Hot answers tagged

21

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated with any protocol that does ephemeral DH key agreement, like TLS—even if, as in TLS<1.3 session resumption, the keys capable of decrypting transcripts of ...


12

It is the keypair that is doing the encrypting, not the one doing the decrypting, that the expiration date applies to. And yes, they will be able to decrypt it after one week. In fact, they will always be able to decrypt it. The expiration date only applies to the key and is nothing more than a gentle reminder that the key is supposed to be replaced and ...


7

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5? The OpenPGP Symmetric-Key Encrypted Session Key Packet (RFC 4880, §5.3) says which algorithm. wouldn't it be "better" to not tell anyone what encryption type was used? Not really. This is a basic premise of essentially all serious cryptography for more than a ...


4

Apparently this answer will be updated as OP develop an understanding of his application. I've never used PGP, but general public-key cryptography concepts are always applicable. entering a private key on a website whenever you need to do something is troublesome You can let clients derive their keys through memorable string - the user agent first ...


4

To generate keys faster than you are doing right now probably requires to add a faster source of random numbers to your system. You could look at the extensions available in your CPU and checking if they are enabled or not on your system. If you are only interested in looking for collision on key ID, you'd probably proceed differently. fingerprint = hash(...


3

No - If you could do this, what would prevent someone else from doing the same thing with their private key?


2

(1,2) You could use: gpg2 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256 --symmetric /*file path* According to The GNU Privacy Guard Manual, p. 71, we use --s2k-cipher-algo name when we want to apply symmetric encryption with a passphrase if --cipher-algo name or --personal-cipher-preferences string have not been set. ...


2

It is likely secure, yes, when it comes to SHA-1. The S2K function, as you mention, simply repeatedly inputs the 8-byte salt and encoded passphrase into the ongoing hash function until a certain number of bytes has been processed (the work factor for this function). Then it produces a key that is smaller than the hash output size. Now this output is an ...


2

What PGP (like pretty much any software that can do bulk data encryption with public keys) does is hybrid encryption. Basically, it generates a random key for a symmetric cipher (e.g. AES), encrypts the file with that randomly generated key, and then encrypts the random key with the recipient's public key and attaches it to the encrypted file. When ...


2

Yes. As rightly pointed in the first answer, we can make keys with identical public-key parameters but a different timestamp, which makes computing a fingerprint very fast. That seems by far the fastest/best to create collisions. We create $k\ge2$ keys (say 16), compute fingerprints with varying timestamps, find a collision, and check that they are not ...


2

If you had a system like this: \begin{equation} \text{you} \longleftrightarrow \text{your network} \longleftrightarrow \text{shared host} \longleftrightarrow \text{friend's network} \longleftrightarrow \text{friend} \end{equation} Your use of ssh defends against an eavesdropper or forger on your network. Your friend's use of ssh—if your friend is using ...


2

Yes, there's an indirect way to perform what's asked with PGP and variants. Draw a an asymmetric public/private key (of a type that can sign), protected by a passphrase. Publish the passphrase-protected private key. Discard the public key (it's in the private key anyway). Use the passphrase as you would use a symmetric key: share it by trusted means between ...


2

It seems to me that the only way to decrypt someone else's e-mail is if the end-point device has been compromised. There is no end-to-end encryption with the usual email delivery using SMTP. Any MTA on the way from the sender to the recipient can read the mail since the encryption is only done between the MTA (if at all) and not end-to-end between sender ...


2

When encrypting with PGP, it's common for the sender to add themselves as a recipient. When they do that, they are able to decrypt their own messages at a later time. If the sender doesn't do that, they simply won't be able to decrypt their previously sent messages.


1

Not trivial by any means, but the bolded script below complements the output of: % gpg --verbose --list-packets skaht_0523F5B4_Secret.asc % ./parse.csh skaht_0523F5B4_Secret.asc ...


1

In short, it is not about proving that you have any key, it is proving that this key is bound to a specific entity. The identity of the person submitting the key must be established. The server doesn't know which keys to trust. It can sign any key, but what would be the point of that? The idea is that users can verify by other means that the key is trusted ...


1

Using tricks As said by Natanael in his comment to your question: this is maybe possible when using elliptic curve cryptography, and is actually kind of used in Bitcoin to have the so-called "hierarchical deterministic wallets". If you want a rough idea of how this kind of child key derivation works, I refer you to this answer. While it might also be ...


1

Assuming that in the question "with public key" describes encryption under the intended recipient's public key; secrecy of the corresponding private keys; that by some external mechanism public keys are securely bound to the legitimate parties; the parties have some unstated convention to define which is Party 1, defining who transmits first and order in "...


1

The usage of subkeys separates the collection of trust signatures from the key's usage. Trust signatures for the Web of Trust are created for you master key. This trust is inherited by your subkeys which are the ones used in the actual cryptographic operations (signing/decrypting). This has a few advantages: Key rollover: You can use short lived subkeys (...


1

The fact that you bought a certificate from an X.509 certification authority doesn't matter to any OpenPGP implementations I know of: when your friend opens the message you just sent them in their OpenPGP-enabled mailer, it won't care a whit about the X.509 CA a priori. Not only would you have to shoehorn your certificate into the OpenPGP message format, ...


1

Encrypting with a DSA key—as the master key is—doesn't make sense. It appears that someone neglected to put the encryption usage flags on the Elgamal encryption subkey, which would be the obvious one to use.


Only top voted, non community-wiki answers of a minimum length are eligible