Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

1
vote
1answer
51 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
2
votes
0answers
47 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
0
votes
1answer
50 views

Verifying PGP Messages

Is it possible to sort of verify a PGP message? Alice sends a PGP Encrypted message to Bob. I know Alice and Bob's public key, and I have their encrypted and plaintext message. Can I confirm that ...
0
votes
1answer
76 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
4
votes
1answer
91 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
0
votes
0answers
42 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
2
votes
1answer
90 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
4
votes
1answer
266 views

Correct way to replace a GPG key

I want to create a new GPG key with a longer key size. What are the best ways to replace the key ? My current key is associated with a lot of stuff like GitHub etc. Should I revoke my old key and sign ...
1
vote
0answers
67 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
3
votes
1answer
88 views

Why are passphrases protecting GPG / SSH private keys needed? [duplicate]

SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
2
votes
3answers
112 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
1answer
105 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
48 views

Are there risks to having many uids on my gpg key?

I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
1
vote
0answers
21 views

3rd party verification of separately encrypted files

I'm trying to figure out how to verify whether a file's contents are unchanged even though it has been re-encrypted and the 3rd party cannot know what is inside of the file. A contrived example to ...
2
votes
3answers
145 views

Does every recipient receive a different version of “encrypted” email using PGP?

If I understood it correctly, PGP encrypts email by using receiver's public key. In a multiple-receiver scenario, does that mean each receiver will get a different version of "encrypted" email but the ...
3
votes
2answers
105 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
1
vote
2answers
93 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
82 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
2
votes
0answers
32 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
1
vote
1answer
51 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
0
votes
1answer
171 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
5
votes
2answers
159 views

Is there a secure way to share a PGP key for use with security.txt?

One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
2
votes
0answers
93 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
2
votes
1answer
53 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
1
vote
0answers
100 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
0
votes
0answers
19 views

Selection Criteria for PGP Generator

My original question's responses indicated that I need to have my small team generate their own public \ private keys for securing email. So the question now shifts to selection criteria for a PGP ...
0
votes
2answers
50 views

Criteria for Selecting an online PGP Generator

When generating Public/Private keys to encrypt email: Is there a line of thinking or reasoning to select one online key generator over the other? Any suggestions or edits that will sharpen the ...
1
vote
0answers
35 views

About verifying GPG4Win binary before using it

I've taken interest in GPG4WIN but I want to be sure that the binary file I downloaded can be trusted. I do not have previous trusted release installed on a Linux OS and I need a trusted software to ...
-1
votes
2answers
672 views

PGP public key is visible

I have found a page with lots of PGP public keys. There is an email address on url. This page is: -----BEGIN PGP PUBLIC KEY BLOCK----- ...
0
votes
1answer
175 views

Practical implications of using a service like ProtonMail

Recently I found out about ProtonMail, which has been promoted as a more secure email service than services like Gmail. According to the creators of ProtonMail, Google can read all Gmail emails, and ...
1
vote
1answer
301 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
1
vote
1answer
32 views

Protocol/standard/software for requesting PGP signing/verification of content?

I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on ...
4
votes
1answer
209 views

Why do so many PGP public keys begin with mQINBF?

Why do so many PGP public keys begin with mQINBF? I am just curious.
1
vote
1answer
28 views

Are there any circumstances where I would need to generate a new revocation certificate for my PGP key?

When I generated by PGP key using GnuPG, I created a revocation certificate, in case I lost control of the master private key. Will this revocation certificate be valid for my PGP key, regardless of ...
0
votes
0answers
160 views

Choose trust level when importing PGP certificate in Kleopatra

I've imported the GPG certificate of a co-worker with Kleopatra that comes with gpg4win. I've used the "Lookup on Server..." feature and verified the fingerprint as instructed in the wizard. Not sure ...
1
vote
3answers
159 views

Receiving a response that is PGP encrypted

I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I ...
2
votes
1answer
77 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
3answers
173 views

How to manage PGP private keys?

I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
0
votes
2answers
907 views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?
4
votes
1answer
1k views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
0
votes
1answer
291 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
4
votes
1answer
321 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
34 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
0
votes
1answer
148 views

How to force GPG to use a Keycard when it is available

I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
1
vote
1answer
54 views

What identifies an entity in PGP?

When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
10
votes
4answers
3k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
2
votes
1answer
60 views

Is it wise to remove redundant self-signatures from my PGP key?

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there: $ gpg --list-sigs AAAAAAAAAAAAAAAA pub 4096R/AAAAAAAA 2014-...
2
votes
1answer
440 views

Is “BEGIN PGP SIGNED MESSAGE” optional to include in an armored message?

Although it's probably nitpicking, it doesn't look very cosmetically pleasing to put the BEGIN PGP SIGNED MESSAGE at the top of an email, is that header really required to parse the message and verify ...
2
votes
1answer
6k views

How to verify PGP signature with signing key

I have to download a program with a PGP signature and a signing key (Public Key) How do I check the program with signing key?
-2
votes
1answer
137 views

PGP private key and decryption issues

I have created a private and public key set and encrypted a message to a friend with their public key. I then turned off my machine, and since it is not in persistence mode, my keys were deleted, but ...