Collaborate Disseminate
There’s a new, practical, collision attack against SHA-1: In this paper, we report the first practical implementation of this attack, and its impact on real-world security with a PGP/GnuPG impersonation attack. We managed to significantly reduce the co… Continue reading New SHA-1 Attack
There’s a new, practical, collision attack against SHA-1: In this paper, we report the first practical implementation of this attack, and its impact on real-world security with a PGP/GnuPG impersonation attack. We managed to significantly reduce the complexity of collisions attack against SHA-1: on an Nvidia GTX 970, identical-prefix collisions can now be computed with a complexity of 261.2rather than264.7,… Continue reading New SHA-1 Attack
When I verify a file signature I get the the following warning:
$ gpg –verify file.sig
gpg: Signature made So 01 Dez 2019 10:08:27 CET
gpg: using RSA key <Pierre’s key ID>
gpg: Good signature from “Pier… Continue reading Why GPG signature is not considered as made by a trusted key?
I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data.
Recently, my colleagues told me: “You should create a 2048-bit to get… Continue reading Is it possible to decrypt a PGP encrypted file without private key?
Years ago, I once used GnuPG client on a Mac OS to encrypt some large files. At one point, I was given a warning that one of my files was too large, and that as a result file integrity could not be guaranteed. I don’t use tha… Continue reading Are there any size constraints with GPG?
I tried to simulate this attack in my PC but I could not generate a poison key, I used Linux (Ubuntu 18.04) and GPG software (gpg (GnuPG) 2.2.4). I tried to manipulate public key and import it to pubkeyring as a poisoned key … Continue reading how to simulate gpg severkey DoS attack?
Say you created some IP in the form of some files. How do you prove that you created the IP, in a theoretical cryptographic sense? A major constraint is to maintain security as well, so you can’t just create a patent which will share the i… Continue reading How to Prove you created Intellectual Property (IP) using a Notary
I submitted my GPG key to the keyserver earlier. Now I got signatures on my key. Can I republish it? gpg –send-keys doesn’t seem to alter my key any more, but doesn’t spit out any error either.
I am searching for the most security problem that affects PGP(Pretty Good Privacy) to analysis it as a research project in IT security subject, and I want some help to know which is that problem and the tools that will help m… Continue reading Looking for a PGP security problem to study in a research project
Keybase’s decryption page says “you must host your private key in Keybase’s encrypted key store.” This really rubs me the wrong way. I was under the impression that your private key should not leave your device, ever (Keybase… Continue reading Is there a secure way to host private PGP keys (is keybase’s method secure?)