New answers tagged

1

One possible attack is Chosen-plaintext attack. The oracle/blackbox would be the Git signatures. Consensus I found on the practicality is close to zero. And the gnupg folks even default the main key to Certify and Sign, which might show some confidence on their signing methods being able to isolate any key reversal. Though everyone suggest to not sign/...


0

As you have identified, hashing does not verify who created the data, but GPG signing does. You are also correct that an attacker could also put their own GPG keys next to the compromised download, and it would be no good to verify the download. However, you would be protected in the following scenarios: The key fingerprint can be confirmed somewhere else; ...


1

While not explicitly stated, apparently --export-minimal drops expired subkeys, which make sense. The option you need is probably self-sigs-only. However, that is a filter only for import. We would need to use an intermediate keyring for that TEMPORARY_KEYRING=`mktemp -d --tmpdir` gpg --armor --export keyid | GNUPGHOME="$TEMPORARY_KEYRING" gpg --...


0

This message can also happen if your key is protected with a passphrase, and your pinentry program isn't working properly. In this case, gpg can't get the passphrase to unlock the decryption key. If this is the case, gpg --list-keys will show the correct key, but gpg -d -v will appear to select the correct key and then just hang for a while before giving up. ...


0

I got the error gpg: decryption failed: No secret key when trying to decrypt a message that I encrypted for someone else. To be able to decrypt it, I had to encrypt the message using --recipient parameter 2 times with both the receiver and sender ID (https://stackoverflow.com/questions/597188/encryption-decryption-with-multiple-keys).


Top 50 recent answers are included