Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
1
vote
1answer
50 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
1
vote
1answer
45 views

Can I copy a PGP revocation to another server?

I have a few PGP keys from long ago that I no longer use. I thought I had revoked them everywhere I had uploaded them but I just noticed I missed one keyserver. Unfortunately, I only have access to ...
3
votes
2answers
63 views

Is PGP passphrase necessary if I store private key and passphrase in the same place?

I'm building a system that generates PGP key and store private key in secret vault. One thing I'm not fully understanding is the need for passphrase. I can generate a random passphrase during the key ...
0
votes
0answers
25 views

GPG Questions About Exporting Subkeys to File

GPG novice here so please bear with me. From what I understand, when you generate a keypair with GPG it will automatically create a subkey pair (sub, ssb). If I wanted to give these to another party ...
19
votes
3answers
2k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
0
votes
0answers
52 views

Read and parse PGP keys

Good morning, my goal is to parse pgp keys but I am facing two problems. I don't know how pgp keys are encoded (for starters I deal with pgp keys generated by Rsa only) and nor do I know how to read ...
0
votes
3answers
86 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
1
vote
2answers
292 views

How do i validate that a PGP Public Key the user inputs is valid?

we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work ...
1
vote
0answers
58 views

Why does PGP create a signature from plaintext?

From my understanding, PGP supports the generation of a signature from plaintext using the sender's private key. Both the plaintext and the signature are encrypted using the session/symmetric key, and ...
10
votes
2answers
4k views

What do the Keybase pgp import instructions actually do?

I've created a Keybase account and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there. I had expected instructions to PGP-sign a specific text from the ...
1
vote
0answers
36 views

Format for data & key exchange/storage [duplicate]

Is there a standard format for storing/exchanging encrypted data along with the key needed to decrypt it (data is encrypted with a single use symmetric key and the symmetric key itself is encrypted ...
6
votes
7answers
745 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
46
votes
7answers
10k views

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

I don't have an education in computer science, I've just become interested in information security and encryption lately. I'm struggling to understand why encrypted web browsing using HTTPS has been ...
1
vote
1answer
709 views

Is it possible to decrypt a PGP encrypted file without private key?

I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data. Recently, my colleagues told ...
7
votes
2answers
16k views

How to verify PGP signature with signing key

I have to download a program with a PGP signature and a signing key (Public Key) How do I check the program with signing key?
0
votes
0answers
36 views

GPG issues with sending and receiving keys

I've experimented a lot with GPG the last couple days and one issue persists: Someone signed my GPG key and published it to a keyserver X. I can see on the webpage that his signature is shown under ...
1
vote
1answer
61 views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
50 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
49 views

How long does it take for a gpg key revoke certificate to propagate to all public key servers?

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is ...
8
votes
2answers
5k views

How to raise a key to ultimate trust on another machine?

I have created a master key with two subkeys: one for signing and the other for encryption. Finally, I have exported the two subkeys to a new machine. How can I tell the new machine to consider the ...
21
votes
7answers
45k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
0
votes
1answer
51 views

PGP encryption passphrase

We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the ...
0
votes
1answer
66 views

Using GPG or PGP, is there a way to give another user (or key) access to decrypt a file for a limited time only? [duplicate]

I want to share encrypted files with someone else however it's only for a short time only. What is the best way to do this? More background: I'd like to add more people to be able to decrypt the ...
1
vote
1answer
652 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
37
votes
4answers
37k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
3
votes
1answer
927 views

Multiple PGP key practices for code signing, GitHub, and email

I have a set of objectives for PGP certificate uses, and have developed what what I think is a reasonable plan as a solution. What I'm wondering is: Have I overlooked something important that ...
2
votes
2answers
1k views

Client sent me an OpenPGP key; I need to generate key for SSH authentication on FTP server

One of my responsibilities is the monitoring of our company's SFTP sever, and making sure our clients upload the files we need from them daily. Until now they had username/password access, but we want ...
6
votes
1answer
128 views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
21
votes
2answers
10k views

Can I check who can decrypt my GPG message after I encrypt it?

