The OpenPGP encrypted data format (RFC 4880), and its implementations PGP and GnuPG.
7
votes
1answer
190 views
Alice trusts Bob only when Bob trusts Alice
some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her.
Is this something ...
6
votes
4answers
485 views
Is compressing data prior to encryption necessary to reduce plaintext redundancy?
As explained in William Stallings' Book, in PGP encryption is done after compression, since it reduces redundancy.
I couldn't relate encryption strength with redundancy. Could anyone explain more on ...
6
votes
2answers
335 views
Is bcrypt better than GnupPG's iterated+salted hashing method?
GnuPG has slow hash built-in in form of iterated+salted S2K.
Does it have disadvantages in comparance with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
5
votes
1answer
348 views
Would RSA-encrypting a private key for itself constitute a vulnerability?
I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
5
votes
1answer
625 views
GPG symmetric encryption and javascript
I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server.
The user should then be able to take the encrypted result ...
5
votes
1answer
267 views
GPG/PGP Verification of Revocation
How does one verify a key revocation?
After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such:
...
4
votes
1answer
439 views
How does GPG verify succesful decryption?
How does GPG (or other programs using the OpenPGP file format) verify that it has succeeded with decryption (for symmetrically encrypted data)?
Is something appended to the clear text so there exist ...
4
votes
2answers
317 views
Is this a correctly formatted PGP session key packet?
RFC 4880 may be full of information, but it can be incredibly vague at times, so im looking for someone who actually knows the answer to this.
Given this public key:
...
4
votes
1answer
221 views
OpenPGP Signature Packet hashed data
RFC 4880 describes the version 4 signature packet, tag 2, as
...
4
votes
1answer
190 views
Length of data to hash for PGP
I have finally managed to verify some simple PGP signed message blocks. However, I discovered that for some reason, my implementation limits me to verifying data that is 9-16 bytes long. no less. no ...
3
votes
2answers
230 views
If Bob steals Alice's private key, how exactly would he read her encrypted documents?
So Bob grabs Alice's secret key when she isn't looking and her encrypted files, doesn't he need to know her passphrase to read her files?
What I am reading is that no he does not need it but as far ...
3
votes
2answers
69 views
GPG and PAR2 error correction data from the plain archive, will it compromise security?
I have the following scenario:
Archives compressed with 7z, hundreds of MiB in size
GPG to encrypt the archives (binary, without ASCII armor)
PAR2 to create error correction data
Question
1. ...
3
votes
3answers
130 views
Can I use PGP to sign a message without providing cryptographic non-repudation?
The difference between a digital signature and a MAC is non-repudiation. A message with a digital signature proves that only the sender could have signed the message, whereas a message with a MAC ...
2
votes
2answers
116 views
Is the “Signed on date” of a PGP Signature Verified?
I noticed that PGP signatures have a "signed on" field. I was wondering if this is "trustworthy" information and if so how is it accomplished.
For example, I can't see how it could be trusted ...
2
votes
2answers
1k views
How exactly would someone crack a private key passphrase?
Lets say for a PGP/GPG pair with a passphrase.
2
votes
1answer
78 views
Educational videos for security topics [closed]
Is there anything like the famous "sorting out sorting" video in cryptography/security.
I am looking for some nice videos that explaines SSL, SET, IPSec, PGP, S/MIME ....
2
votes
0answers
73 views
How to properly format a PGP Message Block?
As sort of a follow up to my (currently) unanswered question, if it is correct, how do i properly calculate and format the packet that actually stores the data being encrypted? I thought I knew what I ...
1
vote
2answers
280 views
How exactly are GPG keys mathematically related, and prime numbers inside of GPG general
Before anyone suggest it, I've yet to pick up "Applied Cryptography" I'm planning on picking it up the next time I visit amazon.
I know that the keys are somehow mathematically related, and I know ...
1
vote
3answers
209 views
two public keys with same passphrase insecure? | can two hashes be compared?
Suppose someone had generated a 2.048-Bit RSA GPG/PGP key pair and published the public key on the usual key servers. Then he withdraws this key and generates a new one in 4.096-Bit RSA using the same ...
1
vote
1answer
230 views
What algorithm does PGP use to encrypt email?
I know it uses RSA/DSA to create keys, but does it use that same algorithm for the actual cipher?
1
vote
2answers
88 views
When is each key used when encrypting an email using OpenPGP?
When you send an email using PGP to encrypt emails, is the recipients public key used to encrypt the email, or is your private key used? Are they both used?
At what points do each of the four keys ...
1
vote
1answer
74 views
Which public key was used. PGP
Is it possible to find out which public key was used to generate the message?
Scenario is like this :
I got data which is encrypted with a public key. Now a "bad guy" hast the encrypted data, and ...
1
vote
1answer
117 views
Generate an insecure public / private key pair
I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods.
As far as I know PGP ...
1
vote
1answer
180 views
OpenPGP Public-Key Encrypted Session Key Packet Key ID generation
Im probably just not reading something again, but:
RFC 4880 says that a OpenPGP Public-Key Encrypted Session Key Packet (tag 1) is made up of
...
1
vote
0answers
149 views
Proper formatting of symmetric algorithm secret key
Given this description from RFC 4880 sec 5.1:
The value "m" in the above formulas is derived from the session key as
follows. First, the session key is prefixed with a one-octet algorithm
...
0
votes
2answers
127 views
Does gpg's symmetric encryption keep information about the filename?
If I encrypt a file with gpg -c file.zip, and change the filename. Is there any way I can restore the filename as I used as a password. or the name encrypted to?
0
votes
1answer
61 views
GPG vs PGP vs OpenSSH and management of them
What is the main difference of the three?
Can I use only one of them for everything (e.g. GPG for SSH authentication)
If I encrypt my private key with a pass-phrase, is it strong enough so that if ...
