59
votes
Accepted
Is the software that uses PGP broken, or is it PGP itself?
Usenix Paper, replacing earlier draft at efail.de.
TL;DR: the vulnerability is in some popular email client software, often combined with an extension simplifying the use of an OpenPGP (e.g. GnuPG) or ...
- 137k
51
votes
Is the software that uses PGP broken, or is it PGP itself?
There are a few parts to the EFAIL attacks.
Some parts are the fault of the mailer authors for exposing unnecessary attack surface via arbitrary incoming email. Some parts are the fault of the ...
- 47.5k
25
votes
Accepted
Why did TLS 1.3 prohibit PGP authentication?
It seems that PGP certificates have the problem that they can be changed by the user. Furthermore, there were extensions for 1.2 that are incompatible for 1.3 (if they were secure in the first place):
...
- 91.1k
24
votes
Accepted
Why is there the option to use NIST P-256 in GPG?
Because P-256 is the most used elliptic curve and there are no certain reasons to believe it's insecure.
It's the first standardized curve at the 128 bit security level (which is very popular).
The ...
- 6,864
23
votes
Accepted
Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?
Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated ...
- 47.5k
19
votes
Accepted
What exactly does s2k do in gpg
The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
- 86.4k
17
votes
Accepted
Why is Curve25519 in the GPG “expert” options?
The risk mainly resides in compatibility.
See, not all GPG users/systems are updated to the latest version. If you look at the GPG changelogs, you'll notice ECC was first introduced to GPG with ...
- 17.7k
17
votes
Accepted
Why are NIST curves still used?
This is a though question that is surfing at the limits of meta/political wars within the cryptography community.
SafeCurves is a good resource, but it's very opinionated about what "safe" ...
- 7,579
15
votes
Accepted
Why does gnupg create 4 separate keys and what does sub and ssb mean?
The abbreviations stand for the following:
pub -- public primary key
sub -- public sub-key
...
- 266
14
votes
Accepted
Do PGP keys with expiration date set expiration date in Encrypted messages too?
It is the keypair that is doing the encrypting, not the one doing the decrypting, that the expiration date applies to. And yes, they will be able to decrypt it after one week. In fact, they will ...
- 15k
12
votes
Accepted
Why does "gpg --export-secret-keys" ask for a password?
man gpg...
GnuPG may ask you to enter the passphrase for the key. This is required because the internal protection method of the secret key is different from ...
- 329
12
votes
Accepted
Is unusual (non power-of-two) RSA key size more secure?
From this answer:
The difficulty of factoring (thus, as far as we know, the security of RSA in the absence of side-channel and padding attacks) grows smoothly with $n$.
So, if factoring is the ...
- 38.4k
12
votes
Accepted
How is the session key more secure than the public key?
From my understanding, if an attacker is able to decrypt a session key which was encrypted through a public key, then the attacker practically has the corresponding private key pair.
Effectively yes, ...
- 45.6k
11
votes
Accepted
Reverse engineering secret key in RSA encryption with the help of signature
In RSA, assuming knowledge of the public key but not the private key, analyzing any number of triplets of matching message, encrypted message, and signature $(m,M,sg)$, does not help (as far as we ...
- 137k
10
votes
How does one verify a GPG/PGP key revocation?
How does one verify a key revocation?
As Jon Callas already stated: you simply don’t.
In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/...
- 17.7k
10
votes
Accepted
What are the security risks in making a passphrase-encrypted private key public?
From the manual of GnuPG:
To help safeguard your key, GnuPG does not store your raw private key on disk. Instead it encrypts it using a symmetric encryption algorithm. That is why you need a ...
- 9,959
9
votes
Why does OpenPGP encryption produce different ciphertexts from the same plain text?
OpenPGP is a hybrid cryptosystem. The actual message is encrypted applying a symmetric cipher like AES with a random session key. This session key again is encrypted using a public/private key ...
- 1,313
9
votes
How Secure is gpg Command Using Symmetric AES-256 From Being Cracked
GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to
guess the passphrase
or compromise the machine used to perform encryption and decryption.
Guessing the passphrase ...
- 137k
8
votes
How does gpg know what cipher algorithm is needed for decryption?
how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5?
The OpenPGP Symmetric-Key Encrypted ...
- 47.5k
7
votes
Accepted
How to generate fingerprint for PGP public key
Your fingerprint is for OpenPGP V4 compatible as it uses SHA-1. The fingerprint is 20 bytes instead of 16 for MD5 used in the older package format.
For V4 it is required to extract the public key ...
- 91.1k
7
votes
Why does OpenPGP encryption produce different ciphertexts from the same plain text?
It is desirable that an encryption scheme produce different ciphertexts from the same plaintext; if that's not the case, it its trivial to check if two plaintexts are identical, which is a potentially ...
- 137k
7
votes
Accepted
Different kind of PGP keys or IDs, how to interpret them?
Exchanging full RSA keys can be very inconvenient, as they consist of very long numbers. In the OpenPGP ASCII-armored version, my public key (without any user IDs and certifications!) already is very ...
- 1,313
7
votes
Why is there the option to use NIST P-256 in GPG?
Daniel J. Bernstein's Safe Curves page has most of the info you want. To summarize:
1) Because it is approved for use by the US government, and they require the use of approved curves when ...
- 5,716
6
votes
Accepted
What do GnuPG sign-only keys mean?
Actually there are even more possible options if you use the --expert flag in GnuPG:
...
- 7,579
6
votes
What was the BassOmatic cipher, and what made it so weak?
Phil Zimmermann did not use DES or the RSA-owned RC-2 as models for the Bass-O-Matic cipher.
For the basis of that symmetric cipher, he used the work of a man named Charlie Merritt. Zimmermann's ...
- 3,102
6
votes
Accepted
libsodium vs gnupg curve25519 compatibility
Found the solution. All that was needed was to reverse the bytes in the curve25519 secret point. Apparantly PGP uses little-endian for this, while ed25519 uses big-endian.
- 171
6
votes
Accepted
Why do people use protocols like PGP, when TLS already exists?
These are different protocols and they serve different purposes.
TLS is an online protocol between two different parties. It's designed to ensure the security of a connection between two endpoints of ...
- 2,901
5
votes
Accepted
Is a chosen ciphertext attack on PGP still possible?
RFC 4880, OpenPGP (superseded RFC 2440 which was up to date in 2002) contains a chapter on security considerations, which also discusses the decryption oracle attack Jallad et al described:
In late ...
- 1,313
5
votes
Accepted
gpg --gen-random quality level: is higher "better"?
This is a really hard question to answer. The definitive answer can only be found in the source code of gpg. However I can still answer your question using a mail I ...
- 45.6k
5
votes
ECDH and ECDSA in PGP with known public key
Sounds like a description of ECIES to me. ECIES is a hybrid cryptosystem that builds upon ECDH.
Basically: the static public key of the receiver is used together with an ephemeral key pair generated ...
- 91.1k
Only top scored, non community-wiki answers of a minimum length are eligible