106
votes
Accepted
Is layered encryption more secure than long passwords?
Option 1 is more secure. In option 2, we can guess each word seperately. When we guess "amazing", we get confirmation that this word is correct and we can continue to the second word. In option 1, we ...
- 34.4k
70
votes
Accepted
Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?
Yes, it's a coincidence that the first bytes appear to you as these symbols. They are part of the OpenPGP message format specification (RFC 4880) and vary depending on the packet properties.
Let's ...
- 45.1k
61
votes
Accepted
Encrypting a few TB of Data
Why not use a commonly used application to do it? VeraCrypt is a good choice as it replaced the respected TrueCrypt application and allows you to create an encryption container that you mount as a ...
- 3,300
53
votes
Accepted
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23:
From: https://help.github.com/articles/about-gpg/
GitHub will automatically sign commits you make ...
- 1,710
41
votes
Encrypting a few TB of Data
I find some of your comments curious. Particularly,
I'm trying to stay away from methods that are reliant on an application, and do it manually - as I'd feel more in 'control'.
and
I don't need ...
- 7,835
41
votes
Can I add an email address to an existing GPG key?
Yes, you can add user IDs. The key is still the same, so you can use it like before. The only difference is that any possibly existing signatures are not valid for the new user IDs.
Find out the key ...
- 19.4k
29
votes
Accepted
GPG why is my trusted key not certified with a trusted signature?
The key needs to be verified. If you trust that someone's public key does in fact belong to that individual and they are in your keyring you can use your private key to sign your correspondent's ...
- 7,859
29
votes
Is layered encryption more secure than long passwords?
This doesn't add security, but makes it easier to guess the passphrase one word at a time (N⁴ vs. N+N+N+N, where N is the symbol count of the word list). Even when you encrypt a file or a message to ...
- 19.4k
26
votes
Accepted
GPG masterkey and subkey for encryption and signature and default keys
If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new ...
- 6,578
26
votes
Accepted
How do GPG smart card devices handle large GPG operations?
The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
- 52.1k
24
votes
Accepted
How to change (sub)key usage of a PGP key?
Since GnuPG 2.2.6 there's a hidden key-edit subcommand "change-usage" which does exactly that. Relevant commit.
Let's try this subcommand with a test key. Let's create one first:
mkdir /tmp/gpg-...
- 464
24
votes
Accepted
Is there a limit on the layers of encryption a file can have?
Theoretically, there's no limit on the number of times you can encrypt a file. The output of an encryption process is again a file, which you can again pass it on to a different algorithm and get an ...
- 4,444
22
votes
Can I specify a public key file instead of recipient when encrypting with GPG
Since GnuPG 2.1.14 there is a new option allowing to encrypt from a keyfile:
--recipient-file FILENAME. It works from an binary or an ascii armored file.
Check the release notes or the dev mailing ...
- 321
22
votes
Accepted
gpg --fingerprint prints out completely different fingerprint
GnuPG generally resolves subkeys to the primary key if a subkey is passed as argument. This might be especially surprising when specifying an encryption subkey: GnuPG resolves the subkey to the ...
- 24.9k
22
votes
Accepted
gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey
Solution
Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.
You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.
If all your private keys are on ...
- 623
21
votes
Accepted
Sending the GPG key to keyserver
The PGP keyserver pool has dozens (129 at the moment) of keyservers in it. When you make a request to it, you may get a different server than the previous request. Over time, the keyservers all ...
- 16.1k
21
votes
Accepted
Where are the symmetric keys stored?
This is actually how PGP/GPG operates.
When you encrypt something to a public key, it first encrypts the data with a symmetric key. Then it encrypts the symmetric key with public key cryptography, and ...
- 17.5k
19
votes
Accepted
Is it safe to share your `gitconfig`'s `user.signingkey` value with the world?
Is it safe to share your gitconfig's user.signingkey value with the world?
Yes, that is safe.
The signingkey value is your GPG key ID (the lower 64 bits of the fingerprint) which is derived from ...
- 45.1k
19
votes
Is layered encryption more secure than long passwords?
Imagine a Hollywood film where they're cracking a password or a security code, with all the spinning digits on a fancy UI, and they have elite hackers who crack one digit of the code at a time, and ...
- 291
18
votes
Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?
As a general principle, well-designed binary file formats¹ will have their first few bytes be a magic number identifying the format. ELF executables' first four bytes are always 7f 45 4c 46, PNG ...
- 657
16
votes
GnuPG decryption not asking for passphrase
GnuPG 2.2.15
--symmetric
-c Encrypt with a symmetric cipher using a passphrase. The default sym-
metric cipher used is AES-128, but may be chosen with the --cipher-algo
...
- 261
16
votes
How to raise a key to ultimate trust on another machine?
To change the Ownertrust trust level of a key after importing in a simplier way (without the interactive --edit-key mode) I found this way in one line using gpg --import-ownertrust:
According to this ...
- 161
16
votes
gpg-agent keeps saving pin for a smartcard
I've been looking into this myself. I want to be prompted to enter my PIN every time I request my smart card (Yubikey in my case) to do a sign/encrypt/auth operation. It is possible to enable this ...
- 161
16
votes
Accepted
Is a part of an encrypted file easier to crack?
No. You still need to find the same length encryption key to decrypt the data into plaintext. Finding the key is the hard part, decrypting a whole or partial image is trivial once you have the key.
...
16
votes
Is layered encryption more secure than long passwords?
Another perspective to what the others said (that guessing single words 4 times is much less expensive than guessing a combination of 4 words at once):
In cryptography, there is the concept of having ...
- 2,409
15
votes
Is it possible to export a GPG subkey's public component?
use ! to keep gpg from speculating/grabbing primary+secondary keys associated with your keyid [email protected]
When using gpg an exclamation mark (!) may be appended to force using the specified ...
- 270
15
votes
Create backup Yubikey with identical PGP keys
found this blurb which says that theres a command you can run which will essentially tell your local gpg app to scan the new card and use that instead if things gel. so in the case of using a backup ...
- 259
14
votes
Accepted
How does GnuPG encrypt secret keys?
GnuPG 2.x has a separate gpg-agent that is the custodian of secret keys and that offers no control whatsoever over the encryption parameters of the secret keys within.
Furthermore, --s2k are accepted ...
- 321
14
votes
Accepted
What is the meaning of GnuPG's --list-sigs output?
Certification Levels
There are different classes of certifications. Quoting RFC 4880, OpenPGP, 5.2.1. Signature Types:
[...]
0x10: Generic certification of a User ID and Public-Key packet.
The ...
- 24.9k
14
votes
gpg4win kleopatra doesn't ask for passphrase on subsequent runs
This is controlled by the following setting:
Kleopatra Settings > GnuPG System > GPG Agent > Expire cached PINs after N seconds
Set it to 0 to make the cached password forgotten immediately.
- 141
Only top scored, non community-wiki answers of a minimum length are eligible