Hi guy’s so what is the most secure and best way to store your private keys?

Let's say I make a key, and I have a backup on non-electronic media and I'm not gonna lose it. Is there still a reason why I should still have it expire some day?

Want to verify text file with two Ubuntu-ISO checksums stored. Signer's public still not in local keyring as the used WSL2 Ubuntu 24.04 was installed from scratch. GnuPG means --keyserver to be deprecated. dirmngr.conf shall be used instead. However as for used Ubuntu 24.04 WSL (no updates are pending) the search for this file completes with zero matches find / -type f -name dirmngr.conf 2>/dev/null

All similar matches are found in /var/lib/ and /usr/bin/ /usr/lib/ folder trees. No single match in /etc/ and user home folder trees.

How to handle in above situation?

Please note this is different use case than having public key in local keyring for distribution own purposes.

One aims an universal method working on numerous Linux distributions. Using GnuPG native interface - has this attitude major Cons?

After months of trying complex solutions, I found GPG's maintainer Werner Koch's simple solution for restoring signing capability when your key shows as a stub (sec#).

Key details:

• Have original backup files (e.g., from Tails)
• Key shows as sec# (stub) in gpg -K output
• Need signing capability restored
• Have the passphrase

Answer:

The solution is surprisingly simple, from Werner Koch (GnuPG maintainer) himself:

[Link to original post]

CRITICAL RULES:

1. USE ORIGINAL, UNMODIFIED BACKUP FILES ONLY
2. NEVER MOVE YOUR ORIGINAL FILES - ONLY COPY THEM

Steps:

