Re: OpenLDAP schema to store OpenPGP keys?

2011-02-03 Thread Sascha Silbe
Excerpts from 's message of Mon Feb 20 10:56:32 +0100 2006: Walter Haidinger schrieb am Samstag, dem 18. Feber 2006: Now, I'd like to setup an OpenLDAP server to store the OpenPGP keys (for use with GnuPG). [...] However, I was unable to find any schema definiton...

Crontab running gpg script can’t find secret key

2011-02-03 Thread griffmcc
Although I can encrypt a file using a script, when crontab runs the same script, it returns the error message “no default secret key: No secret key”. I have one secret key: sananselmo backupscripts.d # gpg --list-secret-keys /root/.gnupg/secring.gpg sec

Re: Crontab running gpg script can’t find secret key

2011-02-03 Thread David Smith
griffmcc wrote: Although I can encrypt a file using a script, when crontab runs the same script, it returns the error message “no default secret key: No secret key”. I have one secret key: sananselmo backupscripts.d # gpg --list-secret-keys /root/.gnupg/secring.gpg

Re: OpenLDAP schema to store OpenPGP keys?

2011-02-03 Thread Peter Palfrader
On Thu, 03 Feb 2011, Sascha Silbe wrote: Excerpts from 's message of Mon Feb 20 10:56:32 +0100 2006: Walter Haidinger schrieb am Samstag, dem 18. Feber 2006: Now, I'd like to setup an OpenLDAP server to store the OpenPGP keys (for use with GnuPG). [...] However, I was unable to

Add/remove recipient without re-encrypting

2011-02-03 Thread Alphazo
Is it possible to add or remove a recipient to an already encrypted file and thus without re-encrypting the whole file? From what I understand GnuPG encrypts the payload (my binary file) with a symmetric session key. Then it stores each recipient key ID (optional) as well as an encrypted version

Re: Add/remove recipient without re-encrypting

2011-02-03 Thread Robert J. Hansen
On 2/3/11 9:38 AM, Alphazo wrote: Is it possible to add or remove a recipient to an already encrypted file and thus without re-encrypting the whole file? Technically, yes, although you would need to write the tool yourself. Assuming I own the private key of one the original recipient, could

Re: Add/remove recipient without re-encrypting

2011-02-03 Thread Hauke Laging
Am Donnerstag 03 Februar 2011 15:38:12 schrieb Alphazo: Is it possible to add or remove a recipient to an already encrypted file and thus without re-encrypting the whole file? Not an answer but a proposal: I have read this question several times on this list. I know that this is possible

Re: Add/remove recipient without re-encrypting

2011-02-03 Thread Nicolas Boullis
Hello, On Thu, Feb 03, 2011 at 03:38:12PM +0100, Alphazo wrote: Is it possible to add or remove a recipient to an already encrypted file and thus without re-encrypting the whole file? From what I understand GnuPG encrypts the payload (my binary file) with a symmetric session key. Then it

GPG Decrypt Messages

2011-02-03 Thread hare krishna
Hi, Can some please help me how to avoid these messages whenever the gpg files is decrypted. Here are the messages gpg: Signature made Wed Feb 02 14:26:25 2011 PST using DSA key ID BD6608B2 gpg: Good signature from umesh (GPG encryptionl) a...@xxx.com It is printing in logs everytime. Please

Is commerical PGP.com compatible with Gnupg ???

2011-02-03 Thread Keith Theman
Hello, Is the pgp from pgp.com compatible with gnupg ?? Is gnupg FIPS 140-2 compliant? Dave ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Is commerical PGP.com compatible with Gnupg ???

2011-02-03 Thread Robert J. Hansen
On 2/3/11 12:34 PM, Keith Theman wrote: Is the pgp from pgp.com compatible with gnupg ?? Generally, yes. PGP holds a patent on the Additional Decryption Key functionality (which GnuPG developers have said will not be implemented in GnuPG, even if it weren't patented), though, so that's an

Re: learning which symmetric cipher via --status-fd when --decrypting

2011-02-03 Thread Werner Koch
On Thu, 3 Feb 2011 08:28, d...@fifthhorseman.net said: is there a way for a program that parses --status-fd to get this Not yet. information, or does the program need to parse --logger-fd as well to better don't do that; the messages may change. What about this new feature:

Re: learning which symmetric cipher via --status-fd when --decrypting

2011-02-03 Thread Daniel Kahn Gillmor
On 02/03/2011 03:01 PM, Werner Koch wrote: On Thu, 3 Feb 2011 08:28, d...@fifthhorseman.net said: is there a way for a program that parses --status-fd to get this Not yet. information, or does the program need to parse --logger-fd as well to better don't do that; the messages may

moving user ID Comments to --expert mode

2011-02-03 Thread Daniel Kahn Gillmor
Hi folks-- I'd like to propose that GnuPG only prompt the user for a Comment for their User ID under --expert mode. Here's why: * most people just need a simple identity-driven OpenPGP certificate, one that matches their name and e-mail address. * new users see the prompt and think they need

