Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Can I configure this so that I don't have the two keys on the same system? I'd like encrypt with my remote system and decrypt with my local system. Is that possible? It seems like importing my private key also imports the public key. I'm a bit confused as to what you're trying to do. If you are encrypting mail to other people, you should be using *their* public key, not your own. The only case where you need your public key is to encrypt mail to *yourself*; otherwise you don't need either of your keys on the remote system. Should I delete the private key from the remote system? It sounds like the public key can always be regenerated from the private key so there's no use in deleting it from the local system. Yes to both statements. Having your private key on the remote system is an unnecessary risk, since you don't need it to encrypt data and it's exposed to anyone else with access to that system. And, though I haven't done it, GnuPG's docs say that the public key can easily (one gpg command) be regenerated from the private key, so you may as well keep it around for convenience. Perfect, thanks everyone. - Grant
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Can I configure this so that I don't have the two keys on the same system? I'd like encrypt with my remote system and decrypt with my local system. Is that possible? It seems like importing my private key also imports the public key. I'm a bit confused as to what you're trying to do. If you are encrypting mail to other people, you should be using *their* public key, not your own. The only case where you need your public key is to encrypt mail to *yourself*; otherwise you don't need either of your keys on the remote system. I'm trying to encrypt email on my remote system and read it on my local system. I'm the only one who needs to read the mail. Should I delete the private key from the remote system? It sounds like the public key can always be regenerated from the private key so there's no use in deleting it from the local system. - Grant
[gentoo-user] {OT} GPG: pub sec keys required to decrypt?
I've been encrypting and decrypting email on the same remote server. I was under the impression that this was a security risk because it meant having the public and private keys on the same machine. I tried importing the public key to my local system and decrypting via enigmail but I got Error - secret key needed to decrypt message. I imported the private key locally and now it decrypts fine, but I have both keys on the same system again. My understanding of GPG is weak. Can someone point out my misconception(s)? - Grant
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
On Tue, Sep 9, 2008 at 18:09, Grant [EMAIL PROTECTED] wrote: I've been encrypting and decrypting email on the same remote server. I was under the impression that this was a security risk because it meant having the public and private keys on the same machine. I tried importing the public key to my local system and decrypting via enigmail but I got Error - secret key needed to decrypt message. I imported the private key locally and now it decrypts fine, but I have both keys on the same system again. My understanding of GPG is weak. Can someone point out my misconception(s)? Hi, you need the recipient's public key to encrypt the message. This message will be decrypted with the recipient's private key. So if you encrypt something for yourself, you'll need your public key to encrypt and your public key to decrypt. Regards, Boris. - Grant -- $ ruby -e'puts .:@BFegiklnorst.unpack(x4ax7aaX6ax5aX15ax4aax6aaX7ax2 \ aX5aX8axaX3ax8aX4ax6aX3aX6ax3ax3aX9ax4ax2aX9axaX6ax3aX2ax4 \ ax3aX4aXaX12ax10aaX7a).join'
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
So if you encrypt something for yourself, you'll need your public key to encrypt and your public key to decrypt. Little correction, you need the PRIVATE key to decrypt. Everybody has the public key but since you don't want everybody to be able to decrypt, it's done with the private key. But you want everybody to encrypt things to you, so the public key is used for encryption. Regards, Sascha signature.asc Description: OpenPGP digital signature
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
I've been encrypting and decrypting email on the same remote server. I was under the impression that this was a security risk because it meant having the public and private keys on the same machine. I tried importing the public key to my local system and decrypting via enigmail but I got Error - secret key needed to decrypt message. I imported the private key locally and now it decrypts fine, but I have both keys on the same system again. My understanding of GPG is weak. Can someone point out my misconception(s)? Hi, you need the recipient's public key to encrypt the message. This message will be decrypted with the recipient's private key. So if you encrypt something for yourself, you'll need your public key to encrypt and your public key to decrypt. Regards, Boris. It looks like I've imported a pub/sec keypair now. Should I remove the public key for security? Maybe I misunderstood from the beginning and having both keys on the same system isn't a security issue? - Grant
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
