52
votes
Accepted
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23:
From: https://help.github.com/articles/about-gpg/
GitHub will automatically sign commits you make ...
- 1,680
48
votes
Accepted
How to raise a key to ultimate trust on another machine?
You can set every key to ultimate trust through opening the key edit command line
gpg --edit-key [key-id]
and running the trust command. You will now be prompted to select the trust level:
Please ...
- 24.4k
33
votes
What actions should I, as an end user, take in response to EFAIL?
Notably, PGP is not the problem. The problem lies with the mail handling apps in your browser which you have allowed to use your PGP keys. Those browser apps decrypt the message as they should, but ...
- 425
28
votes
Accepted
What exactly is a subkey?
This post by user rjh from 2008 in the enigmail forum answers it well:
Originally in PGP 2.6, back in the early 90s, you had just one keypair
and it was used for both encryption and signing. The ...
- 1,726
24
votes
Accepted
GPG masterkey and subkey for encryption and signature and default keys
If you already have an SC and E keys, and you want to remove your C ("master") key to offline storage, then all you require is a new S key (SSK1 in your example). You do not need to create a new ...
- 6,418
16
votes
Accepted
Verify a key was signed by another key
Checking a key is signed
The short answer is that you use the command gpg --list-sig <key id>.
For example, I went to the site you listed above and downloaded the qubes release 2 signing key. ...
- 326
14
votes
Accepted
What is the meaning of GnuPG's --list-sigs output?
Certification Levels
There are different classes of certifications. Quoting RFC 4880, OpenPGP, 5.2.1. Signature Types:
[...]
0x10: Generic certification of a User ID and Public-Key packet.
The ...
- 24.4k
14
votes
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
To add to @Jonathan Cross's answer...
Signature rules
When will GitHub sign commits
GitHub will sign commits made using the web UI
GitHub will sign standard merges made using the web UI
GitHub will ...
- 3,197
12
votes
Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation?
Apart from the fact you'd better not deploy custom crypto code anyway, you're reinventing the wheel. OpenPGP's string-to-key functionality is configurable and can be adjusted to your needs, while not ...
- 24.4k
11
votes
How to raise a key to ultimate trust on another machine?
To change the Ownertrust trust level of a key after importing in a simplier way (without the interactive --edit-key mode) I found this way in one line using gpg --import-ownertrust:
According to this ...
- 111
11
votes
What actions should I, as an end user, take in response to EFAIL?
Disable HTML rendering. (Not HTML sending: HTML rendering. It doesn't matter what mail you send; what matters is what your mailer does on receipt of the adversary's mail.)
Consider configuring your ...
- 2,656
10
votes
Accepted
Is using PGP/MIME or PGP Inline more secure?
What is the most and least secure way of going about encrypting emails?
There is no difference in security: both use the same cryptographic principles, they just use another method of embedding ...
- 24.4k
10
votes
Does GnuPG use symmetric + public key encryption for large files?
OpenPGP always applies hybrid encryption (no matter how small the file/message is), thus encrypts the message using symmetric encryption and a session key, which again is encrypted using one or more ...
- 24.4k
10
votes
Accepted
How do I delete secret subkeys correctly?
As explained by Peter Lebbing and Daniel Kahn Gillmor on the mailing list, the answer for gpg 2.2.15 is to ask gpg-agent to delete the secret subkey.
# Obtain the keygrip of the subkey you want to ...
- 411
8
votes
Accepted
Is the OpenPGP implementation of the YubiKey 4 Open Source?
No, the Yubikey 4 is not Open Source:
The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to ...
- 1,680
8
votes
Why am I asked personal information when creating an OpenPGP key?
First of all, you don't need to enter them, or you can enter false ones if you like, so go ahead and do so if you so prefer. (You may need to read up on the options to disable the fields.)
But the ...
- 10.6k
8
votes
Why am I asked personal information when creating an OpenPGP key?
OpenPGP Includes Key Management
From the introduction to RFC 4880, OpenPGP (highlighting added be me):
OpenPGP software uses a combination of strong public-key and
symmetric cryptography to provide ...
- 24.4k
8
votes
Accepted
How to tell if a "PGP PRIVATE KEY BLOCK" is passphrase protected?
Is this passphrase-protected? There's a high probability it is!
How can I know if this is passphrase-protected?
Simply enough: import the exported key and try to use it; if it was originally ...
- 18.7k
8
votes
What actions should I, as an end user, take in response to EFAIL?
There is another solution apart from disabling HTML rendering - which you nonetheless should.
This is a list of affected clients and webmailers1:
The efail attack in its current form relies first ...
- 7,955
7
votes
Verify a key was signed by another key
Proper verification of key signatures is performed with --check-signatures like so:
$ gpg --check-signatures
pub rsa4096 2017-03-06 [SC]
5817A43B283DE5A9181A522E1848792F9E2795E9
uid ...
- 181
7
votes
What is the purpose and meaning of the --sig-notation and --cert-notation options in GnuPG?
Notations provide meanings to add information to a signature or certification (which also is a special kind of signature). From RFC 4880, 5.2.3.16. Notation Data:
This subpacket describes a "...
- 24.4k
7
votes
Accepted
Should I add picture(s) to my OpenPGP key?
Pictures would add additional information on your identity: similar to providing information on your name, location, place and date of birth, they might help others in identifying you (and ...
- 24.4k
7
votes
How does GnuPG know the initialization vector for decryption?
OpenPGP does not really use an initialization vector (it is defined to be all-zero). Instead, it uses a block of random data afterwards, which takes the role of the initialization vector in the ...
- 24.4k
7
votes
What is the meaning of GnuPG's --list-sigs output?
Trying to clarify some of the details from Jens Erat's post in human language:
" " => 0x00 Generic certification: does not make any particular ownership assertion
"1" => 0x11 Persona ...
- 275
7
votes
Can I encrypt with GnuPG and decrypt with OpenSSL?
OpenSSL implements the X.509 standard, while GnuPG implements OpenPGP. While both use mostly the same cryptographic algorithms with lots of overlap, both protocols have their own file formats and ...
- 24.4k
7
votes
Accepted
How does a private OpenPGP key's passphrase add to its security?
If you have an encrypted private key, this means a private key was generated from random numbers and then symmetrically encrypted using your passphrase. With other words, the private key is not ...
- 24.4k
7
votes
How do I delete secret subkeys correctly?
As of gpg 2.2.19 (maybe earlier versions too) --delete-secret-keys (and --delete-keys, --delete-secret-and-public-key) works as expected and deletes only a subkey if the fingerprint of the subkey ...
7
votes
gpg: Every private key export (of the same key-pair) is different
The exported private keys are encrypted using a password (by default, at least). This means that the private parameters have been encrypted with a key derived from that password plus a randomly ...
- 1,156
6
votes
Accepted
How to verify email addresses in GnuPG UIDs?
The most common case I've seen so far is to sign the key and then send the signed key (well, just the single signature) via e-mail to the purported e-mail address. If there's more than one e-mail ...
- 176
6
votes
Accepted
Is there use for GPG/PGP for casual people who are simply concerned for their privacy?
nor is communicating with people who are willing to use GPG
PGP/GPG or S/MIME provide end to end encryption and tamper resistance. But to offer this it needs to be used by both ends of the ...
- 198k
Only top scored, non community-wiki answers of a minimum length are eligible