Hot answers tagged

61 votes
Accepted

Is the software that uses PGP broken, or is it PGP itself?

Usenix Paper, replacing earlier draft at efail.de. TL;DR: the vulnerability is in some popular email client software, often combined with an extension simplifying the use of an OpenPGP (e.g. GnuPG) or ...
fgrieu's user avatar
  • 140k
53 votes

Is the software that uses PGP broken, or is it PGP itself?

There are a few parts to the EFAIL attacks. Some parts are the fault of the mailer authors for exposing unnecessary attack surface via arbitrary incoming email. Some parts are the fault of the ...
Squeamish Ossifrage's user avatar
25 votes
Accepted

Why did TLS 1.3 prohibit PGP authentication?

It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place): ...
Maarten Bodewes's user avatar
  • 92.3k
24 votes
Accepted

Why is there the option to use NIST P-256 in GPG?

Because P-256 is the most used elliptic curve and there are no certain reasons to believe it's insecure. It's the first standardized curve at the 128 bit security level (which is very popular). The ...
Ruggero's user avatar
  • 7,014
23 votes
Accepted

Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
Squeamish Ossifrage's user avatar
19 votes
Accepted

What exactly does s2k do in gpg

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
Thomas Pornin's user avatar
19 votes
Accepted

Why is Curve25519 in the GPG “expert” options?

The risk mainly resides in compatibility. See, not all GPG users/systems are updated to the latest version. If you look at the GPG changelogs, you'll notice ECC was first introduced to GPG with ...
e-sushi's user avatar
  • 17.9k
18 votes
Accepted

Why are NIST curves still used?

This is a though question that is surfing at the limits of meta/political wars within the cryptography community. SafeCurves is a good resource, but it's very opinionated about what "safe" ...
Lery's user avatar
  • 7,649
16 votes
Accepted

Why does gnupg create 4 separate keys and what does sub and ssb mean?

The abbreviations stand for the following: pub -- public primary key sub -- public sub-key ...
kinnla's user avatar
  • 276
15 votes
Accepted

Do PGP keys with expiration date set expiration date in Encrypted messages too?

It is the keypair that is doing the encrypting, not the one doing the decrypting, that the expiration date applies to. And yes, they will be able to decrypt it after one week. In fact, they will ...
forest's user avatar
  • 15.2k
12 votes
Accepted

Why does "gpg --export-secret-keys" ask for a password?

man gpg... GnuPG may ask you to enter the passphrase for the key. This is required because the internal protection method of the secret key is different from ...
hut's user avatar
  • 329
12 votes
Accepted

Is unusual (non power-of-two) RSA key size more secure?

From this answer: The difficulty of factoring (thus, as far as we know, the security of RSA in the absence of side-channel and padding attacks) grows smoothly with $n$. So, if factoring is the ...
mikeazo's user avatar
  • 38.5k
12 votes
Accepted

Reverse engineering secret key in RSA encryption with the help of signature

In RSA, assuming knowledge of the public key but not the private key, analyzing any number of triplets of matching message, encrypted message, and signature $(m,M,sg)$, does not help (as far as we ...
fgrieu's user avatar
  • 140k
12 votes
Accepted

How is the session key more secure than the public key?

From my understanding, if an attacker is able to decrypt a session key which was encrypted through a public key, then the attacker practically has the corresponding private key pair. Effectively yes, ...
SEJPM's user avatar
  • 45.9k
10 votes
Accepted

What are the security risks in making a passphrase-encrypted private key public?

From the manual of GnuPG: To help safeguard your key, GnuPG does not store your raw private key on disk. Instead it encrypts it using a symmetric encryption algorithm. That is why you need a ...
Biv's user avatar
  • 9,979
10 votes

How does one verify a GPG/PGP key revocation?

How does one verify a key revocation? As Jon Callas already stated: you simply don’t. In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/...
e-sushi's user avatar
  • 17.9k
9 votes

Why does OpenPGP encryption produce different ciphertexts from the same plain text?

OpenPGP is a hybrid cryptosystem. The actual message is encrypted applying a symmetric cipher like AES with a random session key. This session key again is encrypted using a public/private key ...
Jens Erat's user avatar
  • 1,333
9 votes

How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to guess the passphrase or compromise the machine used to perform encryption and decryption. Guessing the passphrase ...
fgrieu's user avatar
  • 140k
8 votes

How does gpg know what cipher algorithm is needed for decryption?

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5? The OpenPGP Symmetric-Key Encrypted ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

How to generate fingerprint for PGP public key

Your fingerprint is for OpenPGP V4 compatible as it uses SHA-1. The fingerprint is 20 bytes instead of 16 for MD5 used in the older package format. For V4 it is required to extract the public key ...
Maarten Bodewes's user avatar
  • 92.3k
7 votes
Accepted

Different kind of PGP keys or IDs, how to interpret them?

Exchanging full RSA keys can be very inconvenient, as they consist of very long numbers. In the OpenPGP ASCII-armored version, my public key (without any user IDs and certifications!) already is very ...
Jens Erat's user avatar
  • 1,333
7 votes

Why does OpenPGP encryption produce different ciphertexts from the same plain text?

It is desirable that an encryption scheme produce different ciphertexts from the same plaintext; if that's not the case, it its trivial to check if two plaintexts are identical, which is a potentially ...
fgrieu's user avatar
  • 140k
7 votes

Why is there the option to use NIST P-256 in GPG?

Daniel J. Bernstein's Safe Curves page has most of the info you want. To summarize: 1) Because it is approved for use by the US government, and they require the use of approved curves when ...
SAI Peregrinus's user avatar
7 votes
Accepted

Why do people use protocols like PGP, when TLS already exists?

These are different protocols and they serve different purposes. TLS is an online protocol between two different parties. It's designed to ensure the security of a connection between two endpoints of ...
bk2204's user avatar
  • 3,046
6 votes
Accepted

What do GnuPG sign-only keys mean?

Actually there are even more possible options if you use the --expert flag in GnuPG: ...
Lery's user avatar
  • 7,649
6 votes

What was the BassOmatic cipher, and what made it so weak?

Phil Zimmermann did not use DES or the RSA-owned RC-2 as models for the Bass-O-Matic cipher. For the basis of that symmetric cipher, he used the work of a man named Charlie Merritt. Zimmermann's ...
Patriot's user avatar
  • 3,132
6 votes
Accepted

libsodium vs gnupg curve25519 compatibility

Found the solution. All that was needed was to reverse the bytes in the curve25519 secret point. Apparantly PGP uses little-endian for this, while ed25519 uses big-endian.
Martijn Otto's user avatar
5 votes
Accepted

Binary format of encrypted PGP private key?

PGP key formats are defined in RFC 4880. Specifically, section 5.5. The private key format includes the public key and quite a bit of other information in unencrypted form. It might be easier to add ...
otus's user avatar
  • 32.1k
5 votes

Are the metadata encrypted by PGP?

The secondary data or metadata are stored in plaintext. Should you receive an encrypted mail by pgp, you will notice that you have 2 files attached: noname.pgp and ...
Biv's user avatar
  • 9,979
5 votes
Accepted

Is a chosen ciphertext attack on PGP still possible?

RFC 4880, OpenPGP (superseded RFC 2440 which was up to date in 2002) contains a chapter on security considerations, which also discusses the decryption oracle attack Jallad et al described: In late ...
Jens Erat's user avatar
  • 1,333

Only top scored, non community-wiki answers of a minimum length are eligible