Hello,

I want to use GnuPG but I don't have a way to check the downloads integrity. I don't have a trusted version of GnuPG installed, and GnuPG's website says to use SHA-1 checksum's from other websites to make sure its consistent. I can't seem to find other websites to verify this. Where can I see announcments other than the GnuPG's website?

Thanks in adavnce,

I need help. I've got the fingerprint and the key and all that but when I try to decrypt a folder that I once encrypted, it says "Decryption not possible: No secret key. The data was not encrypted for any secret key in your certificate list." How can I solve this?

I have the fingerprint of the old account that I used have, and a file that is named after that account. It's either a signature or a certificate, but I'm not really sure. Please help.

I've added that old account to my accounts list and verified the certificate too but for some reason it does not work.

Hi, I'm new here and new to PGP but have used other encryption tools in the past, some of which supported PQC. I was wondering if something like this would be added to PGP and if so when, because I want to use this with https://github.com/ProtonMail/gopenpgp

Hi guys I'm new in the GnuPG club but many of the applications looks like from 2003 is there any application that looks like a little bit modern ?

UPDATE: Thank you for the replies! Now I understand that whole keyblock with primary key, subkeys, and uids is stored while exporting public and private keys. So the talk is not just on single keys, but a whole collection.

I want to "upvote" a question that some user asked on StackExchange: https://security.stackexchange.com/questions/226612/gpg-keys-and-subkeys-export-what-is-exported-and-how

I accidentally found that I have EXACTLY the same question. However, this question on StackExchange is unanswered.

In short: why, when I export my primary keys and subkeys, all public and private keys are equal? In other words, why when I export the private key of a subkey, it is equal to the private key of a primary key?

To update the original StackExchange answer: in PGP blocks there are 4 random characters at the end, so all public and private keys that the person have extracted are somewhat really identical

Couldn’t get this to work. Mail seems to use extensions now and not plugins. Anyone know if they’re gonna adapt Free-GPGMail?

Hi everyone, I was wondering how your experience with wks is. I was looking into it and saw that quite a lot of people seem to struggle with setting it up and als thunderbird seems to have lost support for wks. Is there a better alternative? Or are we just walking backwards considering privacy?

Posted in the Tails subreddit but reposting here as makes more sense.

Suuuuuper green at this, but when I created my key pairs, I exported the private key, but it saved it as a PDF. I didn't have PGP keys toggled in persistent storage on Tails but I do still have that PDF and also my public key. The PDF has a lot of info including "secret portions of key" "paperkey" and 96 rows of Base16 lines, and I have no idea what that means or how to use it.

How do I use that to access my secret key and import it and the public key to decrypt messages that have been encrypted using my public key?

I'm working with a third party where I'm supposed to download a PGP encrypted file from their SFTP server. I generated a key pair using Kleopatra and shared my public key with them. When I tried to decrypt the file, I got the no secret key error. The third party verified that the public key that we shared with them is correct and I don't think we need to export the secret key and save the file somewhere in our machine. I tried to encrypt a test file using Kleopatra and shared the file with another user who's using Kleopatra as well and he managed to decrypt the file. We are on Windows. I'm not really sure what seems to be wrong here.

Any help is appreciated. Thanks

Hi guy’s so what is the most secure and best way to store your private keys?

Let's say I make a key, and I have a backup on non-electronic media and I'm not gonna lose it. Is there still a reason why I should still have it expire some day?

Want to verify text file with two Ubuntu-ISO checksums stored. Signer's public still not in local keyring as the used WSL2 Ubuntu 24.04 was installed from scratch. GnuPG means --keyserver to be deprecated. dirmngr.conf shall be used instead. However as for used Ubuntu 24.04 WSL (no updates are pending) the search for this file completes with zero matches find / -type f -name dirmngr.conf 2>/dev/null

All similar matches are found in /var/lib/ and /usr/bin/ /usr/lib/ folder trees. No single match in /etc/ and user home folder trees.

How to handle in above situation?

Please note this is different use case than having public key in local keyring for distribution own purposes.

One aims an universal method working on numerous Linux distributions. Using GnuPG native interface - has this attitude major Cons?

After months of trying complex solutions, I found GPG's maintainer Werner Koch's simple solution for restoring signing capability when your key shows as a stub (sec#).

