Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
35
votes
2answers
30k views

How does RSA encryption compare to PGP?

On this answer ck says RSA and PGP are different. What you are essentially asking is how do I run my petrol car on diesel? The answer is you can't. I would be interested in a more ...
34
votes
2answers
31k views

GnuPG decryption not asking for passphrase

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away. Does it store the secret key somewhere and uses it (I ...
12
votes
1answer
575 views

Recommended operational security for generating one's primary key pair?

I have been looking for an operational security guide for generating one's asymmetric key pair for (Open)PGP. I have found plenty of technical guides for how to use GnuPG to generate RSA key-pairs, ...
6
votes
1answer
14k views

GPG why is my trusted key not certified with a trusted signature?

When I run gpg --verify ~/file.asc ~/file I receive the following: gpg: Signature made Tue 10 Dec 2016 05:10:10 AM EST using RSA key ID abcdefgh gpg: Good signature from "Alias (signing key) <...
22
votes
1answer
13k views

Ways to sign gpg public key so it is trusted?

I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
19
votes
2answers
1k views

Which signing key should I use for certifying other peoples public keys: master or subkey?

I have a Master Identity key (which is detached from my daily-use keyring) and both encryption and signing subkeys (all are RSA). I sign documents with the signing subkey: GnuPG selects this key ...
8
votes
4answers
2k views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
7
votes
1answer
3k views

GPG masterkey and subkey for encryption and signature and default keys

I am a little confused (as many others) about the concept of subkeys as related to the primary key. gpg by default (at least it seems on my system --- using RSA), upon gpg --gen-key creates a ...
7
votes
2answers
725 views

Apart from the lack of native Outlook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
6
votes
2answers
5k views

When signing email with GPG, how does verification by the receiver work?

I use GPG to sign my outgoing emails. I understand how it works when I encrypt mail to send to someone else. Then I need his/her public key, encrypt it with that, and only he can decrypt it using ...
16
votes
2answers
4k views

GPG-encrypted mailing list and other approaches to safe communication

What is the best way to communicate privately on a mailing-list? Requiring each member of the list to have the public key of each other member, and encrypt their messages with those, is cumbersome to ...
15
votes
5answers
10k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
15
votes
2answers
17k views

Lost my PGP private key, what's next?

I have created a PGP key using GPGTools, and published it a while ago. Things are: I have no longer access to my secret key. Indeed, I unfortunately formatted the wrong drive (encryption was and is ...
12
votes
2answers
8k views

What is the difference between “full” and “ultimate” trust? [duplicate]

When you trust a GnuPG key, you can choose one of these five options (and I'm assuming the same options exist in other OpenPGP tools): 1 = I don't know or won't say (undefined) 2 = I do NOT ...
9
votes
1answer
4k views

What is purpose of --s2k-* GnuPG options? [closed]

When I use gpg --symmetric --s2k- and press tab some options appear: --s2k-cipher-algo --s2k-count --s2k-digest-algo --s2k-mode What do those options do?
7
votes
1answer
314 views

Help - Somebody stole my OpenPGP key ID, what can I do?

I received a key transition statement because somebody found himself in the exact same situation described here. This issue will target more and more OpenPGP users in future, probably even all of them....
7
votes
1answer
3k views

GPG master key without email address

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell ...
5
votes
1answer
2k views

Wrapping my head around Protonmail

I've been trying to grasp how Protonmail could work. From what it gather, it works like this: When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
5
votes
1answer
3k views

Is it typical to create both x509 and OpenPGP key pairs?

I'm looking into increasing my use of signed and encrypted "things" - LibreOffice Documents, Off-the-record chat, PDFs, emails, etc. I'm finding that some things only support x509 format-certificates, ...
22
votes
3answers
6k views

Anything to do about old gpg keys?

Quite A few years ago (in middle school) I created some gpg keys, published them to a keyserver, etc. because I was l33test kid on the block. Now I have gone through a few new computers and OS's, etc....
21
votes
2answers
10k views

Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my ...
13
votes
4answers
4k views

Is it safe for GPG to compress all messages prior to encryption by default?

By default, GPG compresses text during encryption. Additionally, RFC 4880 says: 2.3. Compression OpenPGP implementations SHOULD compress the message after applying the signature but before ...
11
votes
1answer
2k views

Can all the (other) recepients of a PGP encrypted message be identified?

Does an encrypted message contain any information about whom it is encrypted to, or at least to how many recipients? And if so, is it at least only obtainable for other recipients or for just anybody?
8
votes
1answer
3k views

How to tell if my OpenPGP public key is self-signed?

I recently read: You should sign your PGP public key immediately after generating your public/private key-pair. And now I wonder how I can check whether I already did that. So my question is: how ...
6
votes
1answer
466 views

self-signatures using SHA1

This page says: self-signatures must not use SHA1 You can check this by doing: gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep '...
5
votes
2answers
3k views

What do I do about a forgotten, ancient PGP key?

I just created a new PGP key because I want to start using PGP to encrypt my emails. Lo and behold, this is apparently not my first attempt to use PGP. Five years ago, I created another PGP key using ...
9
votes
1answer
3k views

How do PGP keyservers synchronize the keys?

