Re: Search: Applikation to encrypt on the fly

2012-04-17 Thread Werner Koch
On Tue, 17 Apr 2012 08:04, rica...@martinet.de said: Windows 7 would be nice. But Linux would also OK. Write a system service / daemon, wait for changes in the directory and then call gpg (best via gpgme) to encrypt the file. Or do it with a simple script controlled by a cron job (under Unix).

Re: Search: Applikation to encrypt on the fly

2012-04-17 Thread Werner Koch
On Tue, 17 Apr 2012 09:13, bra...@majic.rs said: Hm... Under GNU/Linux there's ecryptfs, but I'm not sure if it's capable of using a GPG key for decrypting the symmetric key? It GnuPG-2.1-beta comes with the g13 tool which uses an OpenPGP or X.509 key as the encfs key. encfs is just one

Re: unable to preset passphrase

2012-04-20 Thread Werner Koch
On Thu, 19 Apr 2012 23:08, yanaty...@yahoo.com said: I need to automate the porcess of receiving an decrypting files encrypted with a gpg key. Since this is supposed to be an unattended process I need to  preset a passphrase. It would be easier and equally save not to protect the key at

Re: Clarification in man page?

2012-04-20 Thread Werner Koch
On Fri, 20 Apr 2012 14:29, pe...@digitalbrains.com said: myself, and I've seen it mentioned by others on this mailing list. At least on *nix, it's relatively common that options can come in any position of the arguments. That is not a general Unix feature but a GNU feature. Werner, perhaps

Re: Clarification in man page?

2012-04-21 Thread Werner Koch
On Sat, 21 Apr 2012 11:55, pe...@digitalbrains.com said: Why is --armor dropped when it is not wanted as a filename? Sorry, I don't understand you. There is just a note telling the novice that --armor is not an option. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen

Re: gpg4win: homedir option not passed on to gpg-agent

2012-04-23 Thread Werner Koch
On Thu, 19 Apr 2012 11:56, peter.c.dietr...@freenet.de said: I use gpg on Windows XP Sp3 via gpg4win 2.1.1-svn1694. I don't know this version. The last released one is 2.1.0. Meanwhile we switched to git and thus the svn prefix does not make sense anymore. Please test with the 2.1.0.

Re: gpg2

2012-04-24 Thread Werner Koch
On Tue, 24 Apr 2012 09:14, da...@gbenet.com said: I'm using Mint Linux - gpg2 and gpg are both using /.gpg I have no /.gpg2 dir on my system Are you sure? The default home directory is ~/.gnupg and not ~/.gpg . It is not advisable to have different directories for both versions. We took

Re: gpg2

2012-04-24 Thread Werner Koch
On Tue, 24 Apr 2012 12:04, da...@gbenet.com said: I have done as you have suggested. It is to be noted that whenever I install a new Linux disro I always run gpg --version - Linux Mint does not create ~/.gnupg automatically one has I did a quick test by adding a new user on a pretty standard

Re: How to make GPG release the token?

2012-04-26 Thread Werner Koch
On Thu, 26 Apr 2012 06:49, quanngu...@mbm.vn said: I'm using GnuPG and OpenSC to test my token. Each time I've done using GPG, the OpenSC cannot access the token. I have to reboot the computer to use OpenSC. GnuPG requires exclusive access to the card. The best way to work with the card from

Re: Question about how RSA keys are generated in GnuPG

2012-04-29 Thread Werner Koch
On Sun, 29 Apr 2012 04:08, papill...@gmail.com said: This is a stupid question I'm sure but I can't seem to find an answer to it in the source code so I thought I'd ask here. When GnuPG is Tou need to look into Libgcrypt. From its manual: The generation of random prime numbers is based on

Re: Decryption with OpenPGP card fails

2012-04-29 Thread Werner Koch
On Sat, 28 Apr 2012 12:06, edm...@systemli.org said: Hello, I am facing problems decrypting data with my OpenPGP v2 card. Signing however is working just fine. I have collected the following output. The PIN retry counter looks a bit weird, could that be the problem? The 3 0 3 are just fine.

Re: GPG on Windows 7?

2012-05-03 Thread Werner Koch
On Wed, 2 May 2012 20:40, mika.henrik.mai...@hotmail.com said: GPG4Win works on Windows 7 too. http://gpg4win.org/ Except for the explorer extension gpgex, which does not work with the 64 bit explorer. We are planning an update, though. Shalom-Salam, Werner -- Die Gedanken sind frei.

