Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
1
vote
1answer
111 views

How do PGP keys “expire”?

When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
0
votes
0answers
38 views

Server application to hold PGP private keys and decrypt as requested

I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
0
votes
1answer
127 views

How long would it take to bruteforce a PGP-Encrypted-Mail?

How long would it take to bruteforce a PGP-Encrypted-Mail? If I'm rightly informed, it depends on the bitsize of the encryption Key.
2
votes
3answers
164 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
1
vote
1answer
65 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
0
votes
1answer
52 views

Can a deleted PGP secret key be recovered from private-keys-v1.d directory?

Executing gpg -K --with-keygrip returns one key entry. However the private-keys-v1.d directory has two entries. I assume that one of them belongs to a secret key that has been deleted/removed. Is ...
0
votes
0answers
44 views

create gpg public key from subkey

I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically. For my communication ...
0
votes
0answers
61 views

How is private key encrypted after export?

For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
0
votes
1answer
59 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
75 views

Can a new signature be added to an already signed message?

Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) ...
1
vote
1answer
76 views

Does creating new subkeys change an existing master key?

I have a PGP master public / private key pair. I have created 3 subkeys for it. I want to add 3 more subkeys to this master key. Would doing so change my public and private keys?
1
vote
0answers
39 views

Were PGP/MIME and PGP/Inline equally affected by EFAIL?

I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while ...
0
votes
0answers
39 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
1
vote
1answer
566 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
2
votes
0answers
84 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
0
votes
1answer
90 views

Verifying PGP Messages

Is it possible to sort of verify a PGP message? Alice sends a PGP Encrypted message to Bob. I know Alice and Bob's public key, and I have their encrypted and plaintext message. Can I confirm that ...
0
votes
1answer
83 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
4
votes
1answer
120 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
0
votes
0answers
110 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
4
votes
1answer
230 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
4
votes
1answer
725 views

Correct way to replace a GPG key

I want to create a new GPG key with a longer key size. What are the best ways to replace the key ? My current key is associated with a lot of stuff like GitHub etc. Should I revoke my old key and sign ...
1
vote
0answers
74 views

PGP With 2 x Yuibikey 4 + 1 USB (Backup)

I have 2 Yubikey 4. I'd like to use them for PGP and overall for securing my online identity. I'm following this guide but I'm stuck at backup step. The guide itself does not explain how to have keys ...
3
votes
1answer
109 views

Why are passphrases protecting GPG / SSH private keys needed? [duplicate]

SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
2
votes
3answers
181 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
3
votes
1answer
132 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
76 views

Are there risks to having many uids on my gpg key?

I'm fairly new to the world of pgp/gpg, I came to it first through Keybase and then the gpg client and now I think I'm in a place where I'm quite happy with my key setup. I've just started a new job ...
1
vote
0answers
22 views

3rd party verification of separately encrypted files

I'm trying to figure out how to verify whether a file's contents are unchanged even though it has been re-encrypted and the 3rd party cannot know what is inside of the file. A contrived example to ...
2
votes
3answers
165 views

Does every recipient receive a different version of “encrypted” email using PGP?

If I understood it correctly, PGP encrypts email by using receiver's public key. In a multiple-receiver scenario, does that mean each receiver will get a different version of "encrypted" email but the ...
3
votes
2answers
105 views

Delivering data securely when the data source is the key maker

Let's say we have the following: Bob needs to send data securely to Alice. Only Bob and Alice are allowed to read/see that data. Alice is not able/allowed to create keys. Alice can use any number or ...
1
vote
2answers
205 views

What does the 'Sign' and "Add to recipients' means in GPG keychain?

Hello everyone, I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains ...
1
vote
1answer
86 views

Does PGP encrypt all messages or only that one send with PGP?

