# Tag Info

9

I think you misunderstood a detail of PGP encryption. Only the random symmetric key is encrypted under the recipient's (asymmetric) public key. This way to encrypt stuff is quite common and is called KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method oy Hybrid Encryption. Some refs: en.wikipedia.org/wiki/Hybrid_cryptosystem and ...

9

A PGP encrypted message can be hundreds or even thousands of bytes. Encrypting and decrypting large amounts of data using asymmetric algorithms is extremely slow. Encrypting only 32 to 16 bytes (the symmetric key) is much faster. Additionally, if you encrypt the same message twice with an asymmetric algorithm, you will get the exact same ciphertext. Using ...

5

The basic explanation is that you need both keys to make a complete encryption/decryption cycle. Basically the encryption works with modulo arithmetic so that $$c=m^a \mod n$$ and $$m=c^b \mod n$$ where $a$ and $b$ are the public and private key of the algorithm. $m$ is the plain text message and $c$ s the ciphertext. The most important thing about the ...

5

This sounds like a fair exchange protocol where what is exchanged is a digital signature. Per this paper, these are impossible without trusted third parties. With a trusted third party, they are possible. Indeed people have proposed schemes that do what you describe again relying on a third party in the case of failure.

5

Use gpg --s2k-mode 3 --s2k-count N, where N is the number of iterations you want to use. The manual page says the default is 65536, and you can use any number between 1024 and 65011712. If you like to tweak the defaults, I suggest making this number as large as you can bear it, without introducing noticeable slowdown (e.g., ideal would be to make the ...

5

"Secure" is not a binary, black-and-white thing. Instead, it's about risk management. Instead of asking whether something is secure, it's better to ask whether it is "secure enough for such-and-such purpose". On the one hand, 1024-bit keys are uncomfortably close to what can be cracked, given lots of computational resources. On the other hand, for casual ...

4

Since your problem seems to be with the principle of public key crypto rather than with the math itself, here is an analogy with a physical object that may help. Take a key lock padlock as below: To close the padlock, you don't need the key, just the padlock itself. To open you use the key. Now, if Bob has a copy of Alice's padlock, he can send her a ...

4

Short answer: “No”. The latest research shows that compression actually harms security. "Reducing redundancy" is an outdated concept from the late 20th century. The intuition was that if our ciphers turned out to be weak, we might avoid a practical loss of confidentiality by giving attackers less information to work with. For example, in the following ...

4

Magic! Have a look at the wikipedia image from the PGP article. The magic behind how the whole thing works is using through the RSA algorithm. Let's say Alice wants to send an encrypted message to Bob. Bob generates a public and private key pair. How the key generation process works is through a whole bunch of mathematics. Essentially, this is how RSA ...

4

KEM/DEM hybrid encryption has another advantage. It enables a very efficient multi-recipient encryption. The payload is encrypted and transmitted only one time. Haven't you wondered yet why you are able to decrypt and read your own message although it was encrypted with the recipient's public key? Normally PGP encrypts the message key for symmetric ...

3

Would we also need some additional options/messages in GnuPG to make it clear when you might be looking at an "unauthenticated" signature? Hopefully I'm not stating the obvious. OpenPGP does not trust keys simply because lots of people have signed them. You must "set ownertrust" for the keys you have before they will be used in Web of Trust ...