Re: Gpg4Win and GnuPG

2012-05-03 Thread Werner Koch
On Thu, 3 May 2012 10:12, papill...@gmail.com said: Quick question: are there any security concerns with running GnuPG and GPG4Win on the same system? Gpg4win is an installer which includes GnuPG as its crypto engine. In fact, Gpg4win is the suggested way to install GnuPG on Windows. In case

Re: Gpg4Win and GnuPG

2012-05-03 Thread Werner Koch
On Thu, 3 May 2012 10:57, papill...@gmail.com said: Thank you, Werner. The system already has GPG installed and they won't want a second copy, I'm sure. I thought GPG4Win added a new context menu item that would allow easier file encryption. If not then Right. However, you can select which

Re: HP-UX installation error of gnupg version 1.4.12

2012-05-03 Thread Werner Koch
On Thu, 3 May 2012 17:19, scra...@carrollu.edu said: installation. However, I am getting the error below when attempting to do the make install step (as SU), which seems to indicate that the This might be a timestamp/make problem. If you don't care about i18n you may simply do ./configure

Re: gpg.conf

2012-05-03 Thread Werner Koch
On Thu, 3 May 2012 20:45, da...@gbenet.com said: and the following commands in my gpg.conf file produce error messages when I remove the hash (#) # --pgp2 Don't use the two dashes in the config file. They are only needed on the command line. Shalom-Salam, Werner -- Die Gedanken

Re: gpg.conf

2012-05-04 Thread Werner Koch
On Thu, 3 May 2012 23:15, da...@gbenet.com said: A re-think of valid user options are required by the developers I think :) I suggest that you use GPA or Kleopatra to modify the options. To a large extend they make sure that the options are correct (via gpgconf). Salam-Shalom, Werner

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 00:27, h...@qbs.com.pl said: decision, and that's agreed by basically anybody (NIST, ECRYPT II). Especially when the cost of establishing the link with 8k RSA is insignificant for any session over 5min in length (as is common in SSH). Sorry, but that is plain nonsense.

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 03:03, j...@enigmail.net said: I suspect WK has ECC ready to go in both GnuPG 1.4 and 2.0 as soon as the ID is approved. I know it's already present in the 2.1 beta code. No, we don't plan to port it back to 1.4. It will actually take years until ECC keys are in wide use

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 12:07, h...@qbs.com.pl said: It still doesn't change the overall picture: 1. migrating to ECC is hard and complicated Right, it will take years. But that is not a problem. 2. using 8k RSA is easy I already told my opinion on this. That was written in 2003, nearly 10

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 16:59, do...@dougbarton.us said: I hope you reconsider backporting ECC to 1.4. Given some of the changes It would be a lot of work and I doubt that we can find anyone to finance that. In fact, finding financial support for any kind of work on GnuPG is very hard. you've

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 14:53, mw...@iupui.edu said: Let me turn things around. Other than providing opportunities to discuss the practicalities of large RSA keys, is there any reason why the agent should care what size key it is storing? The OpenPGP parser has a limit on the size of the MPI

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 16:17, gn...@oneiroi.net said: I think I should give Werner much faster phone now ;) (on my own using 8192-bit RSA key takes about 2-4 seconds to successfully auth; phone was 2 seconds are way too long. I look at most mails not even for a second; if I need to wait 2

Re: SSH Agent keys 4096 bit?

2012-05-04 Thread Werner Koch
On Fri, 4 May 2012 20:54, a...@lown.me.uk said: Might I point out that discussion is with respect to an 8k RSA SSH key for SSH authentication, not for email. A 2 second delay during the initialization of an SSH connection is not a problem. The delay with SSH would even be longer. Again, it

Re: SSH Agent keys 4096 bit?

2012-05-07 Thread Werner Koch
On Fri, 4 May 2012 21:47, do...@dougbarton.us said: only use 1.4 as a result already. The thing that will kill 2.1 for me is the removal of the multiple public keyring functionality. Frankly I doubt that we will be able to remove the latter for 2.1 ;-). Shalom-Salam, Werner -- Die

Re: SSH Agent keys 4096 bit?

2012-05-07 Thread Werner Koch
On Sat, 5 May 2012 20:27, gn...@oneiroi.net said: Hm, shouldn't authentication happen before exchanging key for symmetric part of encryption during the SSH session? No, DH is commonly (and by SSH) used as a key agreement protocol. This means that N and only N communication peers agree on a

Re: non-interactive expiration of a key using --batch?

