PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to ...

learn more… | top users | synonyms

4
votes
1answer
81 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
0
votes
0answers
22 views

Which symmetric encryption method does PGP use for its hybrid-method?

I'm doing some research on PGP for a class-assignment. I've tried to find out which exact implementation PGP uses for its symmetric encryption part. Finding out about RSA as the asymmetric one was ...
0
votes
1answer
24 views

When updating a subkey's expiration date, do old backups of my private master key become invalid?

In GnuPG I have a master key that doesn't expire, with separate subkeys with one year expiration time for encryption, authentication, and signing. If I update the expiration dates of my subkeys, will ...
1
vote
1answer
51 views

What issues exist in generating a signed, paper-based PGP message stored by a hostile organisation?

I have recently been the victim of having my medical record tampered with by the organisation holding it. Under state law I have a legal right to submit information to be included in my medical record,...
28
votes
6answers
3k views

Is there any reason I shouldn't make a GPG-encrypted file publicly-accessible?

I'm working on a project where we need to keep a few specific files easily accessible, but encrypted. My idea for accomplishing this is to have the files available in the project's public website, ...
21
votes
7answers
4k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
2
votes
1answer
18 views

Are expired keys eligible default keys?

From GnuPG's man page: [...] the default key is the first key found in the secret keyring. Are expired keys eligible default keys? Or should I manually set the default key in gpg.conf? I'm ...
1
vote
1answer
31 views

Create revocation certificate for all user IDs

My OpenPGP key consists of three identities and two subkeys. I now would like to create a revocation certificate for the master key. pub 4096R/2J9F2349 2016-05-10 [expires: 2016-11-06] uid ...
0
votes
0answers
19 views

What public key systems allow for delegation?

I am looking for a public key system that allows for a 3rd party to use that key for other purposes. What private key systems allow for this? PGP, S/MIME, PKI?
1
vote
1answer
18 views

How to raise a key to ultimate trust on another machine?

I have created a master key with two subkeys: one for signing and the other for encryption. Finally, I have exported the two subkeys to a new machine. How can I tell the new machine to consider the ...
5
votes
3answers
196 views

Why don't PGP keyservers enforce double-opt-in?

One thing that I found out when starting using PGP: When I uploaded my keys to the SKS keyserver, the keyserver did not take any action to verify that I am who I claim to be. Since a PGP key contains ...
0
votes
0answers
16 views

PGP not decrypting when using gpg4win [migrated]

I have set up the GPGTools on OS X 10.11 and they work perfectly fine in Apple Mail, as I have verified by testing with two of my email addresses. Even in Outlook 2016 with the gpg4win plugin on my ...
1
vote
1answer
46 views

Should I verify installer file PGP hash?

Let's say that I'll download an installer for a program on Windows and the publisher has released PGP Signature for the file. The installer file does not have any code signing certificates. If I ...
5
votes
1answer
43 views

Sending GPG private key to myself

I recently started to use GPG and I wanted to import my secret key from another computer. I was thinking about sending it to myself by email or using an USB storage device. Question : Is it safe ? ...
4
votes
2answers
752 views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
0
votes
0answers
20 views

Enigmail: Issue about sending to old key

So I have set up a new GPG key for myself. I previously had one under the same email, but it has since been revoked. I installed enigmail on my new system with this new key and It seems that it is ...
3
votes
1answer
20 views

Creating subkeys for an existing OpenPGP key

I have an existing OpenPGP key which has been used infrequently. All capabilities appear to be bound to the master key, there are no subkeys. /home/user/.gnupg/pubring.gpg ---------------------------...
3
votes
1answer
43 views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
14
votes
3answers
6k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep <sitename&...
17
votes
2answers
4k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
1
vote
1answer
85 views

What's the minimal way of sharing your public PGP key in email signature?

