Hot answers tagged

22

Forward secrecy is a confusing term that should be abandoned, especially the meaningless but value-loaded variant ‘perfect forward secrecy’. It is especially confusing because it is often associated with any protocol that does ephemeral DH key agreement, like TLS—even if, as in TLS<1.3 session resumption, the keys capable of decrypting transcripts of ...


7

how does gpg know which cipher is needed (in this case AES256 instead of the default CAST5? The OpenPGP Symmetric-Key Encrypted Session Key Packet (RFC 4880, §5.3) says which algorithm. wouldn't it be "better" to not tell anyone what encryption type was used? Not really. This is a basic premise of essentially all serious cryptography for more than a ...


4

Apparently this answer will be updated as OP develop an understanding of his application. I've never used PGP, but general public-key cryptography concepts are always applicable. entering a private key on a website whenever you need to do something is troublesome You can let clients derive their keys through memorable string - the user agent first ...


3

No, the PGP format doesn't contain the public key of the sender. But it does include a key ID of the key (pair) so that you know which private key to use to decrypt the message. It is rather easy to verify this by reading the OpenPGP specifications which defines the packet format(s) used. Or you can take a look using gpg --list-packets --verbose. It is ...


3

The web of trust is no longer active. It was removed in GPG version 2.2.17. The way it worked was that people would meet in person and sign each other's keys, then upload those keys and signatures to a network of "keyservers". Or maybe they'd just verify that email could be delivered to the other person. Or sign whatever they were asked to with no ...


3

What does MDC do exactly in OpenPGP ? MDC stands for Modification Detection Code. It's a field of cryptograms aiming at detecting that an encrypted message has been partially tampered with. Why partially? Because that's the best achievable goal in asymmetric encryption, where it is always possible that an adversary changes a message in its entirety (since ...


3

ProtonMail has a support page about this topic. ProtonMail does not transparently solve this problem. By default, the client has no way to know if the server has provided the correct public key, it just implicitly trust keys sent by the server. Therefore, by default the client has no way to protect against man in the middle attacks from the ProtonMail ...


2

Symmetric cryptography could well work here, to be honest. The main advantage of public cryptography in this setting is that you can encrypt by just using a public key. So you'd get the following operations: Setup: create public / private key pair; encrypt private key with password. Encryption: create random session key; encrypt session key using public ...


2

Wireguard is not PGP. In particular, Wireguard doesn't do several things that PGP does, because doing those things is very difficult to do securely. One of those things is encrypting anything with a public key: Wireguard only does elliptic-curve Diffie-Hellman key agreement. In general, you should never encrypt a message with asymmetric cryptography (public/...


2

When encrypting with PGP, it's common for the sender to add themselves as a recipient. When they do that, they are able to decrypt their own messages at a later time. If the sender doesn't do that, they simply won't be able to decrypt their previously sent messages.


2

No, it isn't possible to use a fingerprint as a key to verify signatures. The PGP fingerprint is a hash of the public key material, see RFC 4880 section 12.2; it doesn't actually contain the public key, and as such it is not correct to speak of a fingerprint as a “short public key” as you did in your question—it is more like a unique key ...


2

It seems to me that the only way to decrypt someone else's e-mail is if the end-point device has been compromised. There is no end-to-end encryption with the usual email delivery using SMTP. Any MTA on the way from the sender to the recipient can read the mail since the encryption is only done between the MTA (if at all) and not end-to-end between sender ...


2

The public key follows the OpenPGP message format. The part inside the -----…----- blocks, apart from the headers, is encoded in base64 (the OpenPGP specification calls it Radix-64). If you decode it, you'll see that only the first byte of the data changes: mDME decodes to 0x98 0x33 0x04 while xjME decodes to 0xc6 0x33 0x04. The data that's encoded in Base64 ...


2

Short answer A strong set key is probably a key signed by a key signed by one of these keys. Meet up with someone via the biglumber.com RSS feed. Longer answer: The PGP Web of Trust is a decentralized trust model in which individuals vouch for one an other's identities using public key cryptography. Some OpenPGP software, such as GnuPG, offer trust ...


2

You're barking up the wrong tree. To answer the stated question, OpenPGP doesn't support or use RSA-PSS, at least not yet. For RSA signature, EMSA-PKCS1-v1_5 from PKCS1, referenced as rfc3447 (which republished PKCS1v2.1) and actually copied for your convenience into rfc4880 13.1.3 (though without the precomputed DigestInfo encodings), is the hash and ...


1

Based on the example given in the question (see here) the following (hex-encoded) bytes would be hashed: From the Public-Key Packet Ciphertype Byte: 99 Key Length: 01 0d Version: 04 CreatedAt: 5e f4 a2 c6 Algorithm: 01 n (with tag): 08 00 a8 14 6d b3 75 12 72 33 1e 92 54 c5 43 f6 44 d2 22 5d 4d 9b 0c b8 5d 60 60 8b f0 39 08 1e 31 29 e2 f5 4c 83 e0 ...


1

Both schemes present in your image represent the same thing. Only the indexing of Ci differ by 1. It all depends on what you consider to be your "first block": In the first, you decrypt by manipulating the previous block and the current block. This means your decryption process start with C-1 and C0 to recover P0. Here, C-1 = IV In the other, you decrypt ...


1

100 MiB is nothing nowadays. Still, it is likely that most time is spend because of I/O operations, rather than encryption / decryption. Once the file is buffered in RAM, the operations will proceed much more quickly. Worse than that, during encryption most of the time is spend during compression of the input - not encrypting it. Try -z 0 so compression of ...


1

Not trivial by any means, but the bolded script below complements the output of: % gpg --verbose --list-packets skaht_0523F5B4_Secret.asc % ./parse.csh skaht_0523F5B4_Secret.asc ...


1

In short, it is not about proving that you have any key, it is proving that this key is bound to a specific entity. The identity of the person submitting the key must be established. The server doesn't know which keys to trust. It can sign any key, but what would be the point of that? The idea is that users can verify by other means that the key is trusted ...


1

Using tricks As said by Natanael in his comment to your question: this is maybe possible when using elliptic curve cryptography, and is actually kind of used in Bitcoin to have the so-called "hierarchical deterministic wallets". If you want a rough idea of how this kind of child key derivation works, I refer you to this answer. While it might also be ...


1

Assuming that in the question "with public key" describes encryption under the intended recipient's public key; secrecy of the corresponding private keys; that by some external mechanism public keys are securely bound to the legitimate parties; the parties have some unstated convention to define which is Party 1, defining who transmits first and order in "...


1

The fact that you bought a certificate from an X.509 certification authority doesn't matter to any OpenPGP implementations I know of: when your friend opens the message you just sent them in their OpenPGP-enabled mailer, it won't care a whit about the X.509 CA a priori. Not only would you have to shoehorn your certificate into the OpenPGP message format, ...


Only top voted, non community-wiki answers of a minimum length are eligible