2012-05-07 Thread Werner Koch
On Sat, 5 May 2012 00:38, d...@fifthhorseman.net said: Any ideas what's going on here? Am i wrong to try to use --batch in this instance? It would be useful to add --status-fd 2, so that you can see what gpg actually expects as user/batch input. Salam-Shalom, Werner -- Die Gedanken

Re: importing new uid (offline master key setup)

2012-05-07 Thread Werner Koch
On Sun, 6 May 2012 22:29, dgbale...@0x01b.net said: Is this supported? Am I going to have the same problems if I change the No. You don't need it. However, GnuPG 2.1 kind of supports this because it drops the secring entirely and thus there is no more need trying to keep pubring and secring

Re: Why the --export-secret-key switch is not listed in help screen?

2012-05-07 Thread Werner Koch
On Sun, 6 May 2012 20:15, pe...@digitalbrains.com said: I suppose it was thought that exporting a private key was such a relatively rarely used command it did not need to be among the most It is also possible that I did not list it with --help so that the user is required to read the full

Re: SSH Agent keys 4096 bit?

2012-05-07 Thread Werner Koch
On Sat, 5 May 2012 12:08, pe...@digitalbrains.com said: Why should the GnuPG authors include a feature they don't believe in? If it's in GnuPG official, it will need to be supported. What if there is It is marketing again. PGP started to use AES-256 for marketing reasons and thus we more or

Re: non-interactive expiration of a key using --batch?

2012-05-07 Thread Werner Koch
On Mon, 7 May 2012 16:31, d...@fifthhorseman.net said: I don't see anything in the --status-fd output that gives me more of a clue, unfortunately. I need to debug it later this evening. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

Re: secret key not found

2012-05-07 Thread Werner Koch
On Mon, 7 May 2012 18:54, rychi...@yahoo.com said: It gives below error. Why it is looking in 'C:/Documents and Settings/Default User/Application'?  Can someone help on this? Because that is the correct directory as told by your Windows version (by means of CSIDL_APPDATA) or configured by you:

Re: non-interactive expiration of a key using --batch?

2012-05-07 Thread Werner Koch
Hi, the problem you have is that you mix commands on the command line and those from stdin. If you replace $ printf 10w\nsave\n | gpg --batch --passphrase-fd 3 \ --command-fd 0 --status-fd=2 --edit-key t...@example.org expire 3pw by $ printf expire\n10w\nsave\n | gpg --batch

Re: secret key not found

2012-05-08 Thread Werner Koch
On Tue, 8 May 2012 00:08, rychi...@yahoo.com said: gpg: keyblock resource `DIR/secring.gpg': No such file or directory gpg: keyblock resource `DIR/temporary': No such file or directory gpg: keyblock resource `DIR/pubring.gpg': No such file or directory I suggest that you import the keys

[Announce] nPth - The New GNU Portable Threads Library

2012-05-08 Thread Werner Koch
Hi! We are pleased to announce the first tarball release of the New GNU Portable Threads Library: nPth version 0.90. nPth is a non-preemptive threads implementation using an API very similar to the one known from GNU Pth. It has been designed as a replacement of GNU Pth for non-ancient

Re: Symmetric encryption using multiple keys

2012-05-08 Thread Werner Koch
On Tue, 8 May 2012 16:41, r...@sixdemonbag.org said: Symmetric encryption uses one key and only one key. In theory this is correct. However, OpenPGP uses a random session key and that key is in turn encrypted symmetrically. The protocol allows to mix arbitrary numbers of public and symmetric

Re: x509 and openGPG smartcard

2012-05-10 Thread Werner Koch
On Wed, 9 May 2012 22:15, guy...@lechiennoir.net said: It seems that I can't write the certificate to the smartcard. Is it a bug or did I made a mistake? BTW, I get the same error on Fedora 16.. I don't know. I only implemented it once and never used. There is no need for it in GnuPG. To

Re: x509 and openGPG smartcard

2012-05-10 Thread Werner Koch
On Thu, 10 May 2012 13:29, si...@josefsson.org said: I thought OpenPGP cards didn't support storing X.509 certs? There was some spare space on the new chips and thus the specs allow for an optional field to store a certificate (or any other data) . GnuPG 1.4 does not support it.

