Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
1
vote
1answer
88 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
1
vote
2answers
83 views

How to Prove you created IP using a Notary

Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can't just ...
0
votes
1answer
18 views

Can I resubmit my GPG key to a keyserver?

I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg --send-keys doesn't seem to alter my key any more, but doesn't spit out any error either.
0
votes
1answer
328 views

What is “web of trust” in PGP and S-MIME? [duplicate]

I'm studying network and system security and I came across the phrase Web of Trust: In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to ...
3
votes
1answer
61 views

Is there a secure way to host private PGP keys (is keybase's method secure?)

Keybase's decryption page says "you must host your private key in Keybase's encrypted key store." This really rubs me the wrong way. I was under the impression that your private key should not leave ...
3
votes
1answer
50 views

Can any private key information be exposed when signing an email? [duplicate]

So I know that PGP encrypted email can be vulnerable to a known-plaintext attack from a known, consistant email footer or greeting (“Hello”, “Yours truly, xxx”, etc), but does the same thing apply to ...
0
votes
2answers
90 views

Is it better to encrypt to an untrusted key or not to encrypt at all?

If a public PGP key can be retrieved, but there is no known path of trust from the sender to the receiver: Is is better to encrypt the message using the key on spec or to not encrypt at all?
7
votes
2answers
719 views

Apart from the lack of native Outlook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
1
vote
0answers
24 views

How does PGP web of trust handle certificate expiration?

I have certificate that expires in two years. I'll probably try to participate in key signing party so I get to know what it actually looks like. What happens in two years? When my certificate ...
1
vote
1answer
56 views

alternatives to the “PGP pathfinder” [closed]

The author of the PGP pathfinder deceased this year. Shortly after the data was not updated any more. Are there any alternatives known to find signature paths?
3
votes
2answers
4k views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
0
votes
0answers
10 views

can i not change the pgp encryption expiry once it is set? [duplicate]

how do i fix the encryption status to 'good' I tried changing the expiry date it only changes the 'Cerify/sign' one. can i not change the pgp encryption expiry once it is set?
0
votes
1answer
177 views

How long would it take to bruteforce a PGP-Encrypted-Mail?

How long would it take to bruteforce a PGP-Encrypted-Mail? If I'm rightly informed, it depends on the bitsize of the encryption Key.
1
vote
1answer
175 views

How do PGP keys “expire”?

When creating a PGP key, you can choose when the key "expires". What does this mean and how does it work?
1
vote
1answer
532 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
2
votes
1answer
598 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
6
votes
4answers
860 views

Is the PGP Web of Trust / Keyserver infrastructure permanently broken?

I love the idea of decentralized trust, the web of trust, and the fact that anyone can run their own keyserver and isn't beholden to a centralized point of failure. But does the decentralized "feature"...
5
votes
2answers
2k views

What do I do about a forgotten, ancient PGP key?

I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key using ...
0
votes
0answers
40 views

Server application to hold PGP private keys and decrypt as requested

I don't know if what I'm talking about exists, or if the concept doesn't make any sense, or even if it's just a stupid question. I'm developing a small integration for our business which receives ...
2
votes
3answers
173 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
78
votes
2answers
21k views

How many OpenPGP keys should I make?

I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
1
vote
1answer
69 views

What use does verifying a file with a signature downloaded from the same server have? [duplicate]

Now, I understand how PGP signatures work and why they can be useful to check if a file has been manipulated but this has always bugged me, if I download a file from a site/server, and read: "...
0
votes
1answer
70 views

Can a deleted PGP secret key be recovered from private-keys-v1.d directory?

Executing gpg -K --with-keygrip returns one key entry. However the private-keys-v1.d directory has two entries. I assume that one of them belongs to a secret key that has been deleted/removed. Is ...
0
votes
0answers
48 views

create gpg public key from subkey

I have a communication partner that is using some script that does not work well with subkeys. Now, my gpg key is a normal key [SC] with three subkeys for E,S and A specifically. For my communication ...
1
vote
1answer
75 views

Can a new signature be added to an already signed message?

Suppose Bob receives a clear-signed message from Alice. Bob wants to add his own signature to this signed message, because he has verified the message contents and wants his friends (network of trust) ...
0
votes
0answers
64 views

How is private key encrypted after export?