On Tue, Sep 9, 2008 at 18:40, Sascha Hlusiak [EMAIL PROTECTED] wrote: So if you encrypt something for yourself, you'll need your public key to encrypt and your public key to decrypt. Little correction, you need the PRIVATE key to decrypt. Everybody has the public key but since you don't want everybody to be able to decrypt, it's done with the private key. But you want everybody to encrypt things to you, so the public key is used for encryption. Oh sorry, yes I meant private... Regards, Sascha -- $ ruby -e'puts .:@BFegiklnorst.unpack(x4ax7aaX6ax5aX15ax4aax6aaX7ax2 \ aX5aX8axaX3ax8aX4ax6aX3aX6ax3ax3aX9ax4ax2aX9axaX6ax3aX2ax4 \ ax3aX4aXaX12ax10aaX7a).join'
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
It looks like I've imported a pub/sec keypair now. Should I remove the public key for security? Maybe I misunderstood from the beginning and having both keys on the same system isn't a security issue? - Grant It is still a security issue, but only as much as any other data on your machine. Physical access to the box, or being remotely hacked will always be a security risk. And yes, if someone does break in and copy your pub/sec keypair, they will have full ability to masquerade as you in signed and encrypted emails. You have to weigh it up for yourself really. Many, many keep pub/sec keypairs for their email on more than one machine. Of course it would be a lot of work for someone to compromise your system for your gpg keys, so your email would have to be of value to them. Just my $0.02 Matt
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
On Tue, Sep 9, 2008 at 18:50, Matt Harrison [EMAIL PROTECTED] wrote: It looks like I've imported a pub/sec keypair now. Should I remove the public key for security? Maybe I misunderstood from the beginning and having both keys on the same system isn't a security issue? - Grant It is still a security issue, but only as much as any other data on your machine. Physical access to the box, or being remotely hacked will always be a security risk. And yes, if someone does break in and copy your pub/sec keypair, they will have full ability to masquerade as you in signed and encrypted emails. You have to weigh it up for yourself really. Many, many keep pub/sec keypairs for their email on more than one machine. Of course it would be a lot of work for someone to compromise your system for your gpg keys, so your email would have to be of value to them. It's always possible to generate a revocations certificate and store it in a safe place (CD, usb key etc.) http://www.gnupg.org/gph/en/manual/c14.html regards, Boris. Just my $0.02 Matt -- $ ruby -e'puts .:@BFegiklnorst.unpack(x4ax7aaX6ax5aX15ax4aax6aaX7ax2 \ aX5aX8axaX3ax8aX4ax6aX3aX6ax3ax3aX9ax4ax2aX9axaX6ax3aX2ax4 \ ax3aX4aXaX12ax10aaX7a).join'
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
It looks like I've imported a pub/sec keypair now. Should I remove the public key for security? Maybe I misunderstood from the beginning and having both keys on the same system isn't a security issue? - Grant It is still a security issue, but only as much as any other data on your machine. Physical access to the box, or being remotely hacked will always be a security risk. And yes, if someone does break in and copy your pub/sec keypair, they will have full ability to masquerade as you in signed and encrypted emails. You have to weigh it up for yourself really. Many, many keep pub/sec keypairs for their email on more than one machine. Of course it would be a lot of work for someone to compromise your system for your gpg keys, so your email would have to be of value to them. Can I configure this so that I don't have the two keys on the same system? I'd like encrypt with my remote system and decrypt with my local system. Is that possible? It seems like importing my private key also imports the public key. - Grant
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Grant wrote: My understanding of GPG is weak. Can someone point out my misconception(s)? Speaking from a purely practical standpoint, keeping your private and public keys completely separate is extremely inconvenient with (IMO) a negligible security benefit. However, there is arguably a much bigger security issue with keeping your private key on a remote server, particularly one you have no control over. Pulling your keypair locally and doing any decryption operations locally is a much easier, and more practical, improvement. If you keep the two halves of your keypair physically separate, then an attacker would need to get two distinct pieces of information in order to break any encryption using your keys. For extremely high security purposes, this may be a worthy benefit. For something like email, your public key should be considered common knowledge anyway. If an attacker can gain control of your private key, the extra burden of getting your public key is insignificant. Put another way: a file containing both your public and private key contains essentially the same amount of secure information as a file containing only your private key. So long as your private key is kept secure, with or without your public key, your risks should be minimal. --K