Re: GPG 1.4.x, 2.x, ECC, and portability

2012-05-14 Thread Werner Koch
On Mon, 14 May 2012 18:05, avi.w...@gmail.com said: In one of the recent, longer, threads, it was my understanding that Werner said that the 1.4.x branch of GnuPG will not be updated to have ECC capabilities, and may eventually be put into runoff as it were. Werner, may I request that you

Re: GPG 1.4.x, 2.x, ECC, and portability

2012-05-15 Thread Werner Koch
On Mon, 14 May 2012 23:53, avi.w...@gmail.com said: anything to work, as I am not able to figure out how to us gpgconf to switch sysconfdir to my stick's drive, and everything else is failing The directory is determined by looking at CSIDL_COMMON_APPDATA. It seems you can change the value by

Re: GPG 1.4.x, 2.x, ECC, and portability

2012-05-22 Thread Werner Koch
On Tue, 15 May 2012 16:50, avi.w...@gmail.com said: them temporarily each time if necessary. Allowing an option to have the home and other helper directories configured as a subfolder of the install directory on the install should be helpful as well. What I I agree. We could do this. If a

Re: Some people say longer keys are silly. I think they should be supported by gpg.

2012-05-22 Thread Werner Koch
On Tue, 22 May 2012 10:58, tim.kac...@gmail.com said: on my computers than break the keys, however they can't plant spyware on everone's computer. without people noticing They do slurp up and Are you sure? Did you looked at the GnuPG code so closely to come up with such a strong statement?

Re: Some people say longer keys are silly. I think they should be supported by gpg.

2012-05-22 Thread Werner Koch
On Tue, 22 May 2012 20:40, r...@sixdemonbag.org said: I think so, yes. The question is who's going to write it? I suspect Werner doesn't have the time. If he wants, I would be happy to take a stab at writing it. Please go ahead. Plain text optionally with org-mode formatting.

Re: GPG 1.4.x, 2.x, ECC, and portability

2012-05-22 Thread Werner Koch
On Tue, 22 May 2012 17:29, avi.w...@gmail.com said: That would be great! To close the loop, could the installer be modified to ask if the current install is portable and then create that file before the rest of the install to make it seamless? I am not keen to add yet another visible option.

Re: Testing GPG EMail encryption

2012-05-23 Thread Werner Koch
On Tue, 22 May 2012 21:28, steveb...@gulli.com said: If any of the GnuPG wizards like to chime in on the technical side on the bug tracker we're happy about any input. AFAIK a Mac specific PINentry is used and not the GTK+ or QT version. Thus I can't help. Salam-Shalom, Werner -- Die

Re: Testing GPG EMail encryption

2012-05-23 Thread Werner Koch
On Wed, 23 May 2012 11:30, mika.henrik.mai...@hotmail.com said: I cannot verify your signature, because you use PGP/MIME and this mailing list uses mailing list software which somehow messes up with headers and makes PGP/MIME signatures unverifiable. It is this old Mailman/Python illness. I

Re: Testing GPG EMail encryption

2012-05-23 Thread Werner Koch
On Wed, 23 May 2012 15:24, r...@sixdemonbag.org said: You may want to move this discussion over to the Enigmail list. We have a system set up that does much of this already, called Adele. We'd be Is that a different one than the Adele from Gnu_PP_, which is a closed source web service?

Re: Testing GPG EMail encryption AKA PGP/MIME

2012-05-23 Thread Werner Koch
On Wed, 23 May 2012 17:35, mika.henrik.mai...@hotmail.com said: On 23.05.2012 12:56, Steve wrote: I think we had the PGP/MIME vs inline discussion already. I am using PGP/MIME in this email. Can you verify my signature on this email? You can find link to my public key in my signature. Sure:

Re: Draft of nine new FAQ questions

2012-05-24 Thread Werner Koch
On Wed, 23 May 2012 23:40, ds...@jabberwocky.com said: Excellent. One note on the new text - it states that 2048-bit DSA keys use a 224-bit hash. In fact, a 2048-bit DSA key can use either 224 or 256-bit hashes. GnuPG uses 256 here (but will of course accept For the records: Before 2.0.13,

Re: Testing GPG EMail encryption AKA PGP/MIME

2012-05-24 Thread Werner Koch
On Wed, 23 May 2012 18:17, da...@gbenet.com said: I've had your key for ages - so why not attach it? Sorry, I don't understand. You want my key? Look into the OpenPGP mail header or simply use a keyserver. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein

Re: Draft of nine new FAQ questions

2012-05-24 Thread Werner Koch
On Thu, 24 May 2012 01:03, mailinglis...@hauke-laging.de said: That sounds like there has never been a security problem. El-Gamal signatures, anyone? Right, there was a bug in the Elgamal signature code. However this was a regression long after we changed the default to DSA with version

