Hot answers tagged

53

If you want to add an user ID to an existing key from the command line (your input is in bold): $ gpg --edit-key <key-id> gpg> adduid Real Name: <name> Email address: <email> Comment: <comment or Return to none> Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O Enter passphrase: <password> gpg> uid ...


39

Both SKS Keyserver Pool (stats) and PGP Global Directory are online. I usually use sks-keyservers, since it consists of many servers which synchronize their databased continuously, while Global Directory is a single, commercially operated server. There also exist a bunch of other keyservers not part of the SKS pool (listed below the same status page) ...


21

Why Use PGP? -- probably fits your size. PGP is useful for two things: 1. Privacy and Security, and 2. Authenticity. By privacy, I mean that you can prevent people from seeing things. For example, you can encrypt an email to someone, or encrypt a file with a list of passwords. By Authenticity, I mean that you can ensure a message was sent/written ...


21

This right part of a public key (either "id_rsa.pub" or "id_dsa.pub") is just a comment and is usually filled with the < login>@< hostname> who generated the key. This in a way similar to the comment field from the SSH Public Key File Format (see RFC 4716). So, as being purely informational and optional, you can change it to whatever you like, but ...


20

S/MIME and PGP are incompatible, but they do use similar concepts (asymmetric encryption and public key certificates). The biggest difference is that S/MIME is based on X.509 public key infrastructure and has the same issues as with SSL: if you want a certificate that will be shown as "valid" to other users, you have to obtain one from a CA that everyone ...


19

First, I'm assuming you're speaking of RSA 1024 bit encryption. Generally, the topic is far too complicated for providing a simple number. tl;dr: Cracking an OpenPGP encrypted message on a single CPU is not feasible, and probably takes years even with large computing clusters. Yet unknown (to the public) mathematical flaws could change this by order of ...


18

Well, this is a bit embarrassing. I've spent hours over the course of a week trying to figure this problem out, and the answer appears to lie with subkeys--a topic the GnuPG manual and FAQ glosses over. While researching what subkeys are and why they might be used instead of --gen-key, I stumbled across this gem: http://wiki.debian.org/subkeys. Debian's ...


16

It turns out that it is possible (and relatively simple) to delete and re-import the key, provided that it is on a keyserver (and provided that the revocation has not been sent to the keyserver, of course). This is what I found to work (THEKEYID is the short ID of the key): Delete the public key as follows (the --expert option allows the public key to be ...


15

Yes, it's possible – practically all PGP software will let you add multiple recipients when encrypting; no additional configuration is needed.


14

Yes, both GnuPG and the commercial PGP.com are implementations of the same OpenPGP standard; in fact, GnuPG was specifically designed to be PGP-compatible. The only differences you might encounter are: Different supported algorithms. For example, GnuPG supports the Camellia encryption algorithm, while PGP.com does not. This is almost never a problem, ...


14

With GnuPG, the original filename can be seen in gpg --list-packets. $ gpg --list-packets test.gpg :pubkey enc packet: version 3, algo 1, keyid CE7B5510340F19EF data: [4095 bits] :encrypted data packet: length: 67 mdc_method: 2 gpg: encrypted with 4096-bit RSA key, ID CE7B5510340F19EF, created 2009-10-31 "Mantas Mikulėnas ...


10

For GnuPG, it's done like this. Import the key: gpg --import key.asc Decrypt the file: gpg --decrypt file.pgp For PGP Command Line, it's mostly the same: pgp --import key.asc pgp --decrypt file.pgp


10

Since it has not been mentioned: this is known as a known-plaintext attack, and would be a very bad vulnerability for a cipher to have. In fact, in public-key crypto this attack is equivalent to a chosen-plaintext attack, since anyone can encrypt any message! There have in fact been some known/chosen-plaintext attacks against RSA (the public-key cipher ...


9

All GPG keys are stored in the "keyring", which is at ~/.gnupg or %AppData%/gnupg. Running gpg --version will show the path being used. The usual way of sharing keys is to export them to a file... gpg -a --export my.email@example.com > mypubkey.asc ...or to publish it on a keyserver and give others the key ID along with the fingerprint: gpg ...


9

No. that is the point of asymmetric keys (public and private) as you can easily encode a message with the public key (that's what it is for) you have the de- and encrypted message. But decrypting the encrypted message is only possible with the private key. The private key can not be regenerated.


