Hot answers tagged

106 votes
Accepted

Is layered encryption more secure than long passwords?

Option 1 is more secure. In option 2, we can guess each word seperately. When we guess "amazing", we get confirmation that this word is correct and we can continue to the second word. In option 1, we ...
  • 28.7k
71 votes

How to securely send private keys

TL;DR: private keys are called private for a reason. You can secure private keys by not transmitting them at all. If you have shell access to the server they are used at, you simply generate them in ...
  • 5,317
70 votes
Accepted

Is it a coincidence that the first 4 bytes of a PGP/GPG file are ellipsis, smile, female sign and a heart?

Yes, it's a coincidence that the first bytes appear to you as these symbols. They are part of the OpenPGP message format specification (RFC 4880) and vary depending on the packet properties. Let's ...
  • 43.9k
65 votes
Accepted

Short OpenPGP key IDs are insecure, how to configure GnuPG to use long key IDs instead?

How the Fingerprint and Long and Short Key IDs are Related Each OpenPGP key has a fingerprint attached, calculated mainly from its public key packet which also contains the creation time. The ...
  • 23.5k
60 votes
Accepted

Encrypting a few TB of Data

Why not use a commonly used application to do it? VeraCrypt is a good choice as it replaced the respected TrueCrypt application and allows you to create an encryption container that you mount as a ...
  • 3,272
46 votes
Accepted

GnuPG decryption not asking for passphrase

Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)? GnuPG only uses keys from your key chain, so it must be in there to use it. ...
  • 23.5k
46 votes
Accepted

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23: From: https://help.github.com/articles/about-gpg/ GitHub will automatically sign commits you make ...
44 votes
Accepted

New PGP key: RSA/RSA or DSA/Elgamal?

since it's known that the NSA infiltrated RSA and made their key generation algorithm weaker If you know that, then you know wrong. You are confusing two things which have no relation whatsoever: ...
41 votes

Encrypting a few TB of Data

I find some of your comments curious. Particularly, I'm trying to stay away from methods that are reliant on an application, and do it manually - as I'd feel more in 'control'. and I don't need ...
  • 7,670
39 votes

Where do you store your personal private GPG key?

This is not what I currently use, but I am thinking about it: Encrypt the private key with very long symmetric encryption key Use Shamir's Secret Sharing to split the symmetric encryption key to 7 ...
  • 31.1k
36 votes
Accepted

How to raise a key to ultimate trust on another machine?

You can set every key to ultimate trust through opening the key edit command line gpg --edit-key [key-id] and running the trust command. You will now be prompted to select the trust level: Please ...
  • 23.5k
31 votes
Accepted

What is the default cipher algorithm for GnuPG?

TL;DR: For GnuPG 1.0 and 2.0, default is Cast5, for GnuPG 2.1 it is AES-128. Recipient's Preferences Per default, GnuPG will read the recipient's algorithm preferences and take the first algorithm in ...
  • 23.5k
31 votes
Accepted

Can I specify a public key file instead of recipient when encrypting with GPG

GnuPG does not support encrypting to a recipient specified by a key file. The key must be imported in advance, and the recipient defined with either his mail address or key ID. I'd recommend to use a ...
  • 23.5k
29 votes

Is layered encryption more secure than long passwords?

This doesn't add security, but makes it easier to guess the passphrase one word at a time (N⁴ vs. N+N+N+N, where N is the symbol count of the word list). Even when you encrypt a file or a message to ...
  • 16.1k
28 votes

How to securely send private keys

GPG can allow you to send these securely without having to send a passphrase. If the destination has their own GPG key, you can encrypt the file so that only they can open it. For example, the ...
  • 381
27 votes
Accepted

What exactly is a subkey?

This post by user rjh from 2008 in the enigmail forum answers it well: Originally in PGP 2.6, back in the early 90s, you had just one keypair and it was used for both encryption and signing. The ...
  • 1,636
26 votes
Accepted

GnuPG asks for a key ID when sharing my public key, what is that?

OpenPGP User IDs User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses....
  • 23.5k
25 votes
Accepted

Putting my PGP ID/link on printed business cards

Considering that your public key is only usable by a computer1; you can remove clutter from your business card by having all electronic data accessible online and referred to by a QR code. The link ...
25 votes
Accepted

How do GPG smart card devices handle large GPG operations?

The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
  • 40.3k
24 votes
Accepted

Is it possible to export a GPG subkey's public component?

RFC 4880, OpenPGP, 11.1. Transferable Public Keys defines subkey packets are always preceded by a public (primary) key, thus GnuPG does not allow to export it separately. To do so anyway, export the ...
  • 23.5k
24 votes
Accepted

Is there a limit on the layers of encryption a file can have?

Theoretically, there's no limit on the number of times you can encrypt a file. The output of an encryption process is again a file, which you can again pass it on to a different algorithm and get an ...
  • 4,438
22 votes

How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

There is no contradiction. Linus himself said in that same talk: If I have those 20 bytes, I can download a git repository from a completely untrusted source and I can guarantee that they did not ...
  • 4,315
22 votes
Accepted

GPG why is my trusted key not certified with a trusted signature?

The key needs to be verified. If you trust that someone's public key does in fact belong to that individual and they are in your keyring you can use your private key to sign your correspondent's ...
  • 7,669
22 votes
Accepted

GPG masterkey and subkey for encryption and signature and default keys

If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new ...
  • 6,238
21 votes
Accepted

What is the difference between "full" and "ultimate" trust?

Ultimate trust means that the key is allowed as introducer in the web of trust. This means, if a key is ultimately trusted, all certified keys are considered valid, no matter if there is a trust path ...
  • 23.5k
21 votes
Accepted

What is an OpenPGP Key ID collision?

They're referring to short key IDs, which are considered vulnerable to collision attacks for quite some time now. The problem is already referenced in RFC 4880, OpenPGP, 3.3. Key IDs: A Key ID is an ...
  • 23.5k
21 votes

How do I protect my OpenPGP key on my computer?

What's your threat model? If your threat is that you are protecting from physical theft, then encrypting the key (using passphrase) or full disk encryption would suffice. If your threat is a ...
  • 31.1k
20 votes
Accepted

How to change (sub)key usage of a PGP key?

Since GnuPG 2.2.6 there's a hidden key-edit subcommand "change-usage" which does exactly that. Relevant commit. Let's try this subcommand with a test key. Let's create one first: mkdir /tmp/gpg-...
  • 414
20 votes
Accepted

Where are the symmetric keys stored?

This is actually how PGP/GPG operates. When you encrypt something to a public key, it first encrypts the data with a symmetric key. Then it encrypts the symmetric key with public key cryptography, and ...
  • 12.9k
19 votes

Is layered encryption more secure than long passwords?

Imagine a Hollywood film where they're cracking a password or a security code, with all the spinning digits on a fancy UI, and they have elite hackers who crack one digit of the code at a time, and ...
  • 291

Only top scored, non community-wiki answers of a minimum length are eligible