Re: Draft of nine new FAQ questions

2012-05-24 Thread Werner Koch
On Thu, 24 May 2012 13:13, rychi...@yahoo.com said: I want to opt out from emails. I don't see unsubscribe option. How can I opt out? Have a look at the last line of each mail: http://lists.gnupg.org/mailman/listinfo/gnupg-users Or look into the mail headers. Salam-Shalom, Werner

Re: Scripts

2012-05-24 Thread Werner Koch
On Thu, 24 May 2012 14:04, tanguy.herrm...@gmail.com said: But for example, I don't know how to display only the fingerprint of a key without all the display around that I must grep/cut/sed away. But maybe I $ gpg --fingerprint --with-colons 1e42b367 | awk -F: '$1==fpr {print $10}'

Re: Testing GPG EMail encryption

2012-05-24 Thread Werner Koch
Hi David, your mails are hard to read because you do not trim the quotes and use lines of 90 characters or longer. Please don't use more than about 72. One hint anyway: GNOME has a thing called gnome-keyring which hijacks the gpg-agent IPC and thus you run into problems when using GnuPG-2. It

Re: encrypt message for very if use a key

2012-05-25 Thread Werner Koch
On Thu, 24 May 2012 19:09, gonzale...@hildebrando.com said: but when I use this, the gpg send me a message: I can't see that but I guess that you want to use this command line: gpg --armor --output enc.txt --encrypt --recipient secur...@gooddata.com --trust-model always --batch --yes

Re: Draft of nine new FAQ questions

2012-05-25 Thread Werner Koch
On Thu, 24 May 2012 02:22, r...@sixdemonbag.org said: The final version that gets submitted to Werner will by necessity be plain text, and that will probably get downshifted into dumb typewriter Keep those quotes. I like UTF-8 and it is always easier to replace them by ticks and backticks

Re: Secret key not available

2012-05-25 Thread Werner Koch
[expires: 2018-12-31] uid Werner Koch w...@gnupg.org sub 1024D/77F95F95 2011-11-02 sub 2048R/C193565B 2011-11-07 [expires: 2013-12-31] 1E42B367 is the primary key and thus has the fingerprint which is usually communicated. C193565B is the encryption key you see

[OT] keyboard mapping (was: Draft of nine new FAQ questions)

2012-05-25 Thread Werner Koch
On Fri, 25 May 2012 15:31, mw...@iupui.edu said: And life is too short to go trawling the Internet for X Compose sequences. If I could find a comprehensive table I'd probably use Meanwhile I set my keyboard to: | mod3+ | normal | shift | |---++| | P | „ |

Re: problem signing public key, ----- gets converted to - -----

2012-05-29 Thread Werner Koch
On Tue, 29 May 2012 15:15, anots...@fastmail.fm said: I want to post a public key in a blog and sign the blog entry. The problem is, that - gets converted to - -. The reader can't copy and paste the public key, he has to remove the - first. If you process the signature with GPG, it

Re: getting an encrypted file to show what public key was used

2012-05-29 Thread Werner Koch
On Tue, 29 May 2012 15:45, lefevre...@osu.edu said: $ gpg --decrypt sensitive_file.gpg gpg: encrypted with ELG-E key, ID F1940956 gpg: decryption failed: secret key not available Use gpg --keyid-format long --decrypt sensitive_file.gpg to see the non-abbreviated key ID as stored in the

Re: changing the default for --keyid-format

2012-05-29 Thread Werner Koch
On Tue, 29 May 2012 18:31, r...@sixdemonbag.org said: Honestly, this seems like something to bring up to the IETF WG. The RFC already has a plethora of implementation recommendations: adding an implementation recommendation of use long key IDs when possible seems I bet that this will

[FYI] keys.gnupg.net (was: changing the default for --keyid-format)

2012-05-29 Thread Werner Koch
Hi, I can't remember whether I announced it, but since some weeks keys.gnupg.net is a CNAME to pool.sks-keyservers.net and http-keys.gnupg.net is a CNAME to ha.pool.sks-keyservers.net The reason for this change is that it is useless to spend a lot of work in maintaining such a second

Re: changing the default for --keyid-format

2012-05-29 Thread Werner Koch
On Tue, 29 May 2012 19:44, r...@sixdemonbag.org said: Anyway. If people are interested in what I found out about effective user-interface design with respect to certificate managers, say the word. Otherwise I'll crawl back under my rock and leave the subject GPA has many different ways to

Re: getting an encrypted file to show what public key was used

2012-05-29 Thread Werner Koch
On Tue, 29 May 2012 19:54, lefevre...@osu.edu said: This is, not surprisingly, the case. There was bad logic in my script and somehow, somewhere, it's using the wrong key for this particular Speaking of scripts: Scripts should use --with-colons and never try to parse the regular output.

