Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

1
vote
1answer
57 views

Does creating new subkeys change an existing master key?

I have a PGP master public / private key pair. I have created 3 subkeys for it. I want to add 3 more subkeys to this master key. Would doing so change my public and private keys?
1
vote
0answers
27 views

Were PGP/MIME and PGP/Inline equally affected by EFAIL?

I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while ...
0
votes
0answers
26 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
1
vote
1answer
225 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
2
votes
0answers
64 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
0
votes
1answer
67 views

Verifying PGP Messages

Is it possible to sort of verify a PGP message? Alice sends a PGP Encrypted message to Bob. I know Alice and Bob's public key, and I have their encrypted and plaintext message. Can I confirm that ...
0
votes
1answer
78 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
4
votes
1answer
105 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
0
votes
0answers
70 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
4
votes
1answer
168 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
4
votes
1answer
437 views

Correct way to replace a GPG key

I want to create a new GPG key with a longer key size. What are the best ways to replace the key ? My current key is associated with a lot of stuff like GitHub etc. Should I revoke my old key and sign ...
1
vote
0answers
70 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
3
votes
1answer
95 views

Why are passphrases protecting GPG / SSH private keys needed? [duplicate]

SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
2
votes
3answers
128 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
1answer
113 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
53 views

Are there risks to having many uids on my gpg key?

I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
1
vote
0answers
21 views

3rd party verification of separately encrypted files

I'm trying to figure out how to verify whether a file's contents are unchanged even though it has been re-encrypted and the 3rd party cannot know what is inside of the file. A contrived example to ...
2
votes
3answers
148 views

Does every recipient receive a different version of “encrypted” email using PGP?

If I understood it correctly, PGP encrypts email by using receiver's public key. In a multiple-receiver scenario, does that mean each receiver will get a different version of "encrypted" email but the ...
3
votes
2answers
105 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
1
vote
2answers
136 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
86 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
2
votes
0answers
43 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
1
vote
1answer
56 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
1
vote
1answer
215 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
5
votes
2answers
214 views

Is there a secure way to share a PGP key for use with security.txt?

One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
2
votes
0answers
111 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
2
votes
1answer
53 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
1
vote
0answers
109 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
0
votes
0answers
27 views

Selection Criteria for PGP Generator

My original question's responses indicated that I need to have my small team generate their own public \ private keys for securing email. So the question now shifts to selection criteria for a PGP ...
0
votes
2answers
53 views

Criteria for Selecting an online PGP Generator

When generating Public/Private keys to encrypt email: Is there a line of thinking or reasoning to select one online key generator over the other? Any suggestions or edits that will sharpen the ...
1
vote
0answers
36 views

About verifying GPG4Win binary before using it

I've taken interest in GPG4WIN but I want to be sure that the binary file I downloaded can be trusted. I do not have previous trusted release installed on a Linux OS and I need a trusted software to ...
-1
votes
2answers
673 views

PGP public key is visible

I have found a page with lots of PGP public keys. There is an email address on url. This page is: -----BEGIN PGP PUBLIC KEY BLOCK----- ...
0
votes
1answer
186 views

Practical implications of using a service like ProtonMail

Recently I found out about ProtonMail, which has been promoted as a more secure email service than services like Gmail. According to the creators of ProtonMail, Google can read all Gmail emails, and ...
1
vote
1answer
395 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
1
vote
1answer
32 views

Protocol/standard/software for requesting PGP signing/verification of content?

I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on ...
4
votes
1answer
214 views

Why do so many PGP public keys begin with mQINBF?

Why do so many PGP public keys begin with mQINBF? I am just curious.
1
vote
1answer
28 views

Are there any circumstances where I would need to generate a new revocation certificate for my PGP key?

When I generated by PGP key using GnuPG, I created a revocation certificate, in case I lost control of the master private key. Will this revocation certificate be valid for my PGP key, regardless of ...
0
votes
0answers
188 views

Choose trust level when importing PGP certificate in Kleopatra

I've imported the GPG certificate of a co-worker with Kleopatra that comes with gpg4win. I've used the "Lookup on Server..." feature and verified the fingerprint as instructed in the wizard. Not sure ...
1
vote
3answers
176 views

Receiving a response that is PGP encrypted

I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I ...
2
votes
1answer
78 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
3answers
224 views

How to manage PGP private keys?

I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
0
votes
2answers
1k views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?
5
votes
1answer
2k views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
0
votes
1answer
334 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
4
votes
1answer
389 views

Signing/certifying keys as a YubiKey user

After using a yubikey on a day-to-day basis for almost a year, I decided that it was about time to learn how to certify my friends' keys. I was surprised to learn that one can only sign keys using ...
1
vote
0answers
34 views

What are direct key signatures (0x1F) usages other than for revocation?

While looking what the PGP Global Directory is, I have found that it's key has two strange signatures: pub 2048R/CA57AD7C 2004-12-06 sig dirct 4DD19F10 2014-01-21 __________ __________ [...
0
votes
1answer
172 views

How to force GPG to use a Keycard when it is available

I have a yubikey (with PGP smartcard function) with my PGP key on it. I did not replace the private key on my main PC with a stub key as keytocard does by default, so I still can use the PGP key with ...
1
vote
1answer
54 views

What identifies an entity in PGP?

When a person A signs a PGP key whose uid is: "Max Anderson < max.anderson@example.com > ", so he is assuring that this key really belongs to the person whose name is Max Anderson and whose email ...
11
votes
4answers
3k views

Create backup Yubikey with identical PGP keys

I've recently bought two Yubikeys Neo which I'd like to use primarily for encryption and authentification by using the smartcard feature with GnuPG. I've read a few how-to on the subject (most notably ...
2
votes
1answer
69 views

Is it wise to remove redundant self-signatures from my PGP key?

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there: $ gpg --list-sigs AAAAAAAAAAAAAAAA pub 4096R/AAAAAAAA 2014-...