Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
38 views

Which PGP fingerprint to share/publish as my digital identity?

The primary secret key should be stored offline and only be used for creating/signing keys. There will be at least two secret keys: one primary key or subkey for signing, and one subkey for encryption;...
0 votes
0 answers
6 views

PGP disk passphrase not recognized [migrated]

I have an external drive fully encrypted with Symantec encryption desktop software using a pgp key. It has been done 15 years ago. Today I try to access the disk, but it's not working. It doesn't ...
1 vote
1 answer
58 views

What is the purpose of PGP email signatures?

As far as I understand, the only purpose of PGP signatures is to prove your identity. Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email ...
user avatar
1 vote
0 answers
15 views

Using GPG is there a way to label public keys on my OpenPGP keyring?

I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
  • 11
0 votes
0 answers
16 views

How to extract the primary user id from a PGP key

I am writing a front-end to display details about the PGP keys that we have stored in a database. One question I have is how to know which user id is the "primary" user id. For example, a ...
0 votes
1 answer
86 views

What are the security implications of using GPG instead of SSH keys for authentication

I want to use a GPG key instead of an SSH key. Looking online I found several guides on how to do it. But these guides are about using GPG for convenience. I instead want to know the pros and cons ...
0 votes
1 answer
95 views

PGP identity for Telegram account

I want to use a Telegram username instead of an email address in a PGP key. Is there an agreed upon standard for doing this? Do you know a software or service which acts as a bridge to connect a PGP ...
  • 119
0 votes
0 answers
69 views

PGP public key flagged as malicious to root. Was ran before

Hello I had used this pgp public key on my win10 OS with pgptool to message someone. Then when i used that same public key in whonix OS console it came back with some type of warning about malicious ...
0 votes
0 answers
49 views

Create "bare" pgp private key / Make private key without being able to generate the public key from it

How do you create a private-key/public-key pair without the public key's information in the private key? So you should basically not be able to extract the public key from the private key. The private ...
  • 142
0 votes
0 answers
58 views

Best practices for GPG user ids and mail extensions / catch-all addresses

Assuming I want to use different mail addresses for different purposes and using either a catch-all configuration (*@example.com) or mail extensions (e.g. me+*@example.com) (where * can be replaced ...
0 votes
1 answer
121 views

deleted a subkey and can now no longer decrypt

My public key had expired so I tried to edit the expiry date with gpg --edit-key It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the ...
  • 359
2 votes
1 answer
236 views

Best practices for verifying authenticity of public key

When one desires to share their public key openly, besides sharing just the key itself: How does one verify that the key belongs to who it claims to be owned by? What is the use case of the key's ...
  • 123
1 vote
1 answer
89 views

Why a public key must be signed with its private pair in PGP

I know about the trust web in PGP. When you sign a key, everybody that trusts you will trust the person with that key. But what is the point of self-signing a key when anybody else can do that with ...
0 votes
0 answers
32 views

Is it posible to remove a public pgp key without a UID (gnuPG)

I use gnuPG on a linux machine. A while back I received a pgp key that sender didn't apply a UID to. While performing a test restore of the keychain I found it errored out at this key. It doesn't ...
  • 103
3 votes
1 answer
90 views

Why are key IDs typically the *last* digits of the key hash?

With PGP for example, the "properties" of the following key are: pub rsa3072/2BD6571B 2022-06-03 [SC] [expires: 2024-06-02] 6713B62DC36CE36403C724B1FFD641CF2BD6571B uid [...
  • 33
0 votes
1 answer
74 views

Sub-key or new key-pair? (PGP/GPG Newbie)

I saw a PGP/GPG key of a dude on the internet with different sub-keys. The reason is that when one sub-key expires, he creates a new one. Now, from a security protective, is it better to create a new ...
0 votes
0 answers
42 views

Can I use ssh-rsa AAA...== cardno:000123456 to import my yubikey public key into open gpg?

I made a private key and sent to my yubikey. However, I lost the public key file corresponding to it, but I have the ssh-rsa AAA...== cardno:000123456 thing. How can I import this public key to my ...
  • 11
0 votes
0 answers
13 views

PGP certify key redundancy

The whole issue is caused by my usage openpgp cards I have 3 cards where I am using one as a Master card with Certify key on it and the second one as a daily runner. The third card was meant to be ...
  • 101
0 votes
2 answers
95 views

Secure data (+ private key) storage in an insecure public cloud environment

We are trying to encrypt files in a manner that they can be completely secure in an insecure environment (like a public cloud). We're talking about military grade secure. The data should be so secure ...
  • 212
1 vote
2 answers
87 views

Can you use GPG to decrypt and encrypt with a different key in one step?

I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (...
6 votes
4 answers
2k views

Why trust a PGP signature if it is distributed along with the data being verified?

Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?
  • 71
9 votes
1 answer
2k views

How do GPG smart card devices handle large GPG operations?

How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs. My first 2 pet theories are: There's some way to chunk up GPG operations or use some ...
0 votes
1 answer
369 views

Can I use Yubikey to encrypt a file without PGP?

