# Tag Info

11

If Bob does NOT care to check signatures (as in the question), Eve can send ANY message she wants to Bob pretending to be Alice, including but not limited to messages Eve got from Alice; all Eve needs is Bob's public key (which, as the name implies, is assumed public knowledge thus known to Eve) and straight use of PGP. Therefore the right question is: Can ...

9

I think you misunderstood a detail of PGP encryption. Only the random symmetric key is encrypted under the recipient's (asymmetric) public key. This way to encrypt stuff is quite common and is called KEM/DEM paradigm: Key Encapsulation Method/Data Encapsulation Method oy Hybrid Encryption. Some refs: en.wikipedia.org/wiki/Hybrid_cryptosystem and ...

9

A PGP encrypted message can be hundreds or even thousands of bytes. Encrypting and decrypting large amounts of data using asymmetric algorithms is extremely slow. Encrypting only 32 to 16 bytes (the symmetric key) is much faster. Additionally, if you encrypt the same message twice with an asymmetric algorithm, you will get the exact same ciphertext. Using ...

6

So your protocol goes like this: Alice generates a key pair $(a_{priv}, a_{pub})$ and sends $a_{pub}$ to Bob. Bob generates a key pair $(b_{priv}, b_{pub})$ and sends $b_{pub}$ to Alice. Alice generates a message $m$ and sends $Enc(Sign(m, a_{priv}), b_{pub})$ (or $Sign(Enc(m, b_{pub}), a_{priv})$, I'm not sure which of both is usually used by PGP) to Bob. ...

6

OpenPGP as defined by RFC 4880 knows two different encodings. Binary encoding Obviously, there is no reasonable limitation to an (ASCII) character subset in binary encoding. Radix 64 Radix 64 is also often entitled ASCII armored. In the end, it is a base64 encoding with a checksum. The content may consist of [a-zA-Y0-0+/=]. ASCII-armored OpenPGP ...

5

Use gpg --s2k-mode 3 --s2k-count N, where N is the number of iterations you want to use. The manual page says the default is 65536, and you can use any number between 1024 and 65011712. If you like to tweak the defaults, I suggest making this number as large as you can bear it, without introducing noticeable slowdown (e.g., ideal would be to make the ...

5

"If PGP and GPG both follow the OpenPGP standard, are they 100% compatible in all use cases?" No, they are not 100% compatible in all use cases, because — depending on the PGP version — there are known interoperability problems. The GNUPG FAQ answers this question quite well: Is GnuPG compatible with PGP? In general, yes. GnuPG and newer PGP ...

4

KEM/DEM hybrid encryption has another advantage. It enables a very efficient multi-recipient encryption. The payload is encrypted and transmitted only one time. Haven't you wondered yet why you are able to decrypt and read your own message although it was encrypted with the recipient's public key? Normally PGP encrypts the message key for symmetric ...

3

Would we also need some additional options/messages in GnuPG to make it clear when you might be looking at an "unauthenticated" signature? Hopefully I'm not stating the obvious. OpenPGP does not trust keys simply because lots of people have signed them. You must "set ownertrust" for the keys you have before they will be used in Web of Trust ...

3

Digital signatures provide authentication, data integrity and non-repudiation. Thus, you are right to say that the authentication check is also basically an integrity check. If it didn't have an integrity check (i.e. no digital signatures) then you cannot be sure that the message you received is the original and unmodified version sent by the claimed sender. ...

2

If you can put the entire PGP certificate in a proprietary non-critical extension then you don't need to find the PGP certificate in a store. This solution depends on the condition that you are able to create your own OID and insert the PGP certificate in the extension. Furthermore, the server should accept such a certificate and contain methods of ...

2

The Tiger hash function is not part of the OpenPGP standard which GnuPG implements. A previous version of that standard (RFC 2440) had reserved an identifier for Tiger, but without actually standardizing it (no OID formally assigned). This was removed during elaboration of the next (current) version of OpenPGP, circa 2003, with apparent consensus, on the ...

