Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Cygwin installed on several computers and would like to use the included GnuPG to encrypt files for my use only. The version of GnuPG included is 1.4.9 but it appears that there’s also a version 2.1 available. Are there any security risks to using 1.4.9 instead of 2.1?

Secondly when I run GnuPG I get an insecure memory message, is this something to be worried about? My understanding is that this is only an issue if I’m worried about losing physical access to the machine and don’t want info written to the swap file that may allow someone to decrypt my files or if I’m on a multi user system where someone else could read memory pages associated with my GnuPG process.

share|improve this question
    
Your question originally mentioned "GPG version 1.49". However, that version does not exist, and Cygwin does not include GPG. You probably meant "GnuPG v 1.4.9", so I corrected your question. –  sleske Jan 16 '12 at 9:00
add comment

1 Answer 1

The version of GnuPG included is 1.4.9 but it appears that there’s also a version 2.1 available. Are there any security risks to using 1.4.9 instead of 2.1?

It's always a good idea to use the latest version, especially with security-critical SW such as encryption. However, GnuPG 1.x and 2.x are being maintained in parallel, and the latest version from the 1.x series is 1.4.11, so you are not that far out of date. The changelogs for 1.4.10 and 1.4.11 do not mention any security fixes, so you are probably OK.

Secondly when I run GnuPG I get an insecure memory message, is this something to be worried about? My understanding is that this is only an issue if I’m worried about losing physical access to the machine and don’t want info written to the swap file that may allow someone to decrypt my files or if I’m on a multi user system where someone else could read memory pages associated with my GnuPG process.

Yes, precisely. If you are the only person using your computer, and if you are not worried about an attacker with physical access to your hardware, you can ignore the warning. You can disable it, see the GnuPG FAQ.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.