When I send, say, a great recipe for funnel cake to Alice and Bob using GPG, I can be pretty sure they will both be able to decrypt it. However, can I be certain, or prove after the fact, that they ...
27
votes
5answers
17k views

Can I get a public key from PGP signature?

I have a PGP signature of a known message. However, I am not sure who signed it. Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just ...
2
votes
3answers
322 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...
0
votes
0answers
44 views

How to automatically sign a message using PGP in an email?

Is there any way to sign and send a message from email server automatically...without using any desktop client to sign the message. For Example, A wants to send a message to B. A open its email ...
55
votes
8answers
17k views

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed: I know Joe's e-mail address: cool_joe@gmail.com. I have a ...
6
votes
2answers
2k views

How to use YubiKey through GnuPG on remote server?

I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
6
votes
2answers
284 views

Does RNG play a role in PGP signing?

We have a Jenkins system that builds and PGP-signs software releases, and we are considering moving the signing component to an isolated VM instead of running it as part of the overall builder ...
2
votes
1answer
91 views

Is it possible for me to somehow verify that the PGP message blob I just generated contains what I intended for it to contain?

I have this text: Would you mind stopping by the local store and buy some baking soda for tomorrow, Betty-Sue? Betty-Sue has given me her public PGP key, which I have imported and now use to encrypt ...
0
votes
0answers
42 views

How to import pgp backup back into smartcard?

I generated a backup of my master key and 3 sub keys following this into these archives: gpg.conf mastersub.key openpgp-recovs.d private-keys-v1.d (contains 4 .key files) pubring.kbx random_seed ...
1
vote
1answer
67 views

Were PGP/MIME and PGP/Inline equally affected by EFAIL?

I saw this question about which out of those two protocols is more secure. The question was from 2016, but Efail was discovered late 2017. I understand that some email programs were affected while ...
-2
votes
2answers
107 views

How does PGP Public and Private Keys work?

I recently tried to understand how PGP works: I encrypt plaintext with my private key and if I send that encrypted text to others with my public key they can encrypt that with my public key?
0
votes
1answer
66 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a OpenPGP smartcard, such as the Nitrokey Pro or similar. But then, how can I decide that I trust an OpenPGP smartcard?
-4
votes
1answer
112 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
5
votes
1answer
4k views

How to send an encrypted mail only knowing the PGP fingerprint?

How does one send an encrypted email with PGP, when he only has the recipient's fingerprint? I am already sending emails using PGP, but I've just pulled a contact's PGP fingerprint who I need to ...
0
votes
0answers
73 views

changing passphrase on gpg subkey

Is it possible to change passphrase on a subkey by: gpg --edit-key sub_key_id passwd Or will this change the passphrase on the master key as well? (My idea stems from the fact that master key is ...
0
votes
0answers
51 views

How to reset a PGP key to work for an old user

We have a scenario where we are locked out of our PGP private key despite 100% certainty we are using the correct passphrase: User1 created a PGP key pairing. The public key was sent to a third party ...
29
votes
7answers
14k views

Putting my PGP ID/link on printed business cards

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well. After doing some research I found that using the short ID is not a good idea....
1
vote
0answers
36 views

How to list signatures of public key file without importing it to keyring?

How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available. I would like a similar output to gpg --list-signatures <key-id>, but ...
19
votes
7answers
6k views

Is PGP for user authentication a good idea?

I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication. How I'm doing it right now My current concept is modeled ...
5
votes
1answer
2k views

Correct way to replace a GPG key

I want to create a new GPG key with a longer key size. What are the best ways to replace the key? My current key is associated with a lot of stuff like GitHub etc. Should I revoke my old key and sign ...
1
vote
0answers
42 views

Why GPG signature is not considered as made by a trusted key?

When I verify a file signature I get the the following warning: $ gpg --verify file.sig gpg: Signature made So 01 Dez 2019 10:08:27 CET gpg: using RSA key <Pierre's key ID> gpg: ...
21
votes
2answers
25k views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...

1
2 3 4 5
13