Decryption with OpenPGP card fails
Hello, I am facing problems decrypting data with my OpenPGP v2 card. Signing however is working just fine. I have collected the following output. The PIN retry counter looks a bit weird, could that be the problem? $ echo Test foo.txt $ gpg2 --default-key 0xF3D84563 --armor -es -r edm...@systemli.org foo.txt $ gpg2 --decrypt foo.txt.asc gpg: encrypted with 4096-bit RSA key, ID 89D322C9, created 2012-03-18 Edmond edm...@systemli.org gpg: public key decryption failed: General error gpg: decryption failed: No secret key [I don't get asked for a PIN when signig because it is still cached by gpg-agent.] $ gpg2 --list-keys edm...@systemli.org pub 1024D/F3D84563 2009-12-03 uid Edmond edm...@systemli.org uid Edmond edm...@riseup.net uid Kalle Blomquist zartbit...@riseup.net sub 4096g/B9112F3F 2009-12-03 [expires: 2012-04-30] sub 2048D/25782A52 2011-05-22 [expires: 2012-04-30] sub 2048R/CD72BB15 2012-03-18 [expires: 2013-03-18] sub 4096R/89D322C9 2012-03-18 [expires: 2013-03-18] $ gpg2 --card-status Application ID ...: [removed by Edmond] Version ..: 2.0 Manufacturer .: ZeitControl Serial number : [removed by Edmond] Name of cardholder: [not set] Language prefs ...: en Sex ..: unspecified URL of public key : [not set] Login data ...: [not set] Signature PIN : forced Key attributes ...: 2048R 4096R 4096R Max. PIN lengths .: 32 32 32 PIN retry counter : 3 0 3 Signature counter : 13 Signature key : 7723 B3A9 82EC 5035 A00F 0931 DD1C 8306 CD72 BB15 created : 2012-03-18 08:44:51 Encryption key: AEF8 F0EA 8B13 29F1 F370 E324 F105 21FD 89D3 22C9 created : 2012-03-18 08:47:00 Authentication key: 8E6F 4404 3CA3 3212 8801 61A3 DC13 CEC0 056B 9E3C created : 2012-01-05 12:36:35 General key info..: pub 2048R/CD72BB15 2012-03-18 Edmond edm...@systemli.org sec 1024D/F3D84563 created: 2009-12-03 expires: never ssb 4096g/B9112F3F created: 2009-12-03 expires: 2012-04-30 ssb 2048R/6703B033 created: 2010-07-13 expires: 2011-07-13 card-no: [removed by Edmond] ssb 2048D/25782A52 created: 2011-05-22 expires: 2012-04-30 ssb 2048R/CD72BB15 created: 2012-03-18 expires: 2013-03-18 card-no: [removed by Edmond] ssb 4096R/89D322C9 created: 2012-03-18 expires: 2013-03-18 card-no: [removed by Edmond] $ gpg2 --version gpg (GnuPG/MacGPG2) 2.0.19 libgcrypt 1.5.0 Copyright (C) 2012 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Any help appreciated :) Edmond ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
fingerprint
what is the reasoning for attaching the key ID to the end of the fingerprint string ? regards mick -- keyID: 0x4BFEBB31 ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: fingerprint
Am Sa 28.04.2012, 22:21:52 schrieb michael crane: what is the reasoning for attaching the key ID to the end of the fingerprint string ? The reason is that the short and long key ID are defined as the last 4/8 bytes of the fingerprint. In other words: They are not attached to the fingerprint (which has 160 bits / 20 bytes) but simply part of it. Hauke -- PGP: D44C 6A5B 71B0 427C CED3 025C BD7D 6D27 ECCB 5814 signature.asc Description: This is a digitally signed message part. ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
RE: Question about key fingerprint uses
Original Message Subject: Re: Question about key fingerprint uses From: Peter Lebbing pe...@digitalbrains.com Date: Fri, April 27, 2012 5:40 am To: Anthony Papillion anth...@papillion.me You're turning it around :). Rather than verify you are speaking to John using his fingerprint, you are verifying the fingerprint by speaking to John. You should already be sure the person on the line is John Smith. John Smith then tells you his fingerprint such that you can be sure the key you're looking at actually belongs to John Smith, and hasn't been exchanged by a man in the middle. Aha! That makes it crystal clear! Indeed, I had turned it around. So then that's why key signing parties rely on verifiable ID. The user verifies his ID so you can be sure the fingerprint he's providing is his actual fingerprint. Makes perfect sense now. Anthony ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: fingerprint