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 3:59 PM, Daniel Kahn Gillmor wrote: * most people just need a simple identity-driven OpenPGP certificate, one that matches their name and e-mail address. Whenever people talk about what most users need, I have to ask to see the user survey that's showing this. History has shown that

Re: learning which symmetric cipher via --status-fd when --decrypting

2011-02-03 Thread Werner Koch
On Thu, 3 Feb 2011 21:13, d...@fifthhorseman.net said: This looks great. Thanks, Werner! Can we expect this in the 1.x and 2.0.x branches as well? Hmmm. If you really want that please out it into the tracker; there is a topic keyword backport. Shalom-Salam, Werner -- Die Gedanken

Re: Crontab running gpg script can’t find secret key

2011-02-03 Thread griffmcc
The user running the cron job is root and the owner of the key is root. I know this because I added whoami whoami.txt to the script and the contents of the file were root. David SMITH-4 wrote: griffmcc wrote: Although I can encrypt a file using a script, when crontab runs the same

Solution: Crontab running gpg script can’t find secret key

2011-02-03 Thread griffmcc
Here's what works for me: echo 'password' | gpg -vvv --homedir /root/.gnupg --batch --passphrase-fd 0 --output /usr/share/file.gpg --encrypt --sign /usr/share/file.tar.bz2 -- View this message in context:

Re: learning which symmetric cipher via --status-fd when --decrypting

2011-02-03 Thread Daniel Kahn Gillmor
On 02/03/2011 04:19 PM, Werner Koch wrote: On Thu, 3 Feb 2011 21:13, d...@fifthhorseman.net said: This looks great. Thanks, Werner! Can we expect this in the 1.x and 2.0.x branches as well? Hmmm. If you really want that please out it into the tracker; there is a topic keyword

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Daniel Kahn Gillmor
On 02/03/2011 04:07 PM, Robert J. Hansen wrote: On 2/3/11 3:59 PM, Daniel Kahn Gillmor wrote: * most people just need a simple identity-driven OpenPGP certificate, one that matches their name and e-mail address. Whenever people talk about what most users need, I have to ask to see the user

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 4:30 PM, Daniel Kahn Gillmor wrote: my user survey is from several years of trying to personally help dozens of people of all skill levels learn how to use OpenPGP for secure messaging. Regardless of the intelligence or technical savvy of the people i've personally helped get more

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Jameson Rollins
On Thu, 03 Feb 2011 17:10:58 -0500, Robert J. Hansen r...@sixdemonbag.org wrote: On 2/3/11 4:30 PM, Daniel Kahn Gillmor wrote: my user survey is from several years of trying to personally help dozens of people of all skill levels learn how to use OpenPGP for secure messaging. Regardless

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Dirk Walter
I like the idea of adding the (Optional) to the prompt because I'm a big fan of optional fields being marked as such. This is an simple and elegant fix to an issue. And I'd hesitate to move it to expert since we have been (ab)using the comment field for our keys, then again this is being used by

Re: Solution: Crontab running gpg script can’t find secret key

2011-02-03 Thread Ingo Klöcker
On Thursday 03 February 2011, griffmcc wrote: Here's what works for me: echo 'password' | gpg -vvv --homedir /root/.gnupg --batch --passphrase-fd 0 --output /usr/share/file.gpg --encrypt --sign /usr/share/file.tar.bz2 I suggest setting the passphrase of the key to an empty passphrase.

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Jerry
On Thu, 03 Feb 2011 16:30:00 -0500 Daniel Kahn Gillmor d...@fifthhorseman.net articulated: On 02/03/2011 04:07 PM, Robert J. Hansen wrote: On 2/3/11 3:59 PM, Daniel Kahn Gillmor wrote: * most people just need a simple identity-driven OpenPGP certificate, one that matches their name and

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Daniel Kahn Gillmor
On 02/03/2011 05:22 PM, Jameson Rollins wrote: On Thu, 03 Feb 2011 17:10:58 -0500, Robert J. Hansen r...@sixdemonbag.org wrote: Zero. Comments don't get certified. All my signature means is I have met this person face to face, have seen two forms of government identification, have

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 5:47 PM, Daniel Kahn Gillmor wrote: By certifying the full user ID you are also certifying the comment. This is not how either OpenPGP or GnuPG work. Certifiers get to define what their certifications mean. Bang, period, end of sentence. There are *no* certification semantics in

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Hauke Laging
Am Donnerstag 03 Februar 2011 23:22:38 schrieb Jameson Rollins: I think this is why his original suggestion was to move it instead to --expert. Moving it to --expert makes a lot of sense to me. Perhaps it makes sense to extend the output of --gen-key by a hint like Additional features are