1. Create clean GPG environment:

```bash  
pkill -9 gpg-agent
mv ~/.gnupg ~/.gnupg.backup
mkdir -p ~/.gnupg/private-keys-v1.d
chmod 700 ~/.gnupg
chmod 700 ~/.gnupg/private-keys-v1.d

2. Import public key:

COPY don't move your original publickey.asc

cp /path/to/backup/publickey.asc ~/.gnupg/
gpg2 --import ~/.gnupg/publickey.asc

3. Restore private key:

COPY your original .key file (will have a long hex name

cp /path/to/backup/[long-hex-name].key ~/.gnupg/private-keys-v1.d/
chmod 600 ~/.gnupg/private-keys-v1.d/*.key

4. That's it. Really! ; )

Verify success:

bash
gpg2 -K

Should show sec (not sec#) for your key.

Repeat for other stubs.

Important Notes:

• NO CONVERSION OF ANY KIND IS NECESSARY
• This will seem too simple to be true - but it works
• You must have your passphrase to use the key
• The security is in the cryptography and passphrase, not in complicated procedures

Like I said I've used gpg before however I don't understand how it works to get to the handshake and how to use it effectively for security and privacy. Any help especially literature with both theory and practice on gpg so I can fully implement it.

Can you list some free resources that are detailed, step by step, and cover everything to do with gpg and setting up gpg practically on macos. The main thing I'm having trouble on is ssh, jsonwebtoken, and other auth is used generally for web apps but I've never seen gpg used throughout school and my admitted short so far professional dev experience. Is gpg more about trust between two parties than trust between an organization and a party. What are the gain use cases that ssh won't cover and is gpg more secure in a noticable way?

[Solved]

Hi, I'm trying to import my private gpg key from my old .gnupg folder. I recently reinstalled linux and all I did before was save the .gnupg folder in my /home. Is it possible to import my key in this case?

I tried to copy my old .gnupg to my new linux installation, but when I do :

gpg --list-secret-keys --keyid-format=long

nothing appears.

I'm experimenting with the use of PGP.
I'm using the version of GnuPG packaged with Ubuntu.

I created a keypair and imported them to my keyring.
I then encrypted a message to myself.

When attempting to decrypt I get the message :'gpg: decryption failed: No secret key'

I thought that maybe I mishandled the keypair or made some dumb user error. So I generated another keypair and tried again. The same thing happened.

So I repeated the process of generating and importing keys... and the same thing happened again.

If I do 'gpg -K' I can see that I do in fact have the secret keys for each of the pairs.

But for some reason, gpg simple isn't bothering to try and use them.

What's going on here?

I have been thinking and reading a lot about key management. The main concern, I understand, is malware on your computer obtaining your passphrase and/or key material. So the mitigation is to only ever decrypt your key on an airgapped system, that way at least remote actors can't get it.

However, I have been considering a threat model that includes the possibility of an evil maid attack. For example, I may have roommates, malicious guests, or a highly motivated thief. Depending on how I build the airgapped system, they could figure out how to steal my credentials. The more complex I make my system, the more technically advanced the attacker would have to be to circumvent it. For example:

• I build a system on a Raspberry Pi, unencrypted -> the attacker modifies my SD card to include keylogger
• I encrypt the system -> the attacker takes my SD card, replaces it with a similar, unencrypted one with a fake bootloader to phish me, then steals my credentials after I use it
• I do the above and place a secret on the encrypted SD card so I can verify its integrity -> the attacker just puts the keylogger on the unencrypted bootloader/firmware and leaves the encrypted portion of the card intact
• I do the above, plus run a program on my encrypted storage to verify the integrity of the bootloader and firmware (is this even possible on a Pi?) -> the attacker makes their firmware look untampered to my program
• I do the above, plus encase the whole system in epoxy or something -> at worst, the attacker has to go through the effort to steal my SD card from the casing, then build an identical-looking system to phish me. This would be a massive pain for them, but it would also be a massive pain for me to initially build the system.
• I rebuild the system from scratch (no epoxy) every time I need to sign something -> This is also a pain, and if I consider the possibility that the attacker has tampered with my hardware, then I have to go out and buy a new board each time.