2

It depends on the version of the GPG format. In V3 the Key ID it is indeed the bottom 64 bits of the modulus, but in V4 it's the bottom 64 bits of the key fingerprint, which in turn is the "SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field" according to the RFC.

2

The usual recommendation is ECDSA, or if you need a really short signature, BLS. See “Security.SE: What asymetric scheme provides the shortest signature, while being secure?”, “Security.SE: How to encrypt a short string to a short ciphertext using an asymmetric encryption?”, and “Crypto.SE: Short length asymmetric encryption?” for details. ECDSA should ...

2

From my recent experience, it's not always compatible. Using the latest version of GnuPG and Symantec PGP, I was able to confirm at least the fact that a 16384-bit RSA key pair (with 4096-bit subkeys) generated in GnuPG will not be usable in Symantec PGP. All of the cipher, hash algorithm, and compression preferences will be displayed as none, the expiry ...

2

I'm assuming Bob uses the standard format, OpenPGP aka RFC4880, to store his private key in a private keyfile. If the adversary Eve somehow obtains Bob's private keyfile, and the passphrase on that keyfile is so short and weak that the adversary breaks it with a dictionary attack or brute force, then -- Things are very bad for Bob. Bob's best choice of ...

2

You can use gpg --list-packets [keyfile] to see a list of all packets and their contents. All hash algorithms have numbers which you can look up in section 9.4 of RFC 4880, "Hash Algorithms". Alternatively, use pgpdump [keyfile] to create a similar output, but already containing the algorithm names instead of their numeric identifiers.

2

GPG implements the OpenPGP standard RFC 4880, so it implements the String-to-Key Specifiers. 3.7. String-to-Key (S2K) Specifiers String-to-key (S2K) specifiers are used to convert passphrase strings into symmetric-key encryption/decryption keys. They are used in two places, currently: to encrypt the secret part of private keys in the ...

1

GPG is an implementation of OpenPGP, which is a higher level protocol than e.g. mcrypt. So use GPG for PGP compatibility and mcrypt or related libraries for more direct - lower level - access to algorithms. AES is Rijndael for a block size of 128 bits and the 128, 192 or 256 bit key sizes. So you are OK there. Learn about modes of operation and something ...

1

In the case of emails your solution is not really practical. The problem is that the sender of an email uses the public key whereas the receiver should have the secret key. This means that whenever somebody wants to send you an email (and therefore generate a new key) you have to be online or you have to provide a set of pre-computed key pairs. If multiple ...

1

(Open)PGP is a hybrid encryption system, it uses both public/private and symmetric key encryption. Public/private key encryption is very inefficient for any kind of data but very small one, so when encrypting for some private key, usually you're only encrypting some block cipher which is then used to actually encrypt the data. For generating this key, a ...

1

No, in general re-using keys is not advisable. Even if you would have a secure token then it would be better to have multiple keys stored in it. In general the level of security required for certificate authorities is higher than the security required for personal use of a key. If you later want to your CA key within a smart card or HSM then it should also ...

1

The link in the question appears to be dead. So the question of parameters for that library might be irrelevant. But there are other options to achieve the end result of gpg symmetric encryption in JavaScript. Another answer suggests Herbert Hanewinkel's JavaScript implementation of OpenPGP. That isn't going to work for symmetric encryption. But last year, ...

1

The first few bytes are the PGP header. They encode the format information, encryption algorithms and the recipient(s) key id. The recipient must know which key to use and how GPG/PGP has encrypted the session key and payload and how the MAC was generated. Like TLS/SSL the OpenPGP standard has a couple of cipher suites and hash algorithms. The format is ...

1

This procedure, also called signing a message, does not encrypt the message itself, thus does not ensure it cannot be read by others. Instead, a hash sum of the message is encrypted using the private key. For verifying, the recipient again calculates the hash sum of the message, and decrypts the hash sum calculated by the sender using the sender's public ...

Only top voted, non community-wiki answers of a minimum length are eligible