Questions tagged [pgp]

PGP is short for "Pretty Good Privacy". It is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security of e-mail communications.

Filter by
Sorted by
Tagged with
2
votes
1answer
98 views

Is it wise to remove redundant self-signatures from my PGP key?

I have changed expiration date of my pgp key several times. Recently I looked at it and started to worry about the mess I can see there: $ gpg --list-sigs AAAAAAAAAAAAAAAA pub 4096R/AAAAAAAA 2014-...
3
votes
1answer
674 views

Is “BEGIN PGP SIGNED MESSAGE” optional to include in an armored message?

Although it's probably nitpicking, it doesn't look very cosmetically pleasing to put the BEGIN PGP SIGNED MESSAGE at the top of an email, is that header really required to parse the message and verify ...
7
votes
2answers
17k views

How to verify PGP signature with signing key

I have to download a program with a PGP signature and a signing key (Public Key) How do I check the program with signing key?
-2
votes
1answer
237 views

PGP private key and decryption issues

I have created a private and public key set and encrypted a message to a friend with their public key. I then turned off my machine, and since it is not in persistence mode, my keys were deleted, but ...
3
votes
2answers
301 views

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
2
votes
1answer
205 views

Is there an open-source PGP that Encrypts-then-MACs, uses Blake2 or Whirlpool, and none of the NIST curves known to be compromised? [closed]

I find the language of RFC4880-bis very disturbing on the topic of privacy. I do not want "modest" security. "Consequently, because it [MDC] is a modest security system, it has modest ...
14
votes
2answers
5k views

Generate new key - ECC vs RSA

I intend to start using GnuPG again. I haven't used it for the last 2 years and was surprised that there is now the option for RSA and ECC keys. After reading a bit about ECC, it seems to me there is ...
3
votes
1answer
602 views

Best way to implement PGP company wide [closed]

What is the best way to implement PGP/GnuPGP company wide? Go to each users workstation, create the keys, upload the public key, and move on to the next?
3
votes
2answers
10k views

Pass password to GPG via script

Okay, maybe first a little context: I use a PGP(GPG) encrypted file to hold my passwords. I use a (dash) script, bound to a key combination, to fill in usernames and passwords across applications/...
2
votes
1answer
85 views

Is there a maximum for the number of certifications on a PGP public key

My question is about openPGP and the GnuPG implementation in particular. The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this ...
4
votes
1answer
2k views

Does Yubikey 4 support multiple OpenPGP encryption keys or only one?

When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key? If I ...
2
votes
1answer
150 views

Does it matter if an average person has email encryption or not?

I was thinking about using a secure email service. So, I read about it. And it feels completely useless for me personally. Almost everyone that I exchange emails with, don't use PGP or any kind of ...
10
votes
2answers
4k views

What do the Keybase pgp import instructions actually do?

I've created a Keybase account and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there. I had expected instructions to PGP-sign a specific text from the ...
0
votes
3answers
490 views

Do I need a PGP key?

I'm new to OpenPGP, GnuPG, and the concept of public-private key pairs. I have some questions in my mind: Is it necessary for me to have a PGP (or an OpenPGP) key? I'm an Android programmer, and an ...
2
votes
1answer
107 views

How to single key decrypt pgp encrypted mails in a multi key/multi identitiy setup?

For pgp encryption I'd like to combine short expiry terms for public signing and email encryption with (convenient) long term decryption possibilities of my mailbox mails. I'm using several mail ...
0
votes
2answers
3k views

Pip verify packet integrity [duplicate]

I've recently used pip to install packets inside of a public network without thinking about it: pip install packetname and I was wondering if pip does some sort of verification via hashing or PGP.
2
votes
1answer
4k views

GPG with Yubikey smart card - smart card doesn't need to be plugged in! [duplicate]

I have created an offline MASTER key along with sub keys. The sub keys were sent to the Yubikey smartcard via the gpg 'keytocard'. The gpg --card-status command correctly identifies the information ...
2
votes
1answer
204 views

What are the consequences of revoking OpenPGP subkeys and generating new ones?

