Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
1
vote
1answer
33 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://tools.ietf.org/html/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0
votes
1answer
37 views

Can I add other key holders to an existing PGP file?

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a ...
2
votes
1answer
90 views

What's the purpose of a key hash when you have the fingerprint?

Looking for "Barack Obama" in Ubuntu's keyserver return these results For example, take the first search result: pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z ...
1
vote
1answer
121 views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
2
votes
1answer
74 views

Is there some way to verify that what I think I encrypted is actually what was encrypted when I don't have the private key? (PGP) [duplicate]

Let's say that Joe gives his PGP public key to Sue so that Sue can send Joe a secret message. Sue opens her PGP/GPG program, types I'm in love with Joe! and encrypts the message with Joe's public key. ...
1
vote
0answers
112 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
1
vote
1answer
92 views

Understanding GnuPG --export-options backup

The GnuPG documentation lists an option called --export-options parameters. One of the possible parameters for this option is backup (aliased export-backup). The description for --export-options ...
2
votes
3answers
98 views

Reading locally-stored emails sent encrypted

As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key). ...
0
votes
0answers
56 views

Do I need to backup my GPG key again after extending its expiry date?

I have just extended the expiry date of my GPG key by following these instructions: Can you extend the expiration date of an already expired GPG key? I have previously backed-up my key. Do I need to ...
1
vote
0answers
53 views

Import secret key into GnuPg doesn't work?

I would like to import a private key into GPG so I did: gpg --allow-secret-key-import --import /path/to/key/key.asc gpg: key 51D5DF493ECAFF88: "John Doe <john.doe@acme.com>" not ...
0
votes
2answers
62 views

No expiry for offline primary PGP key?

Are there benefits to set an expiration date on a PGP primary key which is only used offline? Is setting an expiration date only on the subkeys enough?
0
votes
1answer
275 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
0
votes
2answers
84 views

pgp public key failed to propogate

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
1
vote
1answer
121 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
0answers
88 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
0
votes
1answer
72 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
63 views

What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is?

I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do: Parse the ...
0
votes
1answer
56 views

keys.openpgp.org keyserver fails to send confirmation mail to an Outlook-address

I uploaded my master key's public part to the keys.openpgp.org-keyserver. It has 4 UIDs set up (4 different e-mail addresses) and each of them are correct and valid e-mail addresses. The keyserver ...
1
vote
1answer
133 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
0
votes
0answers
36 views

GPG Questions About Exporting Subkeys to File

GPG novice here so please bear with me. From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb). If I wanted to give these to another party ...
3
votes
2answers
110 views

Is PGP passphrase necessary if I store private key and passphrase in the same place?

I'm building a system that generates PGP key and store private key in secret vault. One thing I'm not fully understanding is the need for passphrase. I can generate a random passphrase during the key ...
0
votes
0answers
100 views

Read and parse PGP keys

Good morning, my goal is to parse pgp keys but I am facing two problems. I don't know how pgp keys are encoded (for starters I deal with pgp keys generated by Rsa only) and nor do I know how to read ...
0
votes
3answers
100 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
1
vote
0answers
66 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
1
vote
0answers
39 views

Format for data & key exchange/storage [duplicate]

Is there a standard format for storing/exchanging encrypted data along with the key needed to decrypt it (data is encrypted with a single use symmetric key and the symmetric key itself is encrypted ...
1
vote
1answer
61 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
46
votes
7answers
10k views

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

I don't have an education in computer science, I've just become interested in information security and encryption lately. I'm struggling to understand why encrypted web browsing using HTTPS has been ...
0
votes
0answers
60 views

GPG issues with sending and receiving keys

I've experimented a lot with GPG the last couple days and one issue persists: Someone signed my GPG key and published it to a keyserver X. I can see on the webpage that his signature is shown under ...
2
votes
1answer
942 views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
82 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
182 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
0
votes
1answer
146 views

PGP encryption passphrase

We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the ...
0
votes
1answer
160 views

Using GPG or PGP, is there a way to give another user (or key) access to decrypt a file for a limited time only? [duplicate]

I want to share encrypted files with someone else however it's only for a short time only. What is the best way to do this? More background: I'd like to add more people to be able to decrypt the ...
6
votes
1answer
423 views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
0
votes
0answers
79 views

How to automatically sign a message using PGP in an email?

Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message. For Example, A wants to send a message to B. A open its email ...
2
votes
1answer
121 views

Is it possible for me to somehow verify that the PGP message blob I just generated contains what I intended for it to contain?

I have this text: Would you mind stopping by the local store and buy some baking soda for tomorrow, Betty-Sue? Betty-Sue has given me her public PGP key, which I have imported and now use to encrypt ...
0
votes
0answers
50 views

How to import pgp backup back into smartcard?

I generated a backup of my master key and 3 sub keys following this into these archives: gpg.conf mastersub.key openpgp-recovs.d private-keys-v1.d (contains 4 .key files) pubring.kbx random_seed ...
-2
votes
2answers
148 views

How does PGP Public and Private Keys work?

I recently tried to understand how PGP works: I encrypt plaintext with my private key and if I send that encrypted text to others with my public key they can encrypt that with my public key?
0
votes
2answers
94 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?
55
votes
8answers
18k views

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed: I know Joe's e-mail address: cool_joe@gmail.com. I have a ...
-4
votes
1answer
132 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
0answers
263 views

changing passphrase on gpg subkey

Is it possible to change passphrase on a subkey by: gpg --edit-key sub_key_id passwd Or will this change the passphrase on the master key as well? (My idea stems from the fact that master key is ...
1
vote
0answers
46 views

How to list signatures of public key file without importing it to keyring?

How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available. I would like a similar output to gpg --list-signatures <key-id>, but ...
21
votes
8answers
7k views

Is PGP for user authentication a good idea?

I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication. How I'm doing it right now My current concept is modeled ...
1
vote
0answers
83 views

Why GPG signature is not considered as made by a trusted key?

When I verify a file signature I get the the following warning: $ gpg --verify file.sig gpg: Signature made So 01 Dez 2019 10:08:27 CET gpg: using RSA key <Pierre's key ID> gpg: ...
1
vote
1answer
1k views

Is it possible to decrypt a PGP encrypted file without private key?

I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data. Recently, my colleagues told ...
1
vote
0answers
33 views

how to simulate gpg severkey DoS attack?

I tried to simulate this attack in my PC but I could not generate a poison key, I used Linux (Ubuntu 18.04) and GPG software (gpg (GnuPG) 2.2.4). I tried to manipulate public key and import it to ...
1
vote
2answers
108 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
0
votes
1answer
43 views

Can I resubmit my GPG key to a keyserver?

I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
3
votes
1answer
315 views

Is there a secure way to host private PGP keys (is keybase's method secure?)

Keybase's decryption page says "you must host your private key in Keybase's encrypted key store." This really rubs me the wrong way. I was under the impression that your private key should not leave ...

1
2 3 4 5
14