Re: getting an encrypted file to show what public key was used

2012-05-29 Thread Werner Koch
On Tue, 29 May 2012 22:02, mailinglis...@hauke-laging.de said: You are probably running gpg non-interactively. In order not to break scripts it is strongly encouraged to use scripted output of gpg only with the options --with-colons, --batch and --status-fd. See http://www.gnupg.org/...;

Re: GnuPG 2 + OpenPGP card on F17

2012-05-30 Thread Werner Koch
On Wed, 30 May 2012 10:50, r...@sixdemonbag.org said: for a bit. If anyone has any advice, I'll be coming back to this problem tomorrow. Maybe letting it sit for a while will spur my brain into solving it. The sudo gpg2 might indicate that root has a running gpg-agent and thus scdaemon.

Re: GnuPG 2 + OpenPGP card on F17

2012-05-30 Thread Werner Koch
On Wed, 30 May 2012 11:47, quanngu...@mbm.vn said: I tried to make the log, but both the file S.log and mycombinedlog are empty. Did I wrong somewhere? Did you restart gpg-agent? pkill gpg-agent and check with ps that it has really been killed. You should see a notice in the log as

Re: changing the default for --keyid-format

2012-05-30 Thread Werner Koch
On Wed, 30 May 2012 16:16, r...@sixdemonbag.org said: On 05/30/2012 09:40 AM, Mark H. Wood wrote: Oh, how many times have I wondered why GPA has no search tool. Taking a look at GPA, it seems that 0.9.0 no longer compiles on a modern UNIX -- it expects libassuan-1.x, apparently, and

GPA download site (was: changing the default for --keyid-format)

2012-05-30 Thread Werner Koch
The new download site is ftp://ftp.gnupg.org/gcrypt/gpa/ -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: GnuPG 2 + OpenPGP card on F17

2012-05-30 Thread Werner Koch
On Wed, 30 May 2012 14:54, r...@sixdemonbag.org said: Also, should this be socket://home... or socket:///home...? Oops, 3 dashes are correct. Starting over from scratch again I manually removed S.gpg-agent and S.log. S.gpg-agent was recreated automatically, but S.log seemed to not be.

Re: GPA download site

2012-05-30 Thread Werner Koch
On Wed, 30 May 2012 16:54, r...@sixdemonbag.org said: http://www.gnupg.org/related_software/gpa/ then, as it points off at a site which only offers 0.9.0 for download. :) That makes sense. For most other parts of GnuPG we enter the current version number into a file swdb.wml and are

Re: PGP interoperability

2012-05-31 Thread Werner Koch
On Wed, 30 May 2012 21:42, expires2...@rocketmail.com said: And shared the fact privately with Symantec? I heard that it is just a bug introduced by the marketing suits. The PGP library never dropped support for DSA2. Salam-Shalom, Werner -- Die Gedanken sind frei. Ausnahmen regelt

Re: F17 + smartcards: *not* fixed

2012-06-01 Thread Werner Koch
On Fri, 1 Jun 2012 05:29, r...@sixdemonbag.org said: This is vexing. Time to look at it again in the morning. I hate udev debugging. The udev rules are too hard to maintain. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

Re: system migration

2012-06-01 Thread Werner Koch
On Thu, 31 May 2012 21:28, r...@sixdemonbag.org said: Other people will chime in with precise folder paths. I no longer have access to any Windows XP machines, so I can't -- but a little exploration should reveal them. Run gpgconf --list-dirs It shows a list of all directories in the

Re: Is there a -----END PGP SIGNED MESSAGE----- tag?

2012-06-01 Thread Werner Koch
On Thu, 31 May 2012 23:04, raubvo...@gmail.com said: According to http://www.gnupg.org/gph/en/manual.html#AEN153, Clearsigned documents do not seem to have a  -END PGP SIGNED MESSAGE- tag. And yet there is a  -END PGP MESSAGE- tag for messages encrypted with gnupg. Am I missing

Re: GnuPG 2 + OpenPGP card on F17

2012-06-01 Thread Werner Koch
On Thu, 31 May 2012 17:30, guy...@lechiennoir.net said: gpg2 --card-status gpg: can't connect to the agent - trying fall back gpg2 starts a new agent. You may want to correctly install gpg-agent - see the manual or the man page. gpg: OpenPGP card not available: No SmartCard daemon but

