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019). PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
user avatar
  • 113
1 vote
3 answers
176 views

Standard for encrypt files before transfer them over internet

I know there are some standards for transferring data securely such as HTTPS for web applications, or SPC & SFTP for secure file transfers. Encrypting files using PGP is a way to encrypt files ...
user avatar
  • 185
1 vote
1 answer
444 views

Why does ECC not have an encrypt capability in GPG, but RSA does?

I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model. Much of it is following guides which I believe are still considered best practices: https://...
user avatar
  • 111
0 votes
1 answer
109 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
user avatar
  • 547
6 votes
1 answer
368 views

How are the PGP keys that Thunderbird 78+ uses encrypted?

With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
user avatar
  • 547
3 votes
0 answers
129 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
user avatar
2 votes
2 answers
263 views

Why isn't there a protocol to exchange PGP keys?

Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters? I imagine a quite simple process like other established ...
user avatar
  • 212
2 votes
1 answer
189 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
user avatar
  • 5,587
0 votes
1 answer
120 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
user avatar
  • 103
0 votes
1 answer
129 views

how does the certificate distributed by the CA work? [closed]

I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender. How does it work? Can you use simple and easily ...
user avatar
0 votes
1 answer
93 views

When changing a PGP passphrase, does it only affect the same key on the other machine?

If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B? Will I still be able to use the PGP key on Computer B ...
user avatar
  • 113
1 vote
3 answers
281 views

Should I backup a GPG key used for Authentication?

Regarding backups (escrows) of GPG (OpenPGP compliant) keys, I seem to understand that (E)ncryption keys need to be backed up, to prevent data loss, and that (S)igning keys should not be backed up, ...
user avatar
0 votes
1 answer
111 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
user avatar
0 votes
1 answer
193 views

Standard form of email signature

A little bit of background: I want to sign my emails for my own safety. None of my intended recipients are users of digital signatures. If one day someone were to impersonate me, I can prove my own ...
user avatar
2 votes
1 answer
362 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
user avatar
  • 123
1 vote
1 answer
234 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://www.rfc-editor.org/rfc/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
user avatar
0 votes
1 answer
82 views

Can I add other key holders to an existing PGP file?

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a ...
user avatar
2 votes
1 answer
161 views

What's the purpose of a key hash when you have the fingerprint?

Looking for "Barack Obama" in Ubuntu's keyserver return these results For example, take the first search result: pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z ...
user avatar
2 votes
1 answer
1k views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
user avatar
2 votes
1 answer
125 views

Is there some way to verify that what I think I encrypted is actually what was encrypted when I don't have the private key? (PGP) [duplicate]

Let's say that Joe gives his PGP public key to Sue so that Sue can send Joe a secret message. Sue opens her PGP/GPG program, types I'm in love with Joe! and encrypts the message with Joe's public key. ...
user avatar
  • 21
1 vote
0 answers
263 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
user avatar
  • 111
4 votes
2 answers
391 views

Understanding GnuPG --export-options backup

The GnuPG documentation lists an option called --export-options parameters. One of the possible parameters for this option is backup (aliased export-backup). The description for --export-options ...
user avatar
2 votes
3 answers
162 views

Reading locally-stored emails sent encrypted

As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key). ...
user avatar
  • 1,013
0 votes
0 answers
181 views

Do I need to backup my GPG key again after extending its expiry date?

I have just extended the expiry date of my GPG key by following these instructions: Can you extend the expiration date of an already expired GPG key? I have previously backed-up my key. Do I need to ...
user avatar
  • 583
1 vote
0 answers
237 views

Import secret key into GnuPg doesn't work?

I would like to import a private key into GPG so I did: gpg --allow-secret-key-import --import /path/to/key/key.asc gpg: key 51D5DF493ECAFF88: "John Doe <john.doe@acme.com>" not ...
user avatar
  • 347
0 votes
2 answers
223 views

No expiry for offline primary PGP key?

Are there benefits to set an expiration date on a PGP primary key which is only used offline? Is setting an expiration date only on the subkeys enough?
user avatar
  • 493
0 votes
1 answer
598 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
user avatar
  • 585
0 votes
2 answers
207 views

pgp public key failed to propogate

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
user avatar
  • 357
2 votes
1 answer
522 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
user avatar
  • 200
1 vote
0 answers
205 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
user avatar
  • 111
0 votes
1 answer
215 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
user avatar
0 votes
1 answer
115 views

What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is?

I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do: Parse the ...
user avatar
0 votes
1 answer
162 views

keys.openpgp.org keyserver fails to send confirmation mail to an Outlook-address

I uploaded my master key's public part to the keys.openpgp.org-keyserver. It has 4 UIDs set up (4 different e-mail addresses) and each of them are correct and valid e-mail addresses. The keyserver ...
user avatar
1 vote
1 answer
297 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
user avatar
  • 1,594

1
2 3 4 5
14