For migration I exported private/public key pair from OSX to whonix. I exported the file to my filesystem and opened the asc file with textedit. The private key to my surprise was in plaintext! I ...
0
votes
1answer
69 views

gpg: Every private key export (of the same key-pair) is different

gpg version: 2.2.16 (as part of Gpg4win 3.1.9). Is this supposed to happen: Every export of my private key partially differs from every other export as follows: 2 middle chunks of the main block, and ...
1
vote
1answer
82 views

Does creating new subkeys change an existing master key?

I have a PGP master public / private key pair. I have created 3 subkeys for it. I want to add 3 more subkeys to this master key. Would doing so change my public and private keys?
3
votes
1answer
258 views

Does it defeat the purpose to create an OpenPGP authentication subkey that is not password-protected?

I'd like to be able to log into and out of my ssh servers freely without entering a password. Previously, I did this with ssh-keygen, storing the key file under my ~/.ssh directory. Since I also have ...
6
votes
1answer
351 views

When should I sign a PGP key with a non-revocable signature?

GnuPG allows the user to sign a key with a non-revocable signature. I have done this when I’m signing one of my own keys—signing my personal key with my work key, for instance. Is there any other ...
1
vote
0answers
40 views

Were PGP/MIME and PGP/Inline equally affected by EFAIL?

I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while ...
4
votes
1answer
271 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
0
votes
0answers
41 views

Import/Register GPG keys from a SmartCard/Yubi

I used my desktop to setup my GPG keys, added them to my Yubikey, and then removed them from my desktop so that when I am prompted for the key it asks me to use my Yubikey --instead of asking for a ...
33
votes
1answer
30k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
1
vote
1answer
799 views

How do I delete secret subkeys correctly?

I tried to use gpg --delete-secret-keys to delete some revoked subkeys but ended up accidentally deleting my primary key instead. I was able to reproduce my mistake with the following commands: $ ...
7
votes
2answers
3k views

How to change (sub)key usage of a PGP key?

gpg2 generates keys with one or several of the (S)igning, (E)ncryption, (C)ertification usages set. However, e.g. Enigmail creates a primary key also set for (A)uthentication, which GnuPG then shows. ...
57
votes
3answers
11k views

Does OpenPGP key expiration add to security?

I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
2
votes
0answers
95 views

How can I trust a GPG key when I download it based on the fingerprint contained in the file I want to verify?

The instructions at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#3 suggest that you can download an ISO for installing an OS, along with the checksums and a signature. You then ...
0
votes
1answer
97 views

Verifying PGP Messages

Is it possible to sort of verify a PGP message? Alice sends a PGP Encrypted message to Bob. I know Alice and Bob's public key, and I have their encrypted and plaintext message. Can I confirm that ...
50
votes
5answers
8k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
0
votes
1answer
84 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
1
vote
1answer
370 views

Why does the revocation sent to the OpenPGP keyservers not show up?

I have created a new OpenPGP key pair. So I wish to revoke the former, I have used. Here's what I managed to do so far. This way I found that my email's ID is 3C76732B: gpg --search [email address ...
4
votes
1answer
125 views

I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. ...
18
votes
1answer
1k views

Emacs and EasyPG not performing public key encryption

I have a file which I edit and encrypt following this guide. I'm a noob as far as security goes and thought that the point of including the line which specifies the cryptographic key to use -*- mode:...
2
votes
3answers
2k views

Where can I find the detailed manual page for gpg --list-secret-keys output

I get confused about the terms used in the output of gpg --list-secret-keys For example what is the meaning of following: sec sec# ssb ssb> there are many codes being used in the output. Can ...
0
votes
0answers
133 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
0
votes
1answer
2k views

Tor, PGP and Tor Entrance Nodes

Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker ...
18
votes
11answers
7k views

Is using Gmail and encrypted documents enough for secure email communication?

My friend was asking me what would be the best way to exchange documents with clients. He was trying to tell me that just sending the documents via email was sufficient and I told him he was insane. ...
28
votes
7answers
13k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
73
votes
6answers
58k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?