So instead of trying to build something myself, I could use something that's already out there. Yubikeys are popular and have secure, tamper-resistant hardware that I could put my trust in to protect my key from getting leaked. But I'm not comfortable with the fact that someone could just take my Yubikey (e.g., while I'm asleep), go sign some data, and then return it to me. Once I find out that someone has impersonated me, then I pretty much have to revoke my key. If I don't find out someone has impersonated me, then that might be worse. Yeah, I can set a PIN on it, but I have to enter it through the Yubikey app on a computer. Someone with physical access to my Yubikey also has physical access to my laptop (which I am less careful with) and possibly even my home network. So I bet they could phish my PIN. To mitigate this I have to go through all the lengths to build that airgapped tamper-resistant system, which is what I'm trying to avoid in the first place.

OnlyKey requires a PIN, but just looking at the firmware source code, I'm not certain the PIN is actually used to encrypt the sensitive material on the device. If it's not encrypted, then somebody who does computer engineering for fun (I know many) could probably break into it if they had physical access. If it is encrypted, they still could by extracting the memory and brute forcing the PIN (8-10 digits from 1 to 6) on the computer. Not a serious security option IMO, although they are talking on the forums about an upcoming Pro device which will feature encryption. OnlyKey does encrypt secrets at rest. I need to read the security documentation more.

Hardware wallets, though. After reading about the Trezor's security features, I am convinced that it was designed to be resistant both to remote and physical attacks. My understanding is that they store secrets encrypted with a PIN (that can be much longer than 10 digits), so an attacker can't get them if they open the device. The older ones that require you to enter the PIN on your computer do it in a clever way: the device creates a scrambled keypad that it shows to you on its screen, and you click the buttons in corresponding positions on the computer. The scrambling is random and the computer doesn't know which position corresponds to which number, so malware can't take your PIN. The Trezor Safe models even have a secure element, which I understand further protects your secrets from physical tampering, though I'm not sure precisely how. The Trezor devices and some other crypto hardware wallets support a GPG agent. On the trezor, my understanding is that the key will be generated deterministically on the device using its seed, so I suppose there is a disadvantage if your private key (somehow) gets compromised and you have to revoke it, then you will have to use an entirely new seed.

All-in-all, it seems to me like hardware wallets, while initially designed for crypto, would also be the most secure way to generate and store a GPG key, while also providing lots of convenience (I could sign keys on my malware infested personal laptop!). But I don't see them mentioned a lot. Why is this? Am I wrong in my assessment?

When I try to encrypt a message it says error public key unusable no matter who I try to send it to. I can decrypt just fine. It was working fine last month. Any help is greatly appreciated

Hi guys,

i have an excel filles with 500 rows (cell a1 till 500). In each row is an pgp encrypted message. (starts with ---begin pgp message--- & ends with ---end pgp message---.

I can decrypt the message by copying the contect of the cell in notepad section in kleopatra then decrypt the content, and copy the message in cell b1 (to b500).

But how can i speed this up? This will take me ages.

Any solution with VBA or a beginners guide i can find somewhere?

Edit: to clarify, excell file itself is not encryped, alle the messages in each cell are

Edit2: I got it! I used Python (which I knew nothing about just three hours ago), and ChatGPT wrote the code for me with lots of trial and error. The program retrieves encrypted messages from column A, decrypts them using GPG, and stores the decrypted messages in column B, processing cell by cell. The data was originally in a .csv file, and it took me some time to realize that Excel had added an extra line break when converting the data from CSV to XLSX...

Hi all, I am running into a weird situation with gnupg (that may be simply due to my ignorance/misunderstanding): I have an application that is trying to check a key's status (in terms of expiration, having valid signing subkeys, etc). We have no trustdb.gpg created and would like to rely on --import --import-options show only to simply display the key data.

By using --trust-model always and --no-auto-check-trustdb, a simple --import will work as expected (it imports the key), but if I also pass --import-options show only, it seems to fail with a ERROR: gpg: Fatal: can't open '/foo/bar/baz/.gnupg/trustdb.gpg': No such file or directory

Is there any way to avoid touching the trustdb, or alternatively, generating a trustdb.gpg without a keyring to simply show the contents of a key?

Any help is much appreciated!

