Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

1
vote
0answers
15 views

3rd party verification of separately encrypted files

I'm trying to figure out how to verify whether a file's contents are unchanged even though it has been re-encrypted and the 3rd party cannot know what is inside of the file. A contrived example to ...
2
votes
3answers
113 views

Does every recipient receive a different version of “encrypted” email using PGP?

If I understood it correctly, PGP encrypts email by using receiver's public key. In a multiple-receiver scenario, does that mean each receiver will get a different version of "encrypted" email but the ...
3
votes
2answers
101 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
1
vote
2answers
31 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
46 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
2
votes
0answers
13 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
0
votes
1answer
28 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
0
votes
1answer
80 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
5
votes
2answers
78 views

Is there a secure way to share a PGP key for use with security.txt?

One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
2
votes
0answers
48 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
2
votes
1answer
46 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
0
votes
0answers
20 views

python-gnupg sign & verify a tar archive

I am using python-gpg to sign / encrypt / verify / decrypt a tar archive. code snippet - # import private key into gnupghome _pvtKey = urllib2.urlopen(_certurl) _pv_data = _pvtKey.read() gpg....
1
vote
0answers
66 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
0
votes
0answers
15 views

Selection Criteria for PGP Generator

My original question's responses indicated that I need to have my small team generate their own public \ private keys for securing email. So the question now shifts to selection criteria for a PGP ...
0
votes
2answers
45 views

Criteria for Selecting an online PGP Generator

When generating Public/Private keys to encrypt email: Is there a line of thinking or reasoning to select one online key generator over the other? Any suggestions or edits that will sharpen the ...
1
vote
0answers
25 views

About verifying GPG4Win binary before using it

I've taken interest in GPG4WIN but I want to be sure that the binary file I downloaded can be trusted. I do not have previous trusted release installed on a Linux OS and I need a trusted software to ...
-1
votes
2answers
668 views

PGP public key is visible

I have found a page with lots of PGP public keys. There is an email address on url. This page is: -----BEGIN PGP PUBLIC KEY BLOCK----- ...
0
votes
1answer
130 views

Practical implications of using a service like ProtonMail

Recently I found out about ProtonMail, which has been promoted as a more secure email service than services like Gmail. According to the creators of ProtonMail, Google can read all Gmail emails, and ...
1
vote
1answer
105 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
1
vote
1answer
29 views

Protocol/standard/software for requesting PGP signing/verification of content?

I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on ...
4
votes
1answer
202 views

Why do so many PGP public keys begin with mQINBF?

Why do so many PGP public keys begin with mQINBF? I am just curious.
1
vote
1answer
22 views

Are there any circumstances where I would need to generate a new revocation certificate for my PGP key?

When I generated by PGP key using GnuPG, I created a revocation certificate, in case I lost control of the master private key. Will this revocation certificate be valid for my PGP key, regardless of ...
0
votes
0answers
70 views

Choose trust level when importing PGP certificate in Kleopatra

I've imported the GPG certificate of a co-worker with Kleopatra that comes with gpg4win. I've used the "Lookup on Server..." feature and verified the fingerprint as instructed in the wizard. Not sure ...
1
vote
3answers
118 views

Receiving a response that is PGP encrypted

I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I ...
2
votes
1answer
68 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
3answers
104 views

How to manage PGP private keys?

I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
0
votes
2answers
358 views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?
3
votes
1answer
407 views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
0
votes
1answer
187 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
3
votes
1answer
176 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
31 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
0
votes
0answers
43 views

Are giant shell scripts ideal for the governance of a git repository?

The link below has the repository for a giant shell script that uses pgp keys to validate users ands that is supposed to: Issue digital value tokens - Create, sign, and enforce contracts - ...
0
votes
1answer
79 views

How to force GPG to use a Keycard when it is available

I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
1
vote
1answer
48 views

What identifies an entity in PGP?

When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
8
votes
4answers
1k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
2
votes
1answer
55 views

Is it wise to remove redundant self-signatures from my PGP key?

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there: $ gpg --list-sigs AAAAAAAAAAAAAAAA pub 4096R/AAAAAAAA 2014-...
2
votes
1answer
315 views

Is “BEGIN PGP SIGNED MESSAGE” optional to include in an armored message?

Although it's probably nitpicking, it doesn't look very cosmetically pleasing to put the BEGIN PGP SIGNED MESSAGE at the top of an email, is that header really required to parse the message and verify ...
2
votes
1answer
2k views

How to verify PGP signature with signing key

I have to download a program with a PGP signature and a signing key (Public Key) How do I check the program with signing key?
-2
votes
1answer
71 views

PGP private key and decryption issues

I have created a private and public key set and encrypted a message to a friend with their public key. I then turned off my machine, and since it is not in persistence mode, my keys were deleted, but ...
3
votes
2answers
169 views

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
2
votes
1answer
139 views

Is there an open-source PGP that Encrypts-then-MACs, uses Blake2 or Whirlpool, and none of the NIST curves known to be compromised? [closed]

I find the language of RFC4880-bis very disturbing on the topic of privacy. I do not want "modest" security. "Consequently, because it [MDC] is a modest security system, it has modest ...
6
votes
2answers
1k views

Generate new key - ECC vs RSA

I intend to start using GnuPG again. I haven't used it for the last 2 years and was surprised that there is now the option for RSA and ECC keys. After reading a bit about ECC, it seems to me there is ...
2
votes
1answer
307 views

Best way to implement PGP company wide [closed]

What is the best way to implement PGP/GnuPGP company wide? Go to each users workstation, create the keys, upload the public key, and move on to the next?
2
votes
2answers
2k views

Pass password to GPG via script

Okay, maybe first a little context: I use a PGP(GPG) encrypted file to hold my passwords. I use a (dash) script, bound to a key combination, to fill in usernames and passwords across applications/...
2
votes
1answer
70 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
2
votes
1answer
893 views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
2
votes
1answer
122 views

Does it matter if an average person has email encryption or not?

I was thinking about using a secure email service. So, I read about it. And it feels completely useless for me personally. Almost everyone that I exchange emails with, don't use PGP or any kind of ...
4
votes
1answer
892 views

What do the Keybase pgp import instructions actually do?

I've created a Keybase account, and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there. I had expected instructions to PGP-sign a specific text from the ...
0
votes
3answers
157 views

Do I need a PGP key?

I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind: Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ...
2
votes
1answer
88 views

How to single key decrypt pgp encrypted mails in a multi key/multi identitiy setup?

For pgp encryption I'd like to combine short expiry terms for public signing and email encryption with (convenient) long term decryption possibilities of my mailbox mails. I'm using several mail ...