9

From RFC 4880: A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field. The Key ID is the low-order 64 bits of the fingerprint. For V3 keys, calculation is similar, but the key length is omitted. In other words, the ...


8

Why do people share their PGP Keys? Because without giving someone your public key, they can't encrypt data that your private key can decrypt or confirm that your digital signature was created by your private key. Wikipedia has what appears to be a decent article on the subject. How can we sent an authenticated mail using a PGP Key? Usually by ...


8

Assuming that you use Enigmail for GPG support in Thunderbird, you can simply use the "OpenGPG Security" Tab for each of your identities. You can get there via Account Preferences -> Manage Identities -> Edit. Alternatively, you can select from the Menu: OpenPGP -> Key Management -> [Right-click on your key] -> Manage User IDs And then ...


8

Slightly modified answer by Jens Erat on Ask Ubuntu, plus information from comments above. -- If you're fine with using the command line, this is easily done using gpg --gen-revoke using Windows Command Prompt. On Windows, if you do not change anything else, the revocation certificate is stored in revoke.asc in your home directory (C:\Users\Name), and you ...


7

With PGP, or other public-key encryption methods, no, this is not possible. You must have their public key to encrypt the file to them. There are other methods of encryption, however. The most common would be called "shared-secret", and this includes things like ZIP file encryption or RAR file encryption. You essentially encrypt the file using a ...


7

I'm doing some research about this topic and I can give you some hints, but I've not found a way to make it work yet. Monkeysphere Monkeysphere seems a very interesting project, but I've not been able to compile it under Mac OS X without clogging my little free diskspace with MacPorts. Using gpgkey2ssh The first way I suggest you to try is to generate a ...


7

Yes, the OpenPGP "secret key" and "secret subkey" packets contain both public and private parameters. You can verify this by using pgpdump to examine the exported key: $ gpg --export-secret-key grawity | pgpdump Old: Secret Key Packet(tag 5)(1854 bytes) Ver 4 - new Public key creation time - Sat Oct 31 14:54:03 EET 2009 Pub alg - RSA Encrypt or ...


7

While @Jens Erat's answer was rather comprehensive, I did research into breaking RSA (the algorithm behind OpenPGP), so I wanted to opine: I'll break with the norm and give the TL;DR first: It is impossible for you to break that key. If we are looking at this realistically, there is no way for you to factor a 1024-bit integer. Your best possible bet would ...


7

PGP Encryption - How public and private keys work You share your public key only and this is what they encrypt data with before they send it to you. You can also encrypt data for them with their public key before you send it to them. The public key is just that [public] so anyone can safely have it to encrypt files but never the private as it always ...


6

You cannot move single keys or even keypairs, but you can move the entire keyring: Move GnuPG data directory (~/.gnupg; on Windows %APPDATA%\.gnupg) to your chosen location. For extra security, copy and secure-wipe instead of just moving (which does an insecure deletion). Set the GNUPGHOME environment variable to the new location. System Properties → ...


6

It is a public PGP key encoded using Radix64 (OpenPGP's variant of Base64) -- "armored". You usually don't need to decode it - you just import it to gpg or PGP software. The key in your post is missing a few newlines though (and won't be recognized by GPG if it's in a single line). It should look like this: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: ...


6

Yes, additional security is necessary. No, your home router or ISP can't intercept the packets. But then why is additional security still necessary? If you decide to use Tor for being anonymous but still use personal information then your data will be safe from your PC till the last hop within the Tor network, but the endpoint can monitor your traffic if ...


6

Received an explanation from the GNU/GCC team about this, and the .sig files were missing due to an error with file replication to their mirror servers. From the team: Interestingly, the .sig files are only on the GNU server (e.g., http://ftp.gnu.org/gnu/gcc/gcc-4.8.0/) but not on the GCC server (e.g., ftp://gcc.gnu.org/pub/gcc/releases/gcc-4.8.0/). ...


6

There is no way to "upgrade" an OpenPGP key. You will have to create a new one, and you will loose your reputation in the web of trust. Some people I met decided to stick with a RSA 1024 primary key, but use stronger subkeys instead (which is easily possible without losing your reputation in the web of trust), which comes with secure day-to-day use (for ...


6

Share your full public key, which will include the public primary key, public subkeys, user IDs and certifications (and some further, special packets). For getting your key certified (or advertising it for usage on your website), the only thing you need to exchange is your primary key's fingerprint. Signatures are issued on pairs of user IDs and primary ...



Only top voted, non community-wiki answers of a minimum length are eligible