Key details:

• Have original backup files (e.g., from Tails)
• Key shows as sec# (stub) in gpg -K output
• Need signing capability restored
• Have the passphrase

Answer:

The solution is surprisingly simple, from Werner Koch (GnuPG maintainer) himself:

[Link to original post]

CRITICAL RULES:

1. USE ORIGINAL, UNMODIFIED BACKUP FILES ONLY
2. NEVER MOVE YOUR ORIGINAL FILES - ONLY COPY THEM

Steps:

1. Create clean GPG environment:

```bash  
pkill -9 gpg-agent
mv ~/.gnupg ~/.gnupg.backup
mkdir -p ~/.gnupg/private-keys-v1.d
chmod 700 ~/.gnupg
chmod 700 ~/.gnupg/private-keys-v1.d

2. Import public key:

COPY don't move your original publickey.asc

cp /path/to/backup/publickey.asc ~/.gnupg/
gpg2 --import ~/.gnupg/publickey.asc

3. Restore private key:

COPY your original .key file (will have a long hex name

cp /path/to/backup/[long-hex-name].key ~/.gnupg/private-keys-v1.d/
chmod 600 ~/.gnupg/private-keys-v1.d/*.key

4. That's it. Really! ; )

Verify success:

bash
gpg2 -K

Should show sec (not sec#) for your key.

Repeat for other stubs.

Important Notes:

• NO CONVERSION OF ANY KIND IS NECESSARY
• This will seem too simple to be true - but it works
• You must have your passphrase to use the key
• The security is in the cryptography and passphrase, not in complicated procedures

Like I said I've used gpg before however I don't understand how it works to get to the handshake and how to use it effectively for security and privacy. Any help especially literature with both theory and practice on gpg so I can fully implement it.

Can you list some free resources that are detailed, step by step, and cover everything to do with gpg and setting up gpg practically on macos. The main thing I'm having trouble on is ssh, jsonwebtoken, and other auth is used generally for web apps but I've never seen gpg used throughout school and my admitted short so far professional dev experience. Is gpg more about trust between two parties than trust between an organization and a party. What are the gain use cases that ssh won't cover and is gpg more secure in a noticable way?

[Solved]

Hi, I'm trying to import my private gpg key from my old .gnupg folder. I recently reinstalled linux and all I did before was save the .gnupg folder in my /home. Is it possible to import my key in this case?

I tried to copy my old .gnupg to my new linux installation, but when I do :

gpg --list-secret-keys --keyid-format=long

nothing appears.

I'm experimenting with the use of PGP.
I'm using the version of GnuPG packaged with Ubuntu.

I created a keypair and imported them to my keyring.
I then encrypted a message to myself.

When attempting to decrypt I get the message :'gpg: decryption failed: No secret key'

I thought that maybe I mishandled the keypair or made some dumb user error. So I generated another keypair and tried again. The same thing happened.

So I repeated the process of generating and importing keys... and the same thing happened again.

If I do 'gpg -K' I can see that I do in fact have the secret keys for each of the pairs.

But for some reason, gpg simple isn't bothering to try and use them.

What's going on here?

I have been thinking and reading a lot about key management. The main concern, I understand, is malware on your computer obtaining your passphrase and/or key material. So the mitigation is to only ever decrypt your key on an airgapped system, that way at least remote actors can't get it.

However, I have been considering a threat model that includes the possibility of an evil maid attack. For example, I may have roommates, malicious guests, or a highly motivated thief. Depending on how I build the airgapped system, they could figure out how to steal my credentials. The more complex I make my system, the more technically advanced the attacker would have to be to circumvent it. For example:

• I build a system on a Raspberry Pi, unencrypted -> the attacker modifies my SD card to include keylogger
• I encrypt the system -> the attacker takes my SD card, replaces it with a similar, unencrypted one with a fake bootloader to phish me, then steals my credentials after I use it
• I do the above and place a secret on the encrypted SD card so I can verify its integrity -> the attacker just puts the keylogger on the unencrypted bootloader/firmware and leaves the encrypted portion of the card intact
• I do the above, plus run a program on my encrypted storage to verify the integrity of the bootloader and firmware (is this even possible on a Pi?) -> the attacker makes their firmware look untampered to my program
• I do the above, plus encase the whole system in epoxy or something -> at worst, the attacker has to go through the effort to steal my SD card from the casing, then build an identical-looking system to phish me. This would be a massive pain for them, but it would also be a massive pain for me to initially build the system.
• I rebuild the system from scratch (no epoxy) every time I need to sign something -> This is also a pain, and if I consider the possibility that the attacker has tampered with my hardware, then I have to go out and buy a new board each time.