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it. I know you can save a PGP key onto Yubikey and use it ...
0 votes
1 answer
83 views

PGP "real" encryption with private key

When explaining the concept of signing a message, often it is presented as "encrypting with your private key", so that somebody who has the public key can "decrypt" the signature ...
  • 131
0 votes
1 answer
407 views

PGP - Use Public key to Decrypt ? (or how that is totally wrong)

I was given a PGP encrypted file, and have been told I can decrypt it using a public key. I don't think that will work. Can anyone that knows for sure how PGP works confirm that what I've been told is ...
  • 307
2 votes
2 answers
358 views

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
-1 votes
1 answer
133 views

Prevent server MITM attack

I want to create a secure messaging application such that you don't have to trust the server. Register with username and password. -> Generate a pair of PGP keys (RSA). -> Encrypt the private ...
  • 1
-1 votes
2 answers
174 views

PGP: how does the owner of a public key generate the fingerprint?

Consider a situation where Alice and Bob don't know each other, and Alice sends some data to Bob and provides a PGP digital signature. Bob obtains Alice's public key, and successfully verifies that ...
3 votes
1 answer
229 views

Approval of GPG key strategy

I am a beginner in anything related to GPG and I have now read quite some stuff about it to get a better idea. I think i grasped most of the concepts by now. I've worked out a GPG key strategy and i ...
  • 153
3 votes
2 answers
189 views

How can I prove the content of a PGP-encrypted message to a third party?

Imagine this scenario A StackExchange user sends you a PGP-encrypted message You decrypt the message and discover that you are being blackmailed You report the message to the admins but they are ...
  • 33
0 votes
0 answers
80 views

Cross signing practice for PGP package signing keys?

I consider WEB of trust as a failed initiative (search for SKS key poisoning mass occurred in 2019). PGP is used to sign software in source (commits / tags in Git/Mercirual) & binary (compiled ...
  • 113
1 vote
3 answers
249 views

Standard for encrypt files before transfer them over internet

I know there are some standards for transferring data securely such as HTTPS for web applications, or SPC & SFTP for secure file transfers. Encrypting files using PGP is a way to encrypt files ...
  • 185
1 vote
1 answer
734 views

Why does ECC not have an encrypt capability in GPG, but RSA does?

I'm attempting to establish a process for setting up a new GPG identity for myself and my threat model. Much of it is following guides which I believe are still considered best practices: https://...
  • 111
0 votes
1 answer
121 views

Is there a use for an MDC even when all messages are signed?

I guess I have halfway grasped the concepts of PGP, and I've halfway understood the concept of the Efail attack. However, I still don't understand whether such attacks would be possible (and an MDC ...
  • 557
6 votes
1 answer
507 views

How are the PGP keys that Thunderbird 78+ uses encrypted?

With Thunderbird 78, a new PGP subsystem has been introduced which handles PGP keys internally. In previous versions, the add-on Enigmail has handled PGP-related stuff, by letting do GnuPG the work ...
  • 557
3 votes
0 answers
168 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
2 votes
2 answers
296 views

Why isn't there a protocol to exchange PGP keys?

Why isn't there a defined protocol to retrieve PGP keys from a destination mail server? Or am I just not searching with the right parameters? I imagine a quite simple process like other established ...
  • 212
2 votes
1 answer
247 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
  • 5,617
0 votes
1 answer
133 views

Enlighten Me Please Regarding PGP Encryption [duplicate]

I have somebody's public PGP key imported on my laptop (Debian Linux), but not their private key. When I encrypt a file to them using their public key, I can then decrypt it again even though I don't ...
  • 103
0 votes
1 answer
135 views

how does the certificate distributed by the CA work? [closed]

I generally wanted to know how a certificate works, I mean a certificate distributed by the Certificate Authority to identify the identity of a sender. How does it work? Can you use simple and easily ...
0 votes
1 answer
98 views

When changing a PGP passphrase, does it only affect the same key on the other machine?

If I change the password of my PGP key (I use it to sign Git commit) on Computer A, does it affect the same PGP key that I have on the Computer B? Will I still be able to use the PGP key on Computer B ...
  • 113
1 vote
3 answers
311 views

Should I backup a GPG key used for Authentication?

Regarding backups (escrows) of GPG (OpenPGP compliant) keys, I seem to understand that (E)ncryption keys need to be backed up, to prevent data loss, and that (S)igning keys should not be backed up, ...
0 votes
1 answer
121 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
0 votes
1 answer
219 views

Standard form of email signature

A little bit of background: I want to sign my emails for my own safety. None of my intended recipients are users of digital signatures. If one day someone were to impersonate me, I can prove my own ...
2 votes
1 answer
489 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
  • 123
1 vote
1 answer
289 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://www.rfc-editor.org/rfc/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0 votes
1 answer
84 views

Can I add other key holders to an existing PGP file?

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a ...
2 votes
1 answer
210 views

What's the purpose of a key hash when you have the fingerprint?

Looking for "Barack Obama" in Ubuntu's keyserver return these results For example, take the first search result: pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z ...
4 votes
1 answer
1k views

What is the correct way to create a backup copy of a PGP key pair?

I am using GnuPG 2.2.20 to create my key pair. I have successfully created a key pair, now I want to create a backup copy in case of HDD failure. Following the instruction here, I have tried gpg --...
2 votes
1 answer
126 views

Is there some way to verify that what I think I encrypted is actually what was encrypted when I don't have the private key? (PGP) [duplicate]

Let's say that Joe gives his PGP public key to Sue so that Sue can send Joe a secret message. Sue opens her PGP/GPG program, types I'm in love with Joe! and encrypts the message with Joe's public key. ...
  • 21

1
2 3 4 5
14