Computer all of a sudden died on me and I have a text file containing the key but can not for the life of me get it to work on openkeychain android. Really hoping when I get a new pc I will be able to import my secret key using a text file. Any advice appreciated. Stressing because that key was for wallet keys that has half my net worth in it.

If i symmetrically encrypt a file that requires a passphrase to be created to do so, is it actually possible to recover the key and save it to a file? Or is creating a shared secret just saving the passphrase to a file and encrypting it with the receivers public key?

I'm really struggling to decrypt a PGP-encrypted external hard drive from around 2005. I can access the file, and I have the original PGP 8.1 installation file along with my license number. However, the software only runs on Windows XP. I've set up an old computer with XP SP3, and installed PGP 8.1, but I'm hitting a wall with license authorization—it won't connect for online authorization, and manual authorization isn't working either. Although the software recognizes the disk, it requires a licensed version to decrypt it.

I thought about purchasing a newer version of PGP, but it has since been acquired by Broadcom, and I can't find a purchasing option on their less-than-helpful website, additionally, I'm not sure it will work either according to ChatGPT there is a "chance," but no guarantee.

Do you think it’s possible to decrypt this drive using GnuPG or other ideas? While I'm fairly tech-savvy, I'm a n00b when it comes to encryption.

So I have tor running and it opens a socks proxy at localhost:9050. I want to fetch some keys from keys.openpgp.org but I am getting configuration error

The command I run is

gpg --verbose --keyserver-options "http-proxy=socks5://127.0.0.1:9050" --keyserver hkps://keys.openpgp.org --recv-keys EFB9ACCD95CBA34198040A2EE9C4F4EE327CFE76

I get the error

gpg: keyserver receive failed: Configuration error

I dont want to alter my gpg.conf as this is only for this one case.

I am using Linux Mint 21.3 which is based on Ubuntu Jammy and my gpg version is 2.2.27

Solved 💡 Was missing some development libraries, which I added right after installing build-essential

RUN apt-get install zlib1g-dev -y
RUN apt-get install libbz2-dev -y

Hi all

Sorry in advance, I am not extremely linux savvy, but I have been tasked with upgrading our hosting environment from using GnuPG 2.2 to using 2.4.5. The problem however is that the same encrypted files fail on the upgraded system, which uses 2.4.5. The error is:

gpg: uncompressing failed: Unknown compression algorithm

I have tried a lot (I think), like specifying different compression algorithms, installing compression libraries, but to no avail.

The output of --version is:

gpg (GnuPG) 2.4.5
libgcrypt 1.11.0
Copyright (C) 2024 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed

I am wondering if the reason is that it only supports "Uncompressed"? In the old 2.2 it lists multiple compression algorithms:

gpg (GnuPG) 2.2.27
libgcrypt 1.8.8
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

And here is the snippet from my Dockerfile, which installs GnuPG 2.4.5:

# Install required tools
RUN apt-get update
RUN apt-get install bzip2 -y
RUN apt-get install build-essential -y

# Install required libraries
RUN wget https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.50.tar.bz2
RUN tar -xvf libgpg-error-1.50.tar.bz2
RUN cd libgpg-error-1.50 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-1.11.0.tar.bz2
RUN tar -xvf libgcrypt-1.11.0.tar.bz2
RUN cd libgcrypt-1.11.0 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libassuan/libassuan-3.0.1.tar.bz2
RUN tar -xvf libassuan-3.0.1.tar.bz2
RUN cd libassuan-3.0.1 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/libksba/libksba-1.6.7.tar.bz2
RUN tar -xvf libksba-1.6.7.tar.bz2
RUN cd libksba-1.6.7 && ./configure && make && make install

RUN wget https://gnupg.org/ftp/gcrypt/npth/npth-1.7.tar.bz2
RUN tar -xvf npth-1.7.tar.bz2
RUN cd npth-1.7 && ./configure && make && make install

# Install gnupg 2.4.5
RUN wget https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.4.5.tar.bz2
RUN tar -xvf gnupg-2.4.5.tar.bz2
RUN cd gnupg-2.4.5 && ./configure && make && make install

Hi

I was wondering if there was a known standardised method to set the filename of an output file to an encrypted hash?

So for example the command gpg --encrypt --recipient alice@cyb.org --output hashing bank_document.txt would generate a file like hj289dm.txt. Such that the file could only be decrypted and be unhashed by alice's private key?

Thankyou

Introducing our new macOS Mail PGP Extension! Experience top-notch email security with effortless PGP encryption right within your Mail app. Enhance your privacy and keep your communications safe. Download now and secure your inbox!

https://macmailpgp.com

Good day,

We are a set of companies that have lots of senders, via a government dictated hub and then a small receiver set.
