Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
1
vote
1answer
73 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
1
vote
1answer
63 views

Understanding GnuPG --export-options backup

The GnuPG documentation lists an option called --export-options parameters. One of the possible parameters for this option is backup (aliased export-backup). The description for --export-options ...
1
vote
1answer
720 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
2
votes
3answers
95 views

Reading locally-stored emails sent encrypted

As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key). ...
202
votes
9answers
116k views

How should I distribute my public key?

I've just started to use GPG and created a public key. It is kind of pointless if no-one knows about it. How should I distribute it? Should I post it on my profile on Facebook and LinkedIn? How about ...
0
votes
1answer
56 views

keys.openpgp.org keyserver fails to send confirmation mail to an Outlook-address

I uploaded my master key's public part to the keys.openpgp.org-keyserver. It has 4 UIDs set up (4 different e-mail addresses) and each of them are correct and valid e-mail addresses. The keyserver ...
0
votes
2answers
90 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?
0
votes
1answer
67 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
0
votes
1answer
228 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
1
vote
3answers
810 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
0
votes
2answers
56 views

No expiry for offline primary PGP key?

Are there benefits to set an expiration date on a PGP primary key which is only used offline? Is setting an expiration date only on the subkeys enough?
1
vote
1answer
59 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
0
votes
0answers
49 views

Do I need to backup my GPG key again after extending its expiry date?

I have just extended the expiry date of my GPG key by following these instructions: Can you extend the expiration date of an already expired GPG key? I have previously backed-up my key. Do I need to ...
1
vote
0answers
49 views

Import secret key into GnuPg doesn't work?

I would like to import a private key into GPG so I did: gpg --allow-secret-key-import --import /path/to/key/key.asc gpg: key 51D5DF493ECAFF88: "John Doe <john.doe@acme.com>" not ...
-4
votes
1answer
130 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
2answers
78 views

pgp public key failed to propogate

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key ...
43
votes
3answers
13k views

Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?

As the title says, do those 4 bytes carry a meaning (I assume they do as apparently the smile changes depending on the key bitness)? The two files below have been encrypted with the different keys, ...
10
votes
1answer
23k views

GPG why is my trusted key not certified with a trusted signature?

When I run gpg --verify ~/file.asc ~/file I receive the following: gpg: Signature made Tue 10 Dec 2016 05:10:10 AM EST using RSA key ID abcdefgh gpg: Good signature from "Alias (signing key) <...
1
vote
1answer
118 views

Is there any point in using PGP or S/MIME when your receipients mostly don't use it?

For an company with sensitive customer relations and above average secrecy how much does it make sense to implement S/MIME or PGP for providing their E-mails the verification functionality (please ...
1
vote
0answers
77 views

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...
0
votes
1answer
62 views

What is the standard way, if any, to announce via e-mail that you have a public PGP key and what it is?

I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do: Parse the ...
1
vote
1answer
114 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
3
votes
2answers
97 views

Is PGP passphrase necessary if I store private key and passphrase in the same place?

I'm building a system that generates PGP key and store private key in secret vault. One thing I'm not fully understanding is the need for passphrase. I can generate a random passphrase during the key ...
0
votes
0answers
32 views

GPG Questions About Exporting Subkeys to File

GPG novice here so please bear with me. From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb). If I wanted to give these to another party ...
19
votes
3answers
2k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
0
votes
0answers
86 views

Read and parse PGP keys

Good morning, my goal is to parse pgp keys but I am facing two problems. I don't know how pgp keys are encoded (for starters I deal with pgp keys generated by Rsa only) and nor do I know how to read ...
0
votes
3answers
98 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
1
vote
0answers
66 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
11
votes
2answers
5k views

What do the Keybase pgp import instructions actually do?

I've created a Keybase account and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there. I had expected instructions to PGP-sign a specific text from the ...
1
vote
0answers
39 views

Format for data & key exchange/storage [duplicate]

Is there a standard format for storing/exchanging encrypted data along with the key needed to decrypt it (data is encrypted with a single use symmetric key and the symmetric key itself is encrypted ...
6
votes
7answers
758 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
46
votes
7answers
10k views

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

I don't have an education in computer science, I've just become interested in information security and encryption lately. I'm struggling to understand why encrypted web browsing using HTTPS has been ...
1
vote
1answer
1k views

Is it possible to decrypt a PGP encrypted file without private key?

I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data. Recently, my colleagues told ...
7
votes
2answers
17k views

How to verify PGP signature with signing key

I have to download a program with a PGP signature and a signing key (Public Key) How do I check the program with signing key?
0
votes
0answers
51 views

GPG issues with sending and receiving keys

I've experimented a lot with GPG the last couple days and one issue persists: Someone signed my GPG key and published it to a keyserver X. I can see on the webpage that his signature is shown under ...
2
votes
1answer
524 views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
74 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
151 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
11
votes
2answers
8k views

How to raise a key to ultimate trust on another machine?

I have created a master key with two subkeys: one for signing and the other for encryption. Finally, I have exported the two subkeys to a new machine. How can I tell the new machine to consider the ...
25
votes
7answers
53k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
0
votes
1answer
111 views

PGP encryption passphrase

We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the ...
0
votes
1answer
143 views

Using GPG or PGP, is there a way to give another user (or key) access to decrypt a file for a limited time only? [duplicate]

I want to share encrypted files with someone else however it's only for a short time only. What is the best way to do this? More background: I'd like to add more people to be able to decrypt the ...
38
votes
4answers
41k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
3
votes
1answer
1k views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
2
votes
2answers
1k views

Client sent me an OpenPGP key; I need to generate key for SSH authentication on FTP server

One of my responsibilities is the monitoring of our company's SFTP sever, and making sure our clients upload the files we need from them daily. Until now they had username/password access, but we want ...
6
votes
1answer
343 views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
23
votes
2answers
10k views

Can I check who can decrypt my GPG message after I encrypt it?

When I send, say, a great recipe for funnel cake to Alice and Bob using GPG, I can be pretty sure they will both be able to decrypt it. However, can I be certain, or prove after the fact, that they ...
27
votes
5answers
19k views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
2
votes
3answers
417 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
0
votes
0answers
68 views

How to automatically sign a message using PGP in an email?

Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message. For Example, A wants to send a message to B. A open its email ...

1
2 3 4 5
13