3

You cannot remove all UIDs, but you can create one which does not link to your identity and remove all others. Backup your .gnupg folder (for unix systems, for Windows wherever your key is stored)! Start editing your key: $gpg --edit-key 47AB515A Create an anonymous UID: gpg> adduid Real name: Anonymous Email address: Comment: You selected this ... 3 Yes, your public key includes your UIDs. It may be possible to delete all before exporting though - for sure you could copy the key, add an "anonymous" UID and delete all others. As long as you're not signing the message, nobody will know who sent the message (but have a look at the mail or other headers!). 2 The answer (to the title question) is no, due to a slight mixup in terminology. What Moxie says is (emphasis added) if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom. Notice that he says MAC and not signature. The PGP group has discussed this too, so you are ... 2 A public PGP key (or "certificate") as seen on the key servers or in your PGP application is a bundle of several pieces of data: A public RSA key (i.e. modulus and public exponent) (or a public key for another signature scheme) – the main key. A bunch of user identities (name, mail address, etc.) for this public key maybe one or several sub keys (for the ... 2 If you can put the entire PGP certificate in a proprietary non-critical extension then you don't need to find the PGP certificate in a store. This solution depends on the condition that you are able to create your own OID and insert the PGP certificate in the extension. Furthermore, the server should accept such a certificate and contain methods of ... 2 The Tiger hash function is not part of the OpenPGP standard which GnuPG implements. A previous version of that standard (RFC 2440) had reserved an identifier for Tiger, but without actually standardizing it (no OID formally assigned). This was removed during elaboration of the next (current) version of OpenPGP, circa 2003, with apparent consensus, on the ... 2 It depends on the version of the GPG format. In V3 the Key ID it is indeed the bottom 64 bits of the modulus, but in V4 it's the bottom 64 bits of the key fingerprint, which in turn is the "SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field" according to the RFC. 2 You can use gpg --list-packets [keyfile] to see a list of all packets and their contents. All hash algorithms have numbers which you can look up in section 9.4 of RFC 4880, "Hash Algorithms". Alternatively, use pgpdump [keyfile] to create a similar output, but already containing the algorithm names instead of their numeric identifiers. 2 Yes, precisely because of what you're using PAR2 for. Anyone with the PAR2 data and most most of the compressed archives can easily calculate the rest of the compressed archives. (In fact, they wouldn't even need the encrypted data!) Yes, because anyone could calculate the error correction data from the encrypted data, without the encryption key. 2 GPG implements the OpenPGP standard RFC 4880, so it implements the String-to-Key Specifiers. 3.7. String-to-Key (S2K) Specifiers String-to-key (S2K) specifiers are used to convert passphrase strings into symmetric-key encryption/decryption keys. They are used in two places, currently: to encrypt the secret part of private keys in the ... 2 If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases? No, they are not 100% compatible in all use cases, because - depending on the PGP version - there are known interoperability problems. Did you do any research before asking? I mean, the GNUPG FAQ answers this question already... Is GnuPG compatible with PGP? ... 2 I'm assuming Bob uses the standard format, OpenPGP aka RFC4880, to store his private key in a private keyfile. If the adversary Eve somehow obtains Bob's private keyfile, and the passphrase on that keyfile is so short and weak that the adversary breaks it with a dictionary attack or brute force, then -- Things are very bad for Bob. Bob's best choice of ... 1 Digital signatures provide authentication, data integrity and non-repudiation. Thus, you are right to say that the authentication check is also basically an integrity check. If it didn't have an integrity check (i.e. no digital signatures) then you cannot be sure that the message you received is the original and unmodified version sent by the claimed sender. ... 1 (Open)PGP is a hybrid encryption system, it uses both public/private and symmetric key encryption. Public/private key encryption is very inefficient for any kind of data but very small one, so when encrypting for some private key, usually you're only encrypting some block cipher which is then used to actually encrypt the data. For generating this key, a ... 1 The first few bytes are the PGP header. They encode the format information, encryption algorithms and the recipient(s) key id. The recipient must know which key to use and how GPG/PGP has encrypted the session key and payload and how the MAC was generated. Like TLS/SSL the OpenPGP standard has a couple of cipher suites and hash algorithms. The format is ... 1 The link in the question appears to be dead. So the question of parameters for that library might be irrelevant. But there are other options to achieve the end result of gpg symmetric encryption in JavaScript. Another answer suggests Herbert Hanewinkel's JavaScript implementation of OpenPGP. That isn't going to work for symmetric encryption. But last year, ... 1 http://security.stackexchange.com/questions/25170/what-information-is-leaked-from-an-openpgp-encrypted-file${\color{white}{This text is supposed to be white, and will hopefully be enough to keep it here rather than being made into a comment.}}\$

1

You could GPG-encrypt both the .7z archive and the PAR2 error-correction data. That will take care of the security issues. Alternatively, you could compute the PAR2 error-correction data on the results of the GPG encryption, for the reasons Ricky Demer explains. That would be secure too. Either one works.

Only top voted, non community-wiki answers of a minimum length are eligible