If I encrypt my Email with PGP will all of my emails will be encrypted or only that ones that people send to me using my PGP key? If I register on Facebook or Dropbox and they send me an email: "...
2
votes
0answers
57 views

GPG self-signature default check level

I think I understand the concept of self-signature in GPG from reading the answer to this question. However it is not yet clear to me how check levels are assigned. When issuing gpg --check-sigs one ...
1
vote
1answer
68 views

PGP - 2048-bit key VS filesize of the exported key

I'm new to cryptography so please bear with me. If I create 2048-bit keys and export security key to file key.gpg (so without ASCII armor), I get a file with size of 1.28 kB. If I understand it ...
1
vote
1answer
261 views

Is there any mechanism that using multiple keys encrypt and decrypt a shared document?

I wanted to achieve the following mechanism to encrypt a document each person in a group of N (user a, b, c...)has her own key; user a and user b somehow decided to encrypt document M, and they can ...
5
votes
2answers
315 views

Is there a secure way to share a PGP key for use with security.txt?

One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
2
votes
0answers
140 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
2
votes
1answer
54 views

Wrong pgp key was signed

Someone signed my PGP key, by accident (we have never met, but I know the person a little). The wrong signature was uploaded to the SKS pool. Is there anything we can do about it to improve the web ...
1
vote
0answers
124 views

What is the solution to digitally sign email apart from S/MIME and GPG/OpenPGP [closed]

I have tried to implement S/MIME, however, I've found out that S/MIME seems to be obsolete, in my perspective. Since S/MIME cannot operate on Google Chrome or Edge. Another solution I found is ...
0
votes
2answers
61 views

Criteria for Selecting an online PGP Generator

When generating Public/Private keys to encrypt email: Is there a line of thinking or reasoning to select one online key generator over the other? Any suggestions or edits that will sharpen the ...
1
vote
0answers
37 views

About verifying GPG4Win binary before using it

I've taken interest in GPG4WIN but I want to be sure that the binary file I downloaded can be trusted. I do not have previous trusted release installed on a Linux OS and I need a trusted software to ...
-1
votes
2answers
677 views

PGP public key is visible

I have found a page with lots of PGP public keys. There is an email address on url. This page is: -----BEGIN PGP PUBLIC KEY BLOCK----- ...
0
votes
1answer
204 views

Practical implications of using a service like ProtonMail

Recently I found out about ProtonMail, which has been promoted as a more secure email service than services like Gmail. According to the creators of ProtonMail, Google can read all Gmail emails, and ...
2
votes
1answer
537 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
1
vote
1answer
33 views

Protocol/standard/software for requesting PGP signing/verification of content?

I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on ...
4
votes
1answer
224 views

Why do so many PGP public keys begin with mQINBF?

Why do so many PGP public keys begin with mQINBF? I am just curious.
1
vote
1answer
32 views

Are there any circumstances where I would need to generate a new revocation certificate for my PGP key?

When I generated by PGP key using GnuPG, I created a revocation certificate, in case I lost control of the master private key. Will this revocation certificate be valid for my PGP key, regardless of ...
1
vote
3answers
207 views

Receiving a response that is PGP encrypted

I work as a software engineer, yet with limited experience in cryptography. I have a practical issue, not so much a technical question, related to a PGP-encrypted mail exchange I've had. Lately, I ...
2
votes
1answer
84 views

Why do people check the passport on key signing events?

I find the common procedure of key signing parties a little awkward: Person A presents the passport and a fingerprint "This is my key!". Person B checks the passports and decides a level of trust to ...
2
votes
3answers
314 views

How to manage PGP private keys?

I am trying to find out a way to protect files that will be stored on a drive accessible to the public. Using permissions is not an option in this case, so I am planning to encrypt the files using PGP ...
0
votes
2answers
2k views

What is the difference between PGP and asymmetric encryption?

I read about 3 main types of encryption: symmetric, asymmetric, PGP. I can figure out the difference between asymmetric and symmetric. But what is the difference between asymmetric and PGP?