We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
189
votes
8answers
105k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
78
votes
2answers
21k views

How many OpenPGP keys should I make?

I am learning how to use OpenPGP keys in GnuPG, and I am wondering what is the threshold people generally use to maintain separate OpenPGP keys. Maintaining an incredibly large number of keys is not ...
74
votes
5answers
11k views

What was so dangerous about PGP that its creator was charged in court for it?

I was reading up on the history of the PGP encryption software when I realised its creator was under criminal charges for munitions export without a license for releasing the source code of PGP. ...
73
votes
6answers
58k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
69
votes
3answers
13k views

Why shouldn't I bring a computer to a key-signing party?

I'm looking at the event description for the key-signing party at an upcoming BSD conference, and it's mentioned that I shouldn't bring my computer in to the event: Things to bring no ...
65
votes
3answers
22k views

What is a good general purpose GnuPG key setup?

Since most key types can be used for multiple purposes, namely certification, authentication, encryption and signatures, one could simply use one key for everything - which is a bad idea, as ...
57
votes
3answers
11k views

Does OpenPGP key expiration add to security?

I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised ...
50
votes
5answers
8k views

Why is end-to-end encryption still not default in mails?

I am not a cryptographer. Maybe that is why I don't see the issues with integrating PGP into SMTP. In my head: Lea requests the server of Luke's domain jedi.com to tell her the public key of luke@...
42
votes
2answers
12k views

Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?

As the title says, do those 4 bytes carry a meaning (I assume they do as apparently the smile changes depending on the key bitness)? The two files below have been encrypted with the different keys, ...
41
votes
5answers
10k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread http://...
40
votes
2answers
11k views

Will encrypting the same file with GnuPG and the same key produce the same ciphertext?

If I encrypt the same file twice with GnuPG, using the same key, will I get the same result? or is it using some random/psudeo-random segment to improve security like rsynccrypto?
39
votes
1answer
12k views

Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?

Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
36
votes
3answers
18k views

When changing a PGP passphrase, does it only affect the private key?

I am beginning to use GPG for email encryption. If I use gpg --edit-key [keyID] to change the passphrase, what files will this affect? Will it only affect my private key, and thus I only need to ...
36
votes
1answer
18k views

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

Short OpenPGP key IDs (with 32 bits / 8 hex characters) are subject to collision attacks. It is strongly recommended to stop using 32 bit IDs: Stop using 32bit key ids It takes 4 seconds to ...
36
votes
4answers
67k views

How (in)secure is POP/IMAP/SMTP

I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken: The ...
35
votes
2answers
30k views

How does RSA encryption compare to PGP?

On this answer ck says RSA and PGP are different. What you are essentially asking is how do I run my petrol car on diesel? The answer is you can't. I would be interested in a more ...
35
votes
6answers
3k views

Why don't PGP and SSH keys see more widespread use as a second factor when authenticating?

One of the major up-and-coming MFA methods is U2F, which relies on an initial key exchange and challenge-response mechanism. It's a relatively new protocol, and is only starting to see more ...
35
votes
3answers
9k views

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a ...
35
votes
3answers
17k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
34
votes
2answers
4k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
33
votes
2answers
3k views

Why does PGP work with the CC field in e-mails?

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user ...
33
votes
1answer
30k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
31
votes
6answers
10k views

What real world benefits does PGP have over sending email with SSL/TLS such as with HTTPS?

I've been learning about PGP, and I asked myself, "Why?" For example, if I'm using https://mail.google.com, then what benefit would adding PGP offer that would justify it being used? I can ...
31
votes
3answers
4k views

Tell people that I can encrypt emails

I know that it is still not very easy to use PGP for an average user. However, the situation is improving (there are some easy plugins that can even nicely integrate into your GMail webmail). In ...
30
votes
6answers
3k views

Is there any reason I shouldn't make a GPG-encrypted file publicly-accessible?