Re: Problem: cannot generate / copy keys larger than 1024bit on my OpenPGP-compatible card

2012-06-03 Thread Werner Koch
On Sat, 2 Jun 2012 17:39, mli...@robin-kipp.net said: 2012-06-02 15:46:48 scdaemon[6044] pcsc_transmit failed: not transacted (0x80100016) What reader are you using? It is possible that your reader does not support extended length APDUs, which are required for v2 cards. Shalom-Salam,

Re: context menu command Import OpenPGP Key

2012-06-03 Thread Werner Koch
On Fri, 1 Jun 2012 23:50, i...@euemd.info said: please can someone explain when the context menu command Import OpenPGP Key (on an attached key) is active or inactive (grayed out)? I cannot You mean in the Windows file explorer extension GpgEX? IIRC, it works solely by matching on the file

Re: Problem: cannot generate / copy keys larger than 1024bit on my OpenPGP-compatible card

2012-06-04 Thread Werner Koch
On Sun, 3 Jun 2012 20:17, ventur...@gmail.com said: By disabling the insternal driver I was able to able to generate keys up to 3072 bits on my v2 card using a SCM-335 card reader via pcsclite. That is a different problem than that with the Omnikey reader. In your case the permissions of

Re: PGP interoperability

2012-06-04 Thread Werner Koch
On Mon, 4 Jun 2012 10:49, b...@adversary.org said: Was there any explanation of why the marketing people dropped or wanted to drop the functionality? Maybe outdated technical specs which made it to the marketing dept. I don't know - you need to ask Symantec. Shalom-Salam, Werner --

Re: FAQ, take two

2012-06-04 Thread Werner Koch
On Mon, 4 Jun 2012 18:35, lists.gn...@mephisto.fastmail.net said: require extensive manual configuration for it to work properly (but if you're using Mutt, you already know that). See http://wiki.mutt.org/?MuttGuide/UseGPG for configuration details. That is not true: Put set

Re: PGP interoperability

2012-06-04 Thread Werner Koch
On Mon, 4 Jun 2012 19:11, b...@adversary.org said: Fair enough. Most people I correspond with use GPG, I'll worry about it if I ever have trouble with someone encrypting to my El-Gamal key. Not for a compliant OpenPGP implemenations. From RFC-4880: Implementations MUST implement DSA for

Re: FAQ, take two

2012-06-05 Thread Werner Koch
Hi, IMHO (Open)PGP's good repudiation comes to great extend from the fact, that it does not require rigor policies to use the keys. It is an ad-hoc scheme and that is what differences it from S/MIME and PKIX. It was my fault that I once set the no-modify flag for all new keys. In practice this

Re: FAQ, take two

2012-06-05 Thread Werner Koch
On Tue, 5 Jun 2012 13:24, r...@sixdemonbag.org said: text and layout. If anyone has recommendations about this, please speak up now. With luck, we can have this thing to Werner by the end of the Some time ago I added custom ids to most questions; for example: ** What is the recommended

Re: FAQ, take two

2012-06-05 Thread Werner Koch
On Tue, 5 Jun 2012 15:24, lists.gn...@mephisto.fastmail.net said: I don't know if this is a coincidence or not, but I will mention that for the first time in a long while, Mutt segfaulted when I tried to open a message on the gnupg mailing list... presumably when it tried I see two reasons

Re: scdaemon needs restarting after removing OpenPGP smartcard

2012-06-05 Thread Werner Koch
Author: Werner Koch w...@gnupg.org Date: Wed Dec 14 10:30:01 2011 +0100 scd: Fix resetting and closing of the reader. * scd/command.c (update_card_removed): Do no act on an invalid VRDR. (do_reset): Ignore apdu_reset error codes for no and inactive card. Close

Re: GnuPG 2.0.19 + Cryptostick - decryption fails with 4096 bit key

2012-06-05 Thread Werner Koch
On Tue, 5 Jun 2012 18:43, m...@spoked.ca said: Somehow, gpg2 is not able to read the key from the card. Is this a known bug? I have not found anyone else documenting this. I don't have a crypto stick, thus I can't test it. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen

Re: FAQ, take two

2012-06-06 Thread Werner Koch
On Tue, 5 Jun 2012 22:26, kloec...@kde.org said: Supports GnuPG versions: 1.4, 2.0 FWIW: Kontact Touch has been developed against GnuPG 2.1. I am not sure whether it works with 2.0. The Linux version will likely work but the WindowsCE version won't work - but well, nobody is using the

Re: FAQ, take two

2012-06-06 Thread Werner Koch
On Tue, 5 Jun 2012 19:22, r...@sixdemonbag.org said: I can add these: it shouldn't be a problem. The reason I'm using XHTML, incidentally, is to make it as easy as possible for you to convert it into org-mode: an hour's work with a SAX parser should be able to take care of most of it. If I

Re: can someone verify the gnupg Fingerprint for pubkey?