The history is that the hub got a company to create a "custom" app to generate the private/public keys, which basically is an antiquated PGP of sorts, if not an early gnupg 1.x

The key pair is generated this way every 4 months, and then the public key shipped to all the senders, and the secret key shared with the receivers - common pub-private key setup.

The "problem" now is that app is a pain to run for me (need to find some x86 Windows VM while I'm on Apple Silicon and Linux servers), and when we did run the GnuPG2 keygen, it came out that GnuPG generated a primary and subkey with split SC & E, while the antiquated custom software does a single key, with SCEA feature to the key.

example differences between the keys:

sec   rsa2048 2024-05-14 [SCEA] [expires: 2024-10-04]
      6AB9B48E00E3F07AEC14C435701D5549DA644AFB
uid           [ unknown] old_key_name


sec   rsa3072 2024-09-18 [SC] [expires: 2025-02-04]
      4EC6C78CB5AEEF773302994ABF85511CDDAE8DD7
uid           [ unknown] gnupg2_key_name
ssb   rsa3072 2024-09-18 [E] [expires: 2025-02-04]

So the problem now is that the public key was distributed to the senders, and they've been using that happily, just... *some* of the receivers now can't decrypt, with the grapevine (via the hub admins) that the keys are `incompatible`

the encrypted files was all decrypted with the 4EC6C78CB5AEEF773302994ABF85511CDDAE8DD7 key from myside.

HELP!!!

Also how to create the key to be only a single key-pair with SCEA settings?

Ok, this might get embarrassing since I just started to use gpg in my workflow.

So I created a primary key with a subkey for signing and a subkey for encryption. Now I wanted to add all my ssh keys to this primary key following https://superuser.com/questions/1414381/how-to-import-an-ssh-ed25519-key-to-gpg.

Is there a way I can mark/tag my new subkeys so I know which one to use for which server?

Or am I completely off what I try to do and misunderstanding how to use gpg subkeys and/or how to use gpg for ssh authentication?

Please be nice to a noob :-D

Now I know it says you shouldn't, as well as gives a warning, but I am wondering if there is a way to do so anyway (knowing the risks).

If anyone can provide any insight or direction, I'd be very grateful. Thank you.

I made my key a while back on a different application and have spent 3 hours trying to import it into cleo but it keeps just saying “imported: 0” and i do not understand why. I have tried EVERYTHING and it simply just will not allow me. I really need to decrypt a message but it wont allow me on any other application for some reason, so the sender told me to try cleo. I cant for the life of me figure out what i could be doing wrong.

I forget it and I don't know how to recover it? Please help

Is there any way to use GPG inside of a text editor WITHOUT installing GPG Suite for Mac?  The reason is that I have a key with curve 448 which is not supported by GPG Suite.

hello,

I'm writing a script that should check if gpg-agent is already unlocked, is there a way to do it?

tried to search a bit with gpg-agent and gpg-connect-agent but maybe I'm looking for the wrong approach.

any help appreciated.

thanks

edit - solved:

gpg-connect-agent "GET_PASSPHRASE --data --no-ask KEY t1 t2 t3" /bye

https://gnupg-users.gnupg.narkive.com/hAQna4v1/is-gpg-agent-passphrase-status-query-possible

Why do these commands:

/usr/bin/gpg --pinentry-mode=loopback --batch --passphrase password --quick-generate-key  rsa4096
/usr/bin/gpg --pinentry-mode=loopback --batch --passphrase password --quick-generate-key  rsa4096
echo "This is a test" > /tmp/tmp692499503
/usr/bin/gpg --pinentry-mode=loopback --passphrase password --output /tmp/tmp692499503.gpg --encrypt --armor --recipient  /tmp/tmp692499503user1@example.comuser2@example.comuser1@example.com

Give me this output:

gpg: key 603EE7D84AF4910A marked as ultimately trusted
gpg: revocation certificate stored as '/home/personal/.gnupg/openpgp-revocs.d/EC757DEBB42A81C3F74DC136603EE7D84AF4910A.rev'
gpg: key 6D4BD9137F7CCC09 marked as ultimately trusted
gpg: revocation certificate stored as '/home/personal/.gnupg/openpgp-revocs.d/C322ABE2D32ED2EB047EDD3F6D4BD9137F7CCC09.rev'
gpg: error retrieving 'user1@example.com' via Local: Unusable public key
gpg: error retrieving 'user1@example.com' via WKD: No data
gpg: user1@example.com: skipped: No data
gpg: /tmp/tmp692499503: encryption failed: No data

Using -expert full-keygen in MacOS terminal, I have created a new keypair with the curve 448.  But it doesn't appear in GPG Keychain.  When I open the key in the text editor and copy its content, GPG Keychain crashes.

Hi I have been trying to work out how to pgp pages to open. I haven't sent an e-mails yet. I've no luck. I have tried everything I can think of I would greatly appreciate any help or suggest a link or something. cheers I appreciate your time.

Anyone having thoughts on how this bifurcation may affect usage and interoperability of gnupg in the future? What about key management?