Questions tagged [pgp]

The OpenPGP encrypted data format (RFC 4880), and its implementations PGP and GnuPG.

21 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
10
votes
0answers
297 views

What was the BassOmatic cipher, and what made it so weak?

According to Wikipedia, this homebrew cipher was originally used in PGP, before Phil Zimmermann replaced it with IDEA. Supposedly, insecurities in the algorithm were pointed out to him, leading to ...
6
votes
1answer
151 views

Why is recipient hashed in this Sign/Encrypt/Sign proposal?

Own research In my journey into trying to understand PGP, and public key signing and encryption as a whole, I came across this answer on CE. It is an answer to a question with the title: Should we ...
5
votes
0answers
83 views

Can a PGP subordinate key be used as a web of trust signing key?

I already understand the desire to segregate a PGP master key from subkeys, allowing me to keep the master key in some off-site non-networked location while making use of the subkeys to do things like ...
3
votes
0answers
70 views

Do people sign my subkey?

So, I've generated my GPG key pair. Created a subkey for signing and a subkey for encryption. Exported the whole thing, removed my master key pair to a secure place, re-imported only the subkeys. Now, ...
2
votes
0answers
25 views

What are some examples of out of bound channels that work over the Internet in practice?

If I want to verify a public key (be it RSA, PGP, etc.) with another client over the Internet only, what are some viable out-of-bound channels for verification? Which channels have been used in ...
2
votes
0answers
65 views

Concept for a RSA “repeater”. Is it sensible?

I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
2
votes
0answers
46 views

GPG Sub Key Renewal Questions

Last year, I followed this guide to create two GnuPG Smart Cards; one card with the Primary Key and the other card with the Sub-keys. I noticed that the sub keys were close to expiring so I renewed ...
2
votes
1answer
307 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
2
votes
0answers
58 views

How does OpenPGP handles situation when signatures on one OpenPGP key contradict each other?

For example, I was on a key signing party. After a party, one person signed my key with full trust and sent this signature to me by email. Then that person changed their mind and signed my key with ...
2
votes
0answers
193 views

encrypted file sharing protocol

I am trying to design a file exchange protocol for learning purposes, inspired by PGP, but fixing some of its shortcomings. Assuming the machine where the creation and decryption of the file happens ...
1
vote
1answer
51 views

Creating nested messages in OpenPGP

I need to create a nested message in OpenPGP (my understanding is that the protocol itself should support it). Let's say I have Payload ("Time in Lordran is ...
1
vote
0answers
64 views

Safest method for encrypting a file on a local machine

I am looking for a safe method to encrypt a local file on my machine. Let's say I have a file containing my logins and passwords -- how can I make sure that the encryption is reasonably sufficient in ...
1
vote
1answer
50 views

Message types in GPG

I am trying to check the part where messages are both encrypted and signed. But what is the difference between a message which looks like this ...
1
vote
0answers
320 views

GPG implementation of ECC “Encryption” (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
1
vote
0answers
56 views

PGP - MIME, is it correct?

I see following x.509 certificate attached(or may be signed, not sure) with OpenPGP key. Is that s/MIME certificate attached with PGP? What that does? Can this be created with GnuPG or probably, how ...
0
votes
1answer
41 views

Authenticated, Quantum-resistant GPG2?

GPG2 does not provide authentication. It still uses SHA-1 by default. It does not seem to get any stronger as time goes by. If one were to pass a randomly-generated symmetric key (from a TRNG) over ...
0
votes
1answer
34 views

Why should I export my private key instead of well known asymmetric crypto mechanism on openkeychain?

I'm trying to use password-store as password manager under linux. I created a private github repo with my gpg files in order to use it with other devices. I installed android-password-store app for ...
0
votes
0answers
38 views

Brute-forcing a PGPDisk (.PGD) encrypted file

I have some ~20 year old PGPDisk (.PGD) files for which I have long since lost the keys and/or passwords. I've written some GPU accelerated brute-forcing for OpenOffice / PBKDF2 in the past, so I ...
0
votes
0answers
23 views

Why is the key creation date part of the OpenPGP Key Fingerprint?

In Version 3 keys, the Key Fingerprint was defined as follows: The fingerprint of a V3 key is formed by hashing the body (but not the two-octet length) of the MPIs that form the key material (public ...
0
votes
2answers
156 views

Computing PGP ed25519 and curve25519 keygrips?

There are public key algorithmic differences for how PGP computes fingerprints and keygrips. For the v4 protocol, fingerprints are not exclusively computed from public keys while keygrips are. RFC ...
0
votes
0answers
83 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?