I'm working on a project where we need to keep a few specific files easily accessible, but encrypted. My idea for accomplishing this is to have the files available in the project's public website, ...
29
votes
2answers
7k views

GPG File size with multiple recipients?

If I encrypt a file for multiple users how does the file size change? Does the size of the output double for two users. How about 10 or 100 users?
28
votes
7answers
13k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
28
votes
4answers
18k views

How can I encrypt a file using gpg without including the recipient's key ID?

An OpenPGP encrypted file will include the key ID of the intended recipient's public encryption key, as explained in this question. Is there any way to remove that information from the resulting ...
28
votes
6answers
6k views

Shouldn't GPG key fetching use a secure connection?

If I run this for example: gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451 then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) ...
28
votes
1answer
13k views

PGP - Why have separate encryption subkey

This is how my key is set up: pub 4096R/AAAAAAAA created: 2012-11-14 expires: 2013-11-14 usage: SC trust: ultimate validity: ultimate sub 4096R/BBBBBBBB created: ...
28
votes
2answers
10k views

What information is leaked from an OpenPGP encrypted file?

If an attacker obtains a file that has been encrypted using an OpenPGP public key, what information can the attacker deduce? For example, to what degree of certainty can the attacker deduce the ...
28
votes
1answer
10k views

What is the exact meaning of this gpg output regarding trust?

When I import signatures or receive a key with gpg, it outputs some cryptic lines like: gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 16 trust: ...
26
votes
4answers
4k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
25
votes
3answers
2k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
24
votes
4answers
15k views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
24
votes
3answers
12k views

ECC in (Open)PGP

How is with the support for ECC (Elliptic Curve Cryptography) in (Open)PGP so far? It seems that GnuPG (The GNU Privacy Guard) doesn't have an official implementation - but I did find the gnupg-ecc ...
24
votes
1answer
22k views

New PGP key: RSA/RSA or DSA/Elgamal?

I wanted to create a new PGP key using GPG Keychain Access on my Mac. One of the options was to choose keytype: RSA and RSA DSA and Elgamal RSA (Sign only) DSA (Sign only) I found this Superuser ...
24
votes
3answers
17k views

How does storing GPG/SSH private keys on smart cards compare to plain USB drives?

I have a basic understanding of private/public key cryptography and have been using it for SSH logins and GPG encryption/signing for a while now. However, I have always kept the private key/keyrings ...
23
votes
4answers
12k views

Why does PGP use symmetric encryption and RSA?

Looking into the details of Pretty Good Privacy, I'm confused as to the reasoning behind encrypting the message with a session key and the key with the recipient's public key via RSA. I fail to see ...
23
votes
3answers
6k views

In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?

It's described very well by this diagram. It seems like the process used is convoluted and more round-about than it needs to be. Why is an intermediate random key generated for the payload's ...
23
votes
3answers
2k views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by using ...
22
votes
5answers
2k views

Considerations for long-term key storage (paper backup, media for vault storage)?

I'm reviewing our company's security procedures regarding cryptographic keys and master passwords, and also my private system at home. The key generation process is pretty much the same as that ...
22
votes
3answers
6k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, etc....
22
votes
1answer
18k views

Are SSH keys and PGP keys the same thing?

I have a 3072 bit RSA key that I generated for use with SSH. Can this key-pair be used with PGP/GPG, or do I need to generate a new pair of keys separately for use in email encryption? Are the two ...
22
votes
1answer
13k views

Ways to sign gpg public key so it is trusted?

I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
21
votes
2answers
10k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
20
votes
3answers
11k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep <sitename&...
19
votes
6answers
35k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
19
votes
1answer
8k views

Can I check who can decrypt my GPG message after I encrypt it?

When I send, say, a great recipe for funnel cake to Alice and Bob using GPG, I can be pretty sure they will both be able to decrypt it. However, can I be certain, or prove after the fact, that they ...
19
votes
2answers
1k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...