I almost feel stupid for asking this, but I have some trouble understanding subkeys, and what to do if a subkey gets compromised. Let's say my "main" private key is used for certification only. I ...
0
votes
2answers
72 views

Switch Private- and Public- key for Identification

Today at the University we learned if Alice gives Bob her private key and vice versa, they can identify them self. It make sense but is this good practice? I always thought that Certificates are made ...
4
votes
4answers
2k views

Sharing a PGP Private Key

I read often that you should not share a PGP private key. I understand that and it makes sense. If someone has my private key (and manages to obtain the password for it), I can be impersonated. But ...
3
votes
2answers
1k views

How did I have two different public keys for one e-mail address

I created public/private keypair with Mailvelope Chrome plugin. I don't fully remember the details but I exported the public key and sent it to MIT keyserver. After few weeks, I realized that my ...
1
vote
2answers
214 views

Is it possilbe to use an OpenPGP private key to sign a file via OpenSSL?

Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL? I've tried this: $ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key $ openssl rsautl -sign -in testfile ...
3
votes
1answer
589 views

Strong password for GPG key or encrypt password database with GPG key?

I have a password database, that can be secured by a passphrase or by providing a GPG key. I have a GPG key that can be secured via a good password that I can remember, or via a great password that I ...
8
votes
3answers
2k views

GnuPG warning for a signed key with trust level 4

When encrypting a document with a public key I got a warning: $gpg --encrypt -r 6B7F10E4 file.pdf It is NOT certain that the key belongs to the person named in the user ID. If you *really* know ...
4
votes
1answer
452 views

Is an OpenPGP signature made before a key is revoked considered valid?

If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was ...
0
votes
2answers
7k views

Basic PGP Encryption / Decryption

I am working on a project that requires the basic encryption/decryption of a message. I generated private/public keys with my email and no password. The pgp public key as well as the private key, ...
2
votes
1answer
2k views

Can a CA sign a PGP certificate?

Say I have a public/private PGP key pair used to sign emails. When someone receives a message, he obviously has no way to check that the message was ~really~ signed by me without having received my ...
3
votes
1answer
62 views

Is it practical and/or secure to get my friends to remotely sign my OpenPGP public key?

My best friends would trust who I am and I would also trust who they are, without looking at our government-issued IDs. We went to the same schools and same classes for many years. However, they now ...
2
votes
1answer
265 views

Can an attacker replace the hash of a download, a download, and the public key?

I have a question about DSA and GPG. Suppose you are trying to verify a downloaded file is 'legit' (i.e., no malicious code and it is the intended file). I'll just use Ubuntu's 16.04 LTS ISO image as ...
2
votes
1answer
1k views

Can I look up email address from a PGP/GPG fingerprint?

If I know a PGP fingerprint, can I query a keyserver to find out what email address(es) it is associated with?
5
votes
1answer
787 views

How should I choose a trust model in GnuPG?

GnuPG offers a set of different trust models, but the manual isn't sufficient (for me at least) to figure out which one to use. Ideally, I would like a trust model that accepts the trust I explicitly ...
7
votes
1answer
568 views

Priority of GnuPG subkey selection during encryption

I've got the following set of 6 subkeys $ gpg -K ... ssb> rsa2048 2017-10-04 [E] [expires: 2027-10-02] ssb> rsa2048 2017-10-04 [S] [expires: 2027-10-02] ssb> rsa2048 2017-10-04 [A] [...
3
votes
1answer
765 views

What do these signatures of my PGP key mean?

When I was viewing the key information of my PGP key on a key server, I couldn't understand the meaning of some of the signatures. Here is the key information from the key server(https://pgp.mit.edu/...
2
votes
1answer
3k views

How do I check who a public PGP/RSA key belongs to?