What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
10
votes
4answers
8k views

Secure way to transfer public/secret key to second computer

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
33
votes
6answers
2k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
42
votes
5answers
6k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
7
votes
1answer
344 views

Using ECC for PGP-Master Key in combination with Yubikey

I acquired a Yubikey Neo last month. Now I want to use the Smart-Card functionality for PGP. I followed the official guides on the Yubico Website tested it with 2048 RSA Keys and it worked fine. But ...
2
votes
0answers
12 views

Multiple PGP keys on one server [duplicate]

I have a server on which we are planning to expire the current PGP keys later this year. Now we have several clients which are currently using that PGP key. We want to have another new PGP key pair ...
10
votes
2answers
471 views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
66
votes
3answers
12k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
7
votes
2answers
872 views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
4
votes
1answer
58 views

Explanation of modern PGP?

wikipedia states that OpenPGP is currently defined with RFC 4880 which defines a very simple process that doesn't seem like it represents modern RSA + AES encrypted email: The sender creates a ...
2
votes
1answer
64 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
5
votes
4answers
9k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
3
votes
2answers
61 views

What are the benefits to adding a bitcoin blockhash UID notation to one's OpenPGP key?

Example: Notation data: blockhash@bitcoin.org 000000000000000011d9f6931e65f814c6f3b221736b0c45f25e0365a3d156fa As seen here: https://sks-keyservers.net/pks/lookup?op=vindex&search=...
3
votes
1answer
40 views

Critical sub-packets in OpenPGP not used

OpenPGP in RFC4880 allow to tag signature sub packets as "critical" by setting the high bit 7 in the packet type. I checked a few keys generated with GnuPG2 and all the sub packets are not critical, ...
5
votes
1answer
138 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
0
votes
2answers
60 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
2
votes
1answer
83 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
1
vote
0answers
88 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
3
votes
1answer
25 views

Does it matter what version of GnuPG I use to create revocation certificates?

Today I am about to create a bunch of revocation certificates for all of my emails. Why? Because it already happened to me in the past, that I lost my private key, or my computer was compromised. It ...
6
votes
1answer
173 views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
1
vote
1answer
23 views

Why does the revocation sent to the OpenPGP keyservers not show up?

I have created a new OpenPGP key pair. So I wish to revoke the former I used. Here's what I managed to do so far: This way I found that email's ID = 3C76732B gpg --search burian.vlastimil2@gmail....
2
votes
1answer
37 views

What is the purpose and meaning of the --sig-notation and --cert-notation options in GnuPG?

What is the purpose of the --sig-notation and --cert-notation options in GnuPG? What are the intended use cases? In the first part the a @ character is used, so I guess the options are for providing ...
7
votes
3answers
1k views

What is the purpose of 'Version:' in PGP public key

PGP public keys look something like -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.9 (GNU/Linux) mQGiBEl2HAgRBAC9IZGQE3NRWFoXV7CcVRbo7xMe+nGPRMTOocA0pcv9N67R6CAZ ... -----END PGP PUBLIC ...
9
votes
1answer
7k views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
38
votes
2answers
9k views

How many OpenPGP keys should I make?

I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
2
votes
1answer
32 views

How to import primary secret key from backup into GnuPG?

I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1. Even if I delete my entire ~/....
21
votes
3answers
4k views

Does OpenPGP key expiration add to security?

I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
2
votes
1answer
40 views

Revoking signing keys: do they still work afterwards?

Scenario: I have multiple signing subkeys, each for every portable device (i.e laptop). None of them have private master key (it is deleted following the tips in Alex Cabal's post. One of the devices ...
2
votes
2answers
230 views

Is the RSA private key useless without the password?

I notice whenever I generate a new gpg key (using pgp) I always have to assign a password to it, which makes perfect sense. But if I'm not mistaken, gpg is based on prime numbers. How is this ...
1
vote
1answer
53 views

Spam protection for public GPG keys?

Public keys published to a server almost always contain emails. Is there any sort of protection against bot harvesters that will use that email for spam?