2012-06-07 Thread Werner Koch
On Wed, 6 Jun 2012 21:54, pe...@digitalbrains.com said: But it's a bit unclear to me on what basis you decided it looked correct? Your mail suggests to me that you decided that based on the fact that the UID on that key is Werner Koch (dist sig). But that would be the very first thing

Re: can someone verify the gnupg Fingerprint for pubkey?

2012-06-07 Thread Werner Koch
On Thu, 7 Jun 2012 17:59, mika.henrik.mai...@hotmail.com said: % gpg --list-sigs D8692123C4065DEA5E0F3AB5249B39D24F25E3B6 pub 2048R/4F25E3B6 2011-01-12 [expires: 2019-12-31] uid Werner Koch (dist sig) sig 58DFC608 2011-06-11 Andrey ... sig 30B94B5C 2012

Re: can someone verify the gnupg Fingerprint for pubkey?

2012-06-09 Thread Werner Koch
On Fri, 8 Jun 2012 23:41, smick...@hotmail.com said: Another thing is that downloading the key from that link you provided is no guarantee of safety in and of itself either because the page is not being hosted over SSL with confirmed identity information. So That is not relevant. The key

Re: Gpg4win

2012-06-10 Thread Werner Koch
On Sat, 9 Jun 2012 18:35, jw72...@verizon.net said: When I installed Gpg4win, it came with GnuPG v2.0.17. I am not sure when it will be updated to include v2.0.19, but I was wondering The new beta has 2.0.19. whether there would be any problem from substituting the new version of gpgv2.exe

Re: can someone verify the gnupg Fingerprint for pubkey?

2012-06-10 Thread Werner Koch
On Sat, 9 Jun 2012 11:28, markr-gn...@signal100.com said: Do you know of any common modern browsers that have finger protocol support built in? I wonder, how many people even have a finger client Indeed they must have dropped finger recently. I don't known when I checked the last time, but

Re: can someone verify the gnupg Fingerprint for pubkey?

2012-06-10 Thread Werner Koch
On Sun, 10 Jun 2012 16:03, smick...@hotmail.com said: I wasn't going to say anything, but I had no idea what Mr. Koch was talking about with that finger stuff. I studied his email and the email header looking for clues. Couldn't decipher what he meant. I am sorry about this. Most of the time

Re: can someone verify the gnupg Fingerprint for pubkey?

2012-06-10 Thread Werner Koch
On Sun, 10 Jun 2012 16:36, smick...@hotmail.com said: Mr. Koch, can you (or anyone else) recommend a book that is good for novices like myself that covers GPG public keys and can help me learn how to verify identity based on the chain of trust (self-signatures and other signatures as you said

Re: RFE: --update-before-use

2012-06-14 Thread Werner Koch
On Thu, 14 Jun 2012 19:48, r...@sixdemonbag.org said: We already have something similar to this in --auto-key-retrieve, and the same warnings about that option probably also apply here. The principal difference would seem to be that auto-key-retrieve only fetches certificates that are not on

Re: Need a GUI for e ncrypt/decrypt in Ubuntu 11.10

2012-06-14 Thread Werner Koch
On Thu, 14 Jun 2012 19:09, r...@sixdemonbag.org said: proprietary programs, but saying proprietary program X does Y and the FOSS alternative doesn't, I really like Y, I'd like it if we could do Y is just fine. Right. Note that the FSF actually forbids us maintainers to mention proprietary

Re: GnuPG GUIs

2012-06-15 Thread Werner Koch
On Fri, 15 Jun 2012 04:08, avi.w...@gmail.com said: GPA does not allow me to edit gpg.conf; then again, the system seems Sure it does. You may edit most of the options: Edit-Backed_Preferences. This uses gpgme to edit the conf files in a reliable way. Salam-Shalom, Werner -- Die

Re: GnuPG GUIs

2012-06-15 Thread Werner Koch
On Fri, 15 Jun 2012 15:01, avi.w...@gmail.com said: shows. But where do I address options such as s2k-digest-algo and bzip2-compress-level? How do I change the Home directory (it's using You are not supposed to change these options :-). We include in the GUI only those options which are

<    1   2   3   4   5   6   7   8   9   10   >