Collaborate Disseminate
I have certificate that expires in two years. I’ll probably try to participate in key signing party so I get to know what it actually looks like.
What happens in two years? When my certificate expires, and I’ll renew it by s… Continue reading How does PGP web of trust handle certificate expiration?
I’m trying to figure out how to generate private key for the Root CA according the principles of WebTrust.
One additional requirement I have that the generate private key should be then imported to any HSM, independent of th… Continue reading Root CA key generation compliant with WebTrust and HSM independent
Someone signed my PGP key, by accident (we have never met, but I know the person a little).
The wrong signature was uploaded to the SKS pool.
Is there anything we can do about it to improve the web of trust again?
If I’m a trusted user in the web-of-trust but my private key gets stolen by Eve, how would other users find out that my key is compromised and thus cannot be trusted anymore? Is there a way for them to find out and revoke the… Continue reading What happens if my private key gets stolen in the web of trust?
I find the common procedure of key signing parties a little awkward:
Person A presents the passport and a fingerprint “This is my key!”. Person B checks the passports and decides a level of trust to sign the key at home.
No… Continue reading Why do people check the passport on key signing events?
I’m new to GPG and I am having a difficult time verifying anything. How can I populate a keyring with trusted keys, but knowing any?
Could someone list the fingerprints of public keys of Whonix, Tails, Tor, Qubes, Keepass, a… Continue reading Empty GPG keyring [on hold]
My question is about openPGP and the GnuPG implementation in particular.
The web of trust idea seems to have your public keys signed by those who meticulously verify it. So when someone does this verifications, he could send… Continue reading Is there a maximum for the number of certifications on a PGP public key
I frequently use GPG to verify downloads. By doing that I implicitly put trust in a key provided by the author. At least I trust the key enough to run software verified using the given key on my computer. Some examples might … Continue reading Is it responsible to sign an OpenPGP key without verifying person’s identity?
If a signature was made before the key was revoked will it still be considered as valid after revocation? Assuming that the key was revoked as superseded, the answer is obvious if the key was compromised.
In particular I’m i… Continue reading Is an OpenPGP signature made before a key is revoked considered valid?
GnuPG offers a set of different trust models, but the manual isn’t sufficient (for me at least) to figure out which one to use.
Ideally, I would like a trust model that accepts the trust I explicitly assign to a key using Gn… Continue reading How should I choose a trust model in GnuPG?