So instead of trying to build something myself, I could use something that's already out there. Yubikeys are popular and have secure, tamper-resistant hardware that I could put my trust in to protect my key from getting leaked. But I'm not comfortable with the fact that someone could just take my Yubikey (e.g., while I'm asleep), go sign some data, and then return it to me. Once I find out that someone has impersonated me, then I pretty much have to revoke my key. If I don't find out someone has impersonated me, then that might be worse. Yeah, I can set a PIN on it, but I have to enter it through the Yubikey app on a computer. Someone with physical access to my Yubikey also has physical access to my laptop (which I am less careful with) and possibly even my home network. So I bet they could phish my PIN. To mitigate this I have to go through all the lengths to build that airgapped tamper-resistant system, which is what I'm trying to avoid in the first place.

OnlyKey requires a PIN, but just looking at the firmware source code, I'm not certain the PIN is actually used to encrypt the sensitive material on the device. If it's not encrypted, then somebody who does computer engineering for fun (I know many) could probably break into it if they had physical access. If it is encrypted, they still could by extracting the memory and brute forcing the PIN (8-10 digits from 1 to 6) on the computer. Not a serious security option IMO, although they are talking on the forums about an upcoming Pro device which will feature encryption. OnlyKey does encrypt secrets at rest. I need to read the security documentation more.

Hardware wallets, though. After reading about the Trezor's security features, I am convinced that it was designed to be resistant both to remote and physical attacks. My understanding is that they store secrets encrypted with a PIN (that can be much longer than 10 digits), so an attacker can't get them if they open the device. The older ones that require you to enter the PIN on your computer do it in a clever way: the device creates a scrambled keypad that it shows to you on its screen, and you click the buttons in corresponding positions on the computer. The scrambling is random and the computer doesn't know which position corresponds to which number, so malware can't take your PIN. The Trezor Safe models even have a secure element, which I understand further protects your secrets from physical tampering, though I'm not sure precisely how. The Trezor devices and some other crypto hardware wallets support a GPG agent. On the trezor, my understanding is that the key will be generated deterministically on the device using its seed, so I suppose there is a disadvantage if your private key (somehow) gets compromised and you have to revoke it, then you will have to use an entirely new seed.

All-in-all, it seems to me like hardware wallets, while initially designed for crypto, would also be the most secure way to generate and store a GPG key, while also providing lots of convenience (I could sign keys on my malware infested personal laptop!). But I don't see them mentioned a lot. Why is this? Am I wrong in my assessment?

When I try to encrypt a message it says error public key unusable no matter who I try to send it to. I can decrypt just fine. It was working fine last month. Any help is greatly appreciated

Hi guys,

i have an excel filles with 500 rows (cell a1 till 500). In each row is an pgp encrypted message. (starts with ---begin pgp message--- & ends with ---end pgp message---.

I can decrypt the message by copying the contect of the cell in notepad section in kleopatra then decrypt the content, and copy the message in cell b1 (to b500).

But how can i speed this up? This will take me ages.

Any solution with VBA or a beginners guide i can find somewhere?

Edit: to clarify, excell file itself is not encryped, alle the messages in each cell are

Edit2: I got it! I used Python (which I knew nothing about just three hours ago), and ChatGPT wrote the code for me with lots of trial and error. The program retrieves encrypted messages from column A, decrypts them using GPG, and stores the decrypted messages in column B, processing cell by cell. The data was originally in a .csv file, and it took me some time to realize that Excel had added an extra line break when converting the data from CSV to XLSX...

Hi all, I am running into a weird situation with gnupg (that may be simply due to my ignorance/misunderstanding): I have an application that is trying to check a key's status (in terms of expiration, having valid signing subkeys, etc). We have no trustdb.gpg created and would like to rely on --import --import-options show only to simply display the key data.

By using --trust-model always and --no-auto-check-trustdb, a simple --import will work as expected (it imports the key), but if I also pass --import-options show only, it seems to fail with a ERROR: gpg: Fatal: can't open '/foo/bar/baz/.gnupg/trustdb.gpg': No such file or directory

Is there any way to avoid touching the trustdb, or alternatively, generating a trustdb.gpg without a keyring to simply show the contents of a key?

Any help is much appreciated!

Computer all of a sudden died on me and I have a text file containing the key but can not for the life of me get it to work on openkeychain android. Really hoping when I get a new pc I will be able to import my secret key using a text file. Any advice appreciated. Stressing because that key was for wallet keys that has half my net worth in it.