I want to know technical details about how public PGP keyservers synchronize the keys. If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and ...
9
votes
1answer
534 views

My OpenPGP private keys are set up with sub-keys. What happens if I revoke a sub-key and re-issue a new one?

I have set up my OpenPGP keys with sub-keys, following the general instructions laid out in "Creating the perfect GPG keypair." The general gist is that you create a "master keypair" which is not ...
8
votes
2answers
3k views

Does GnuPG use symmetric + public key encryption for large files?

Recently, I have a need to encrypt few large files. I have the option to use the OpenSSL command line utility, however I prefer to use GnuPG. How does GnuPG works under the hood with the --encrypt ...
8
votes
1answer
8k views

PGP RSA key size - encryption/decryption time

From what I've read, PGP only uses the pub/priv keys for encrypting/decrypting a symmetric key used for actually encrypting/decrypting data. I'd reasonably assume that longer asymmetric keys wouldn't ...
6
votes
2answers
2k views

Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?

Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption. Should slow hash function (like bcrypt) be applied to password before using it with ...
6
votes
1answer
3k views

Purpose of secret-subkeys?

Through output of gpg -k und gpg -K it seems that I always have (as well as create) (sub)keypairs. But, if the purpose of the pub and sub is as it is shown below and the purpose of the secretkey is ...
5
votes
1answer
604 views

What are the problems with uploading client-side encrypted keys to keybase.io?

I was just reading some articles about keybase.io: http://www.makeuseof.com/tag/keybase-wants-bring-encryption-masses-heres/ http://blog.lizdenys.com/2014/03/31/refusing-to-verify-myself/ And I'm ...
4
votes
1answer
303 views

Cross-certification between worlds like X.509 and PGP?

Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
3
votes
1answer
2k views

PGP/GPG: Do I need more encryption subkeys?

As far as I know after reading several tutorials, it's reasonable to create one subkey for signing per each device I use, especially one that can be stolen, like laptop. However, having multiple ...
2
votes
1answer
489 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
9
votes
1answer
4k views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
6
votes
1answer
715 views

Why are PGP signatures not more widely used as an authentication method?

Example: Bob generates a key pair for this example. Bob registers at example dot com where he provides his public key. When Bob will try to log in, example dot com will ask him to sign a random ...
4
votes
3answers
2k views

Two-way PGP email without publishing your key / address to a key server?

If I want to have some privacy and avoid the attention of publishing my email address to the public key server web of trust, yet have a secure two-way email conversation with one recipient, what are ...
3
votes
2answers
289 views

Why does my private OpenPGP key look different between devices?

Something I noticed, when I use gpg --export-secret-keys -a on different computers: My private key looks different, even though they are the same key pair. Is that normal or does this indicate ...
3
votes
1answer
149 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
0answers
3k views

Store PGP keys in HSM

Is anyone storing the PGP encryption key in a Hardware Security Module (HSM)? Company policy mandates this, so I need to store the private key to decrypt pgp file in HSM. But as much i know PGP uses ...
1
vote
1answer
205 views

Web of Trust: What is “signatory trust”?

I am learning about the Web of Trust and how to use it. However, I have some issues to fully grasp the concept of Signatory Trust. What is an easily understandable definition of signatory trust? An ...
1
vote
3answers
314 views

Is it possible that to sign a message with a PGP key in a way that leakes the key

Alice provides a software for signing messages. The software runs in a airgapped enviroment. The software is given the message that's to be signed and the private key. The software then produces a ...
7
votes
3answers
3k views

How does GnuPG encrypt secret keys?

When creating a secret key with GnuPG, you are asked for a password to protect it. Which encryption algorithm is used to achieve this? The handbook only says that a symmetric encryption algorithm is ...
7
votes
1answer
95 views

User IDs containing URIs

When adding a User ID to your OpenPGP key, you are typically asked (for example by GnuPG) to provide a name, a comment, and an email address (where each part is optional). This format (Name (Comment) ...
4
votes
1answer
56 views

Do I need separate revocation certificates for each email address associated with a key?

I just created my first OpenPGP key with GnuPG + Thunderbird + Enigmail. The key is used for two email addresses. Now I created a revocation certificate. There is only on of the email addresses ...
3
votes
1answer
358 views

Should I revoke & regenerate PGP private keys after computer is serviced by Apple Store?

I recently had an issue with my MacBook where it wouldn't boot. So I took it in to the apple store, and they said that they would need to send it off to a service center to diagnose and repair it. I ...
3
votes
1answer
619 views

What do these signatures of my PGP key mean?

When I was viewing the key information of my PGP key on a key server, I couldn't understand the meaning of some of the signatures. Here is the key information from the key server(https://pgp.mit.edu/...
2
votes
3answers
211 views

With GPG, can 3rd party verify that message has been encrypted by specific public key?

Bob is sending message X to Alice. He encrypts X with Alice's public key using gpg and sends her encrypted message (ciphertext). Later Alice claims that Bob made a mistake and the ciphertext was not ...