I am new to public key cryptography. I see from keyservers it's possible to do a look up for public keys associated with an email address. Is there a reverse function available to check what email/...
3
votes
1answer
91 views

Will Adobe have to re-sign all their previous publications?

Adobe recently published their PGP private key by accident. They have now issued a new one. But will they need to re-sign (with their new key) everything that was signed with their old key? As ...
4
votes
1answer
372 views

Generate subkeys based on less secure OpenPGP primary key

I've been reading about the benefits of using OpenPGP subkeys for different machines. Obviously, it's a much safer practice than copying around the same master key between multiple machines (...
2
votes
1answer
536 views

Can an OpenPGP primary key revoke a subkey of a subkey?

I would like to have the following setup: a main Key, saved in a hardware wallet or paper wallet. Let's call this level 1. The idea is to never have to use this key again, as a sort of last resort. ...
3
votes
1answer
767 views

How can I generate a .gpg file for verifying Putty?

I downloaded the Putty installer from ssh.com, which said To import the signature key into GPG, use: gpg --import putty-release-2015.asc To check the signature of a file, use: gpg -...
4
votes
1answer
133 views

When reading PGP or other encrypted emails, is it wise to unplug my computers ethernet in order to use my private key?

I've never used PGP before so my logic may be a bit off. When receiving an email encrypted with my public key, would it not be best to unplug or disconnect my computer's internet before decrypting ...
0
votes
2answers
117 views

Is sending the same e-mail encrypted and also unencrypted a security risk?

Is it a risk, if I send the same email one time encrypted and to another recipient unencrypted? I wonder if it would be possible to calculate the decryption key (if someone had a copy of both) and ...
2
votes
1answer
126 views

Rationale for subkeys in OpenPGP?

I have seen from different sources that the sole purpose of the master key should really be to generate the subkeys, and that it should be subsequently backed up to an offline location and deleted ...
0
votes
1answer
725 views

Is email published with PGP key?

When I generate key it has my email address attached to it. Does it mean, when I publish my public PGP key people also see my email attached to it? From what public keys I saw so far it seems to me ...
3
votes
2answers
116 views

Concern regarding repeatable text in Git commits reducing namespace and weakening GPG key

I need help with two PGP / GPG issues: Ensuring that my thinking is correct (i.e., I really do need another GPG subkey for my scenario) Ensuring that I create the subkey correctly without ...
1
vote
1answer
673 views

PGP encryption for the server based app

Here is context: I am using PGP to encrypt messages in a chat web app. After going through some articles, I get brief idea how PGP works and here is how I am doing it with openPGPJs : Client(web ...
6
votes
2answers
2k views

How to use YubiKey through GnuPG on remote server?

I'm wondering if it is possible to use a Yubikey to unlock for example a GnuPG key on a server, so can I somehow pass the generated token from the YubiKey over SSH to the server in an easy way?
4
votes
1answer
185 views

GPG key handling with Server

I'm using a VPS as a development machine and need gpg a) for signing git commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel ...
2
votes
1answer
236 views

How to get my OpenPGP keys signed?

I was wondering if anyone has any recommendations for getting my OpenPGP key signed by others. I live in the middle of nowhere, and there aren't meetup groups within 50 miles of me ever. How to get ...
2
votes
1answer
742 views

PGP trust model

Given Alice has signed Bob's key, and Bob has signed Chloe's key, Alice would like to send Chloe a secure e-mail using Chloe's key but Alice cannot check Chloe's key physically. Instead Alice could ...
0
votes
1answer
55 views

How is the correct key chosen when decrypting OpenPGP messages?

I own multiple PGP key pairs and receive a PGP-encrypted email. How does PGP know which key has been used for encryption, i.e., which key should be used for decrypting the email?
2
votes
1answer
364 views

Use one subkey for signing + encrypting

I'm phasing out my old OpenPGP key and am creating a new one. I plan to lock away the main key and do daily work only with subkeys. The subkeys will be valid for a year and I'll add new ones after ...

1 2
3
4 5
13