4

I have Cygwin installed on several computers and would like to use the included GnuPG to encrypt files for my use only. The version of GnuPG included is 1.4.9 but it appears that there’s also a version 2.1 available. Are there any security risks to using 1.4.9 instead of 2.1?

Secondly when I run GnuPG I get an insecure memory message, is this something to be worried about? My understanding is that this is only an issue if I’m worried about losing physical access to the machine and don’t want info written to the swap file that may allow someone to decrypt my files or if I’m on a multi user system where someone else could read memory pages associated with my GnuPG process.

  • Your question originally mentioned "GPG version 1.49". However, that version does not exist, and Cygwin does not include GPG. You probably meant "GnuPG v 1.4.9", so I corrected your question. – sleske Jan 16 '12 at 9:00
4

The version of GnuPG included is 1.4.9 but it appears that there’s also a version 2.1 available. Are there any security risks to using 1.4.9 instead of 2.1?

It's always a good idea to use the latest version, especially with security-critical SW such as encryption. However, GnuPG 1.x and 2.x are being maintained in parallel, and the latest version from the 1.x series is 1.4.11, so you are not that far out of date. The changelogs for 1.4.10 and 1.4.11 do not mention any security fixes, so you are probably OK.

Secondly when I run GnuPG I get an insecure memory message, is this something to be worried about? My understanding is that this is only an issue if I’m worried about losing physical access to the machine and don’t want info written to the swap file that may allow someone to decrypt my files or if I’m on a multi user system where someone else could read memory pages associated with my GnuPG process.

Yes, precisely. If you are the only person using your computer, and if you are not worried about an attacker with physical access to your hardware, you can ignore the warning. You can disable it, see the GnuPG FAQ.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.