Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

What is the main difference of the three? Can I use only one of them for everything (e.g. GPG for SSH authentication)

If I encrypt my private key with a pass-phrase, is it strong enough so that if someone steals my laptop or private key, I'm safe?

If not, what about encrypting my private key with the scrypt algorithm?

share|improve this question

closed as off-topic by e-sushi, otus, DrLecter, Gilles, poncho Aug 19 at 2:37

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Probably belongs to security stack exchange. –  Jens Erat Mar 5 '13 at 14:24
    
I don't think so. It has to do entirely with the algorithms (except for the GPG/PGP part) –  ttouch Mar 5 '13 at 14:29
1  
In the FAQ I'm reading "to security.SE if you want to know what you should do now" and this question seems all about what to do, not about "the internals" of the algorithms. –  Jens Erat Mar 5 '13 at 14:44
1  
You mixed multiple independent questions here, which doesn't make it totally clear what to answer. scrypt is not an encryption algorithm. –  Paŭlo Ebermann Mar 5 '13 at 19:07
3  
This question appears to be off-topic according to our help center because it is about cryptographic software, not its cryptographic internals. –  e-sushi Aug 18 at 5:27

1 Answer 1

up vote 3 down vote accepted

What is the main difference of the three? Can I use only one of them for everything (e.g. GPG for SSH authentication)

  • GnuPG is an free and open-source implementation of the OpenPGP standard.
  • Symantec PGP is a proprietary implementation of the OpenPGP standard.
  • The OpenPGP standard defines ways to sign and encrypt information (like mail, other documents and code/software).
  • OpenSSH is about connection securely to remote computers. For authenticating you need some secret, usually this is a passphrase or SSH key.

With OpenPGP, you hold a secret (private key) which also can be used for authenticating yourself. It needs software support for that, and I haven't heard of some code doing this for (Symantec) PGP, but there is a way doing this with GnuPG.

If I encrypt my private key with a pass-phrase, is it strong enough so that if someone steals my laptop or private key, I'm safe?

Your password encrypts your private key. The key is safe as long as your password is safe. If your password is too weak (dictionary-attacks, not long enough, easy to brute-force for other reasons), your key is vulnerable, too.

Think about how valuable your key is for an attacker and choose fitting security measures like storing your key offline (in the and of this answer).

If not, what about encrypting my private key with the scrypt algorithm?

If doing so, security depends on the password you're using for scrypt and scrypt's algorithm. You can achieve the same amount of security with a good OpenPGP password, so there is no need for additionally encrypting your key.

share|improve this answer
    
Thank you! Just what I was searching for! –  ttouch Mar 5 '13 at 14:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.