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Grant wrote: Can I configure this so that I don't have the two keys on the same system? I'd like encrypt with my remote system and decrypt with my local system. Is that possible? It seems like importing my private key also imports the public key. I'm a bit confused as to what you're trying to do. If you are encrypting mail to other people, you should be using *their* public key, not your own. The only case where you need your public key is to encrypt mail to *yourself*; otherwise you don't need either of your keys on the remote system. As far as keeping your public key away from your secret key, I believe it is possible to export just one or the other via gpg then import just that key. But a quick glance through the GnuPG FAQ points out this nugget of information: All OpenPGP secret keys have a copy of the public key inside them, and in a worst-case scenario, you can create yourself a new public key using the secret key. A tool to convert a secret key into a public one has been included (it's actually a new option for gpgsplit) and is available with GnuPG versions 1.2.1 or later (or can be found in CVS). So there's really no point in keeping the two separate. --Mike
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Am Dienstag, 9. September 2008 18:50:54 schrieb Matt Harrison: And yes, if someone does break in and copy your pub/sec keypair, they will have full ability to masquerade as you in signed and encrypted emails. And that's of course only true if the secret key is protected with a weak or no passphrase. Bye... Dirk
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Create 2 couple of key. one for remote, other for local. Il giorno mar, 09/09/2008 alle 10.24 -0700, Grant ha scritto: It looks like I've imported a pub/sec keypair now. Should I remove the public key for security? Maybe I misunderstood from the beginning and having both keys on the same system isn't a security issue? - Grant It is still a security issue, but only as much as any other data on your machine. Physical access to the box, or being remotely hacked will always be a security risk. And yes, if someone does break in and copy your pub/sec keypair, they will have full ability to masquerade as you in signed and encrypted emails. You have to weigh it up for yourself really. Many, many keep pub/sec keypairs for their email on more than one machine. Of course it would be a lot of work for someone to compromise your system for your gpg keys, so your email would have to be of value to them. Can I configure this so that I don't have the two keys on the same system? I'd like encrypt with my remote system and decrypt with my local system. Is that possible? It seems like importing my private key also imports the public key. - Grant signature.asc Description: Questa รจ una parte del messaggio firmata digitalmente
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
Am Dienstag, 9. September 2008 19:24:27 schrieb Grant: Can I configure this so that I don't have the two keys on the same system? Well, on the machine where you created the key pair, you would have to export one of them and then delete it from the local keyring. But why should you? I'd like encrypt with my remote system and decrypt with my local system. Then you need the public key on the remote system. Is that possible? Yes. It seems like importing my private key also imports the public key. Only if you also exported both (to the same file). However, nothing keeps you from removing one of them again after import. HTH... Dirk
Re: [gentoo-user] {OT} GPG: pub sec keys required to decrypt?
On Tuesday 09 September 2008, Dirk Heinrichs wrote: Am Dienstag, 9. September 2008 18:50:54 schrieb Matt Harrison: And yes, if someone does break in and copy your pub/sec keypair, they will have full ability to masquerade as you in signed and encrypted emails. And that's of course only true if the secret key is protected with a weak or no passphrase. That's right. There's three elements of information necessary to encrypt/decrypt a message: 1. Public key - everyone has this as long as you publish it via public keyservers, or as long as you send it to them directly, that's why it is called public. They'll use this to encrypt messages they send to you, which you can only decrypt with your private key. 2. Private key - no one should have this other than your goodself. In the sense that your machine has not been compromised (yet) your private key is secure. On the other hand if your machine had been compromised you would probably have bigger problems to deal with. If you are really paranoid you can keep this key saved on separate media (e.g. a USB stick) and mount that before you encrypt/decrypt mail or data. As a matter of fact it is good practice to store a copy of your private key on separate media in case you want to use your public key and for whatever reason you have lost access to your primary machine (theft, fs corruption, etc). 3. Your passphrase which allows you to decrypt and use your private key. As Dirk said using a key pair without a really strong passphrase or no passphrase at all(!) is rather foolish from a security perspective. So, for someone to be able to readily compromise your encryption they will need to get their hands on your private and public keys, as well as your passphrase. When you have your key pair stored on a server that you have no absolute control over (i.e. you and only you have access to the root passwd and no one with a LiveCD can access it) then your private key's security relies mainly on your unbreakable for practical purposes strong passphrase. HTH. -- Regards, Mick
