106
votes
Accepted
Is layered encryption more secure than long passwords?
Option 1 is more secure. In option 2, we can guess each word seperately. When we guess "amazing", we get confirmation that this word is correct and we can continue to the second word. In option 1, we ...
- 29.6k
72
votes
How to securely send private keys
TL;DR: private keys are called private for a reason.
You can secure private keys by not transmitting them at all.
If you have shell access to the server they are used at, you simply generate them in ...
- 5,337
70
votes
Accepted
Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?
Yes, it's a coincidence that the first bytes appear to you as these symbols. They are part of the OpenPGP message format specification (RFC 4880) and vary depending on the packet properties.
Let's ...
- 44.7k
60
votes
Accepted
Encrypting a few TB of Data
Why not use a commonly used application to do it? VeraCrypt is a good choice as it replaced the respected TrueCrypt application and allows you to create an encryption container that you mount as a ...
- 3,270
52
votes
Accepted
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23:
From: https://help.github.com/articles/about-gpg/
GitHub will automatically sign commits you make ...
- 1,680
50
votes
Accepted
GnuPG decryption not asking for passphrase
Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?
GnuPG only uses keys from your key chain, so it must be in there to use it.
...
- 24.4k
48
votes
Accepted
How to raise a key to ultimate trust on another machine?
You can set every key to ultimate trust through opening the key edit command line
gpg --edit-key [key-id]
and running the trust command. You will now be prompted to select the trust level:
Please ...
- 24.4k
41
votes
Encrypting a few TB of Data
I find some of your comments curious. Particularly,
I'm trying to stay away from methods that are reliant on an application, and do it manually - as I'd feel more in 'control'.
and
I don't need ...
- 7,755
39
votes
Where do you store your personal private GPG key?
This is not what I currently use, but I am thinking about it:
Encrypt the private key with very long symmetric encryption key
Use Shamir's Secret Sharing to split the symmetric encryption key to 7 ...
- 31.4k
29
votes
Is layered encryption more secure than long passwords?
This doesn't add security, but makes it easier to guess the passphrase one word at a time (N⁴ vs. N+N+N+N, where N is the symbol count of the word list). Even when you encrypt a file or a message to ...
- 18.7k
28
votes
Accepted
What exactly is a subkey?
This post by user rjh from 2008 in the enigmail forum answers it well:
Originally in PGP 2.6, back in the early 90s, you had just one keypair
and it was used for both encryption and signing. The ...
- 1,726
28
votes
How to securely send private keys
GPG can allow you to send these securely without having to send a passphrase. If the destination has their own GPG key, you can encrypt the file so that only they can open it.
For example, the ...
- 381
28
votes
Accepted
GPG why is my trusted key not certified with a trusted signature?
The key needs to be verified. If you trust that someone's public key does in fact belong to that individual and they are in your keyring you can use your private key to sign your correspondent's ...
- 7,789
26
votes
Accepted
How do GPG smart card devices handle large GPG operations?
The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
- 46.3k
25
votes
Accepted
GnuPG asks for a key ID when sharing my public key, what is that?
OpenPGP User IDs
User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses....
- 24.4k
24
votes
Accepted
GPG masterkey and subkey for encryption and signature and default keys
If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new ...
- 6,418
24
votes
Accepted
Is there a limit on the layers of encryption a file can have?
Theoretically, there's no limit on the number of times you can encrypt a file. The output of an encryption process is again a file, which you can again pass it on to a different algorithm and get an ...
- 4,456
24
votes
Can I add an email address to an existing GPG key?
Yes, you can add user IDs. The key is still the same, so you can use it like before. The only difference is that any possibly existing signatures are not valid for the new user IDs.
Find out the key ...
- 18.7k
22
votes
Accepted
How to change (sub)key usage of a PGP key?
Since GnuPG 2.2.6 there's a hidden key-edit subcommand "change-usage" which does exactly that. Relevant commit.
Let's try this subcommand with a test key. Let's create one first:
mkdir /tmp/gpg-...
- 434
21
votes
How do I protect my OpenPGP key on my computer?
What's your threat model?
If your threat is that you are protecting from physical theft, then encrypting the key (using passphrase) or full disk encryption would suffice.
If your threat is a ...
- 31.4k
21
votes
Accepted
What is the difference between Key, Certificate and Signing in GPG?
In public key cryptography, the key is usually a key pair, consisting of a public key and a private key, and it is what you do encryption, decryption, signing, and verification with.
"A key ...
- 401
21
votes
Accepted
gpg --fingerprint prints out completely different fingerprint
GnuPG generally resolves subkeys to the primary key if a subkey is passed as argument. This might be especially surprising when specifying an encryption subkey: GnuPG resolves the subkey to the ...
- 24.4k
21
votes
Accepted
Sending the GPG key to keyserver
The PGP keyserver pool has dozens (129 at the moment) of keyservers in it. When you make a request to it, you may get a different server than the previous request. Over time, the keyservers all ...
- 16.1k
21
votes
Accepted
gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey
Solution
Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.
You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.
If all your private keys are on ...
- 583
21
votes
Accepted
Where are the symmetric keys stored?
This is actually how PGP/GPG operates.
When you encrypt something to a public key, it first encrypts the data with a symmetric key. Then it encrypts the symmetric key with public key cryptography, and ...
- 15.4k
20
votes
Can I specify a public key file instead of recipient when encrypting with GPG
Since GnuPG 2.1.14 there is a new option allowing to encrypt from a keyfile:
--recipient-file FILENAME. It works from an binary or an ascii armored file.
Check the release notes or the dev mailing ...
- 301
19
votes
Accepted
export-secret-key after Yubikey is plugged in
After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of ...
- 781
19
votes
Accepted
Is it safe to share your `gitconfig`'s `user.signingkey` value with the world?
Is it safe to share your gitconfig's user.signingkey value with the world?
Yes, that is safe.
The signingkey value is your GPG key ID (the lower 64 bits of the fingerprint) which is derived from ...
- 44.7k
19
votes
Is layered encryption more secure than long passwords?
Imagine a Hollywood film where they're cracking a password or a security code, with all the spinning digits on a fancy UI, and they have elite hackers who crack one digit of the code at a time, and ...
- 291
18
votes
Putting my PGP ID/link on printed business cards
I'd recommend putting your OpenPGP key's fingerprint in textual form and as QR code on your business card.
To do so, you would create an URI with OPENPGP4FPR as scheme and your OpenPGP fingerprint in ...
- 334
Only top scored, non community-wiki answers of a minimum length are eligible