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Doug Barton
On 02/03/2011 15:16, Hauke Laging wrote: Am Donnerstag 03 Februar 2011 23:22:38 schrieb Jameson Rollins: I think this is why his original suggestion was to move it instead to --expert. Moving it to --expert makes a lot of sense to me. Perhaps it makes sense to extend the output of --gen-key

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Doug Barton
On 02/03/2011 14:22, Jameson Rollins wrote: I have to agree with Daniel that I have in fact honestly never spoken to anyone who was*not* confused by that field. I can't ever remember seeing a comment field used in any way that made sense to me. I'm as pedantic as the next geeky dev, but I

Re: moving user ID Comments to --expert mode

2011-02-03 Thread David Shaw
On Feb 3, 2011, at 5:10 PM, Robert J. Hansen wrote: I invite you to look through the User IDs in your own keyring, from the perspective of a potential certifier, and ask yourself what does it mean for me to certify these comments? Zero. Comments don't get certified. All my signature means

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 6:30 PM, David Shaw wrote: Or are you arguing the *meaning* of the certification (you may or may not sign the user ID, but if you did sign it, the comment part should be considered null and void in terms of your particular certification)? This. I may agree with the comment, I may

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Jameson Rollins
On Thu, 03 Feb 2011 17:54:39 -0500, Robert J. Hansen r...@sixdemonbag.org wrote: But i suspect he would not want to certify this User ID: Daniel Kahn Gillmor (I am really Robert Hansen) d...@fifthhorseman.net Correct. Because the presence of my signature means something. The

Re: learning which symmetric cipher via --status-fd when decrypting

2011-02-03 Thread vedaal
Message: 8 Date: Thu, 03 Feb 2011 02:28:05 -0500 From: Daniel Kahn Gillmor d...@fifthhorseman.net is there a way to get information about which symmetric cipher was used on an encrypted message when decrypting? There may be other direct ways, but a simple unexpected way, is to use the option

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 6:09 PM, Jameson Rollins wrote: Just out of curiosity, can you explain why you wouldn't sign dkg's hypothetical user ID? Because with a comment like that, my impression would be that he was aiming to deliberately yank my chain: and why should I put up with that? To use that as an

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Matthew James Goins
On Thu, Feb 03, 2011 at 04:07:40PM -0500, Robert J. Hansen wrote: Whenever people talk about what most users need, I have to ask to see the user survey that's showing this. I don't think it matters what the real numbers are. We've all seen user ids with utterly unhelpful comments, and it stands

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 5:32 PM, Matthew James Goins wrote: Personally I've never seen a comment that helped me identify the owner of a key in a meaningful way. The problem with anecdote is everyone's anecdote is different. As a ham radio operator (KC0SJE), I have a fair number of keys that have comments of

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 8:17 PM, Doug Barton wrote: So, you're saying that hams are not smart enough to figure out how to use expert mode if they really want this functionality? :) You're moving the goalposts. That was responding to someone who denied the usefulness of comments at all. If I'm establishing

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Doug Barton
On 02/03/2011 17:23, Robert J. Hansen wrote: On 2/3/11 8:17 PM, Doug Barton wrote: So, you're saying that hams are not smart enough to figure out how to use expert mode if they really want this functionality? :) You're moving the goalposts. That was responding to someone who denied the

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Doug Barton
On 02/03/2011 17:10, Robert J. Hansen wrote: On 2/3/11 5:32 PM, Matthew James Goins wrote: Personally I've never seen a comment that helped me identify the owner of a key in a meaningful way. The problem with anecdote is everyone's anecdote is different. As a ham radio operator (KC0SJE), I

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/3/11 8:36 PM, Doug Barton wrote: then it's disingenuous to say but they can just use expert mode. Why? Because it does not recognize the validity of a well-answered question. When a question is asked and answered, it is good form to recognize the answer, rather than say ... well,

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 El 03-02-2011 22:17, Doug Barton escribió: On 02/03/2011 17:10, Robert J. Hansen wrote: ... The problem with anecdote is everyone's anecdote is different. As a ham radio operator (KC0SJE), I have a fair number of keys that have comments of

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Werner Koch
On Thu, 3 Feb 2011 21:59, d...@fifthhorseman.net said: * new users see the prompt and think they need to enter something there, without understanding why or what to put there. This leads to people either making a witticism (e.g. No Comment), repeating their I have only seen a few of these

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Doug Barton
On 02/03/2011 17:52, Robert J. Hansen wrote: On 2/3/11 8:36 PM, Doug Barton wrote: then it's disingenuous to say but they can just use expert mode. Why? Because it does not recognize the validity of a well-answered question. I recognized it, but I don't think the answer is as central

Re: moving user ID Comments to --expert mode

2011-02-03 Thread Robert J. Hansen
On 2/4/11 2:16 AM, Doug Barton wrote: I recognized it, but I don't think the answer is as central to the question of moving comments to expert mode as you do. Daniel's argument boils down... I wasn't responding to Daniel. I was responding to Matt Goins, as was shown in my message, who said he