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 28.04.2012 23:21, michael crane wrote: what is the reasoning for attaching the key ID to the end of the fingerprint string ? Hi Mick If I understand your question correctly it is actually the other way around, with the KeyID being based on the fingerprint. Multiple keys can share the same KeyID, which is why for verification purposes the fingerprint should always be used. - -- - Kristian Fiskerstrand http://www.sumptuouscapital.com Twitter: @krifisk - Corruptissima re publica plurimæ leges The greater the degeneration of the republic, the more of its laws - This email was digitally signed using the OpenPGP standard. If you want to read more about this The book: Sending Emails - The Safe Way: An introduction to OpenPGP security is now available in both Amazon Kindle and Paperback format at http://www.amazon.com/dp/B006RSG1S4/ - Public PGP key 0xE3EDFAE3 at http://www.sumptuouscapital.com/pgp/ -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.19 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJPnFXHAAoJEBbgz41rC5UIrwQP/AnJ7W9aZOqNkdgvJUhILyK9 mgXBX5QunHmV5R/tRE7B2jYPwwdfCAVkueQnUF3c5G5s4zmlyJ+pSj5BZ+z+GJyF yKFzaFknICbewj3NmIOBHiG9iv9m+9YFEWj1/9xwUHSdIk2U3KlNJKTcZtvdSRrV DL26Sv42GWSEHTZ1soz5DaskdXUvNy/Qk3HlKNcvNQ3VomLHWHIL6z7R/mA4QXvz faWeyoBt5lEDfrb4ZRiBGKfETlOOYGA5G8WbfxVkBkl1KNyO214Ir//8rJXV3fOi POLBvL+UUfraqLVQEwD9vBwDmcwnIEd3q8SfqTbhNyxC80ORW/Wu+els/jCSWsi5 m+XaSSn44gwpES4o1A7VipoDFrcklwKzrF5UyquEiWIqfRb4+tin2CmepMmCzu7E DYXl2yBTCAqWg1D+Mzo/WSmIkJlS3TwEx69DMVDmLkIbXedPH+veu7kDIWal66wo r8QTkxSSxEceXZNYp/L1gJgtrbGVVlL0dX2PnBAgRgyL6R7G3uAOaAsaKtCOiDqK K/WPFkdoSxmQkplTFqiuHCSthmGvQpUP/0d70SZmmHj+BfWuI2F1ChzdzCVzDtxn xQeZqzrMAbmul7cHXrbDpY7fubouZD6iAABvBRjo4G5iZt9ZoMi9pj/1y5BOHBu6 ECzWXm9159POGfyOXPfo =ofyE -END PGP SIGNATURE- ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Re: fingerprint
On Sat, Apr 28, 2012 at 10:21:52PM +0100, michael crane wrote: what is the reasoning for attaching the key ID to the end of the fingerprint string ? That's the way the key ID is derived for v4 keys. v4 keys use the low 64 bits (or 32 bits for short key IDs) as the key ID. v3 keys used the low 64 bits (respectively 32 bits) of the RSA modulus. However, this posed two problems. One is that the low bit is always one (multiplying two large primes together does that). The other is that originally v4 keys were all DSA or Elgamal. Those algorithms don't have a modulus in the same way[0], so a different technique had to be used to derive a unique fingerprint. [0] Basically, the one (for Elgamal) or two (for DSA) primes that are use as moduli can be shared securely among many keys, so using them as the sole basis for a key ID means arbitrarily many keys can have the same key ID, which kinda defeats the purpose. -- brian m. carlson / brian with sandals: Houston, Texas, US +1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187 signature.asc Description: Digital signature ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
Question about how RSA keys are generated in GnuPG
Hi Everyone, This is a stupid question I'm sure but I can't seem to find an answer to it in the source code so I thought I'd ask here. When GnuPG is selecting primes for RSA key generation, what parameters are set for the primes? Is there a floor and a ceiling set for the numbers generated? Please feel free to point me to the right place in code if need be. Thanks! Anthony -- Anthony Papillion Software Developer and IT Consultant Phone: (918) 533-9699 My Twitter: twitter.com/cajuntechie My Facebook: facebook.com/cajuntechie My Identica: identi.ca/cajuntechie ___ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
