New answers tagged

1 vote
Accepted

How to generate an expired key with gpg?

You can set an expiration timestamp (in UTC) by typing something like “20220623T223000” for June 23rd, 2022, 22:30:00 UTC. GnuPG will still consider that expiration timestamps in the past are invalid. ...
user avatar
2 votes
Accepted

can these encryption methods for a text file protect against physical access to machine by adversary?

The information in the script should be sufficiently protected by the proposed encrypted provided that it is properly implemented and all access is done before the adversary gets access to the device ...
user avatar
3 votes
Accepted

deleted a subkey and can now no longer decrypt

Assuming you're using version 2 of GnuPG, the secret subkey should still be in your gnupg private-keys-v1.d subdirectory, but it's just a free-floating file and GnuPG isn't associating it with any key ...
user avatar
  • 6,163
3 votes

Is it normal, that some companies just sign the txt file which contains the sha value of the program?

In general, it's fine to provide a signed manifest file with hashes instead of individual signed files. Kernel.org, along with many other projects, do this, often by signing the output of something ...
user avatar
  • 6,895
1 vote

Is it normal, that some companies just sign the txt file which contains the sha value of the program?

You did not mention who is an adversary and their capabilities; Scenario A: Suppose I have an .exe file, the provider offers a sha1 txt file with hash value and this txt file is gpg signed. So I ...
user avatar
  • 5,389
1 vote

Is it normal, that some companies just sign the txt file which contains the sha value of the program?

They are basically the same. On both scenarios, an attacker have to change two files to make you download a tainted executable. On scenario A, it's the executable and the text file. On scenario B, the ...
user avatar
  • 50.3k
3 votes
Accepted

Best practices for verifying authenticity of public key

Authentication of public keys sent over an insecure network is generally done through one of the following methods Public Key Infrastructure (PKI). We rely on certificate authorities (CA's) to ...
user avatar
  • 19.6k
1 vote

Why a public key must be signed with its private pair in PGP

There are a couple reasons that self-signing is important in OpenPGP: First, user IDs and photos aren't attached to the key any other way. As a result, it's entirely possible for someone to attach a ...
user avatar
  • 6,895
3 votes
Accepted

Why are key IDs typically the *last* digits of the key hash?

What you've mentioned, that the key ID is the last portion of the hash, is true of v4 OpenPGP keys. However, before that, there were v2 and v3 keys (which were functionally identical) which are ...
user avatar
  • 6,895

Top 50 recent answers are included