If i symmetrically encrypt a file that requires a passphrase to be created to do so, is it actually possible to recover the key and save it to a file? Or is creating a shared secret just saving the passphrase to a file and encrypting it with the receivers public key?

So I have tor running and it opens a socks proxy at localhost:9050. I want to fetch some keys from keys.openpgp.org but I am getting configuration error

The command I run is

gpg --verbose --keyserver-options "http-proxy=socks5://127.0.0.1:9050" --keyserver hkps://keys.openpgp.org --recv-keys EFB9ACCD95CBA34198040A2EE9C4F4EE327CFE76

I get the error

gpg: keyserver receive failed: Configuration error

I dont want to alter my gpg.conf as this is only for this one case.

I am using Linux Mint 21.3 which is based on Ubuntu Jammy and my gpg version is 2.2.27

Solved 💡 Was missing some development libraries, which I added right after installing build-essential

RUN apt-get install zlib1g-dev -y
RUN apt-get install libbz2-dev -y

Hi all

Sorry in advance, I am not extremely linux savvy, but I have been tasked with upgrading our hosting environment from using GnuPG 2.2 to using 2.4.5. The problem however is that the same encrypted files fail on the upgraded system, which uses 2.4.5. The error is:

gpg: uncompressing failed: Unknown compression algorithm

I have tried a lot (I think), like specifying different compression algorithms, installing compression libraries, but to no avail.

The output of --version is:

gpg (GnuPG) 2.4.5
libgcrypt 1.11.0
Copyright (C) 2024 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed

I am wondering if the reason is that it only supports "Uncompressed"? In the old 2.2 it lists multiple compression algorithms:

gpg (GnuPG) 2.2.27
libgcrypt 1.8.8
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

And here is the snippet from my Dockerfile, which installs GnuPG 2.4.5:

# Install required tools
RUN apt-get update
RUN apt-get install bzip2 -y
RUN apt-get install build-essential -y

# Install required libraries
RUN wget https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.50.tar.bz2
RUN tar -xvf libgpg-error-1.50.tar.bz2
RUN cd libgpg-error-1.50 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.11.0.tar.bz2
RUN tar -xvf libgcrypt-1.11.0.tar.bz2
RUN cd libgcrypt-1.11.0 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libassuan/libassuan-3.0.1.tar.bz2
RUN tar -xvf libassuan-3.0.1.tar.bz2
RUN cd libassuan-3.0.1 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libksba/libksba-1.6.7.tar.bz2
RUN tar -xvf libksba-1.6.7.tar.bz2
RUN cd libksba-1.6.7 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/npth/npth-1.7.tar.bz2
RUN tar -xvf npth-1.7.tar.bz2
RUN cd npth-1.7 && ./configure && make && make install

# Install gnupg 2.4.5
RUN wget https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.4.5.tar.bz2
RUN tar -xvf gnupg-2.4.5.tar.bz2
RUN cd gnupg-2.4.5 && ./configure && make && make install

Hi

I was wondering if there was a known standardised method to set the filename of an output file to an encrypted hash?

So for example the command gpg --encrypt --recipient alice@cyb.org --output hashing bank_document.txt would generate a file like hj289dm.txt. Such that the file could only be decrypted and be unhashed by alice's private key?

Thankyou

Introducing our new macOS Mail PGP Extension! Experience top-notch email security with effortless PGP encryption right within your Mail app. Enhance your privacy and keep your communications safe. Download now and secure your inbox!

https://macmailpgp.com

Good day,

We are a set of companies that have lots of senders, via a government dictated hub and then a small receiver set.
The history is that the hub got a company to create a "custom" app to generate the private/public keys, which basically is an antiquated PGP of sorts, if not an early gnupg 1.x

The key pair is generated this way every 4 months, and then the public key shipped to all the senders, and the secret key shared with the receivers - common pub-private key setup.

The "problem" now is that app is a pain to run for me (need to find some x86 Windows VM while I'm on Apple Silicon and Linux servers), and when we did run the GnuPG2 keygen, it came out that GnuPG generated a primary and subkey with split SC & E, while the antiquated custom software does a single key, with SCEA feature to the key.

example differences between the keys:

sec   rsa2048 2024-05-14 [SCEA] [expires: 2024-10-04]
      6AB9B48E00E3F07AEC14C435701D5549DA644AFB
uid           [ unknown] old_key_name


sec   rsa3072 2024-09-18 [SC] [expires: 2025-02-04]
      4EC6C78CB5AEEF773302994ABF85511CDDAE8DD7
uid           [ unknown] gnupg2_key_name
ssb   rsa3072 2024-09-18 [E] [expires: 2025-02-04]

So the problem now is that the public key was distributed to the senders, and they've been using that happily, just... *some* of the receivers now can't decrypt, with the grapevine (via the hub admins) that the keys are `incompatible`

the encrypted files was all decrypted with the 4EC6C78CB5AEEF773302994ABF85511CDDAE8DD7 key from myside.

HELP!!!

Also how to create the key to be only a single key-pair with SCEA settings?