Re: TOFU

[Stefan Claas]

On 08.06.17 22:33, Stefan Claas wrote:

[snip]

bad signature and mangled text. I don't like
how the Editor in Thunderbird works! I look like
an idiot here on the list with my postings.

Regards
Stefan


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: TOFU

[Stefan Claas]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On 07.06.17 14:24, Peter Lebbing wrote:
> I hope Enigmail will add the TOFU statistics to the displayed > information. 
> Or maybe they already did, I see that I'm using Debian >
jessie's enigmail package for Enigmail, and Debian jessie/stable has >
pretty old packages (well maintained, but old). > I did a test today
with Enigmail and with TOFU in command line mode.
I posted 3 messages with a fantasy name to a Usenet test group where
the 3rd message was signed with a fake key and Enigmail showed me this:

UNTRUSTED Good signature from Ernst Mustermann 
Key ID: 0x4608CFA2 / Signed on: 08.06.17, 21:07

UNTRUSTED Good signature from Ernst Mustermann 
Key ID: 0x4608CFA2 / Signed on: 08.06.17, 21:08

UNTRUSTED Good signature from Ernst Mustermann 
Key ID: 0x4608CFA2 / Signed on: 08.06.17, 21:17

(It's the usual message under macOS with the blue bar. Note: with auto
key retrival on.)

Then i downloaded all messages run them through GnuPG and on the first
message TOFU already told me that there are 3 equal email addresses!

Regards
Stefan



-BEGIN PGP SIGNATURE-

iQEzBAEBCAAdFiEEK6+F+SgavVQ4I8fFmB63w4LsUrQFAlk5tIgACgkQmB63w4Ls
UrRENwgA5AdTLLyqXMweycHoQcxFjzi5wdZv/t9KxYCTlYDLAQDkmabD9Gzcdfbe
4x/wc/RbIB9alJ/GPBgtNvl4xrljGQhw20pA2ppbe/YS2hnIHlmWgyscNj1168cc
sGOBAU2ZlX2CGRpDe/9cbuF5pj9/l8jeCFQGaY1RKp5DkXFZr4svxC3CnCd3p94t
6ROhxjls8R0SkGvBHls8Cm6bRoACETkRITHd5y5WbMmzWQFLoAWfl3ekxYt2Q46c
XxLCRBQvxg0R6zngmuciZLBsCe94+xsNiqRZ+Q9GFAagobSaGZso+aSquqguU35G
mOpxm07iEgU1YeAGS67tLTTxWGv0HQ==
=mpGy
-END PGP SIGNATURE-



___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

GPG4Win Advice

[Ian A Morris]

Hi All,

I have been tasked with setting up a secure file transfer mechanism for our 
organisation.
We have created the private keys etc. using Kleopatra and are able to 
encrypt/sign (with asci armor) and decrypt and exchange files with our partners 
successfully.
I would like to automate the process as follows.
Users place files in a folder based on a Fileserver.
GPG4Win (based on our SFTP Server) is scheduled to check the folder, encrypt 
any files it finds placing the encrypted file on the SFTP server's Outbound 
folder and DELETING the original file on the Fileserver.
I am able to automate the encryption but the original file stays in place. When 
using the GUI there are options for the following, "Remove unencrypted original 
file when don"

Could you please help. I would like to

[cid:image002.png@01D2E06C.9548ED40]


I am using the following syntax

Gpg2 -batch -recipient x  -encrypt-files -armor C:\Location\*.txt
Which creates the encrypted the files in the same location and the orginal 
files still remain.

I have tried a number of different options, none of which worked for me.
If I am able to to encrypt/decrypt and point the files to an alternative 
location and remove the orginals then I would be extremely grateful for the 
help.


Kind Regards

Ian A. Morris
IT Infrastructure Analyst
ICT Transformation Project
Int: 7592191
Tel: 02380 626897
Mob: +44 7958 216696
[cid:image001.png@01D214E5.DE402DE0]

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: libgcrypt

[Reynold DeMarco Jr]

Thank you for this - I found libgcrypt version 1.7.7 at /usr/local/bin
which is not in my class path.

I will update my system to include the path or run with it on the
command line or both but at any

rate this solution will work for me.

Reynold


On 06/07/2017 11:14 PM, Werner Koch wrote:
> On Wed,  7 Jun 2017 23:32, socal2...@gmail.com said:
>
>> I installed libgcrypt 1.7.7 on this machine but it reverts to the
>> distro installation of 1.6.6
> Did you install the correct libgcrypt*-dev package (assuming you are
> using a pre-packaged version) and can configure find it?  Enter
>
>libgcrypt-config --version
>
> This should show you a 1.7 version number.  If it does not, try
>
>   which libgcrypt-config 
>
> this should show you from where it was executed.  Non-distro installed
> packages will find that script in /usr/local/bin and not in /usr/bin/.
>
> If not there are two ways to fix that:
>
>   - Put /usr/local/bin into your PATH right before /usr/bin.  You will
> also need to run "hash -r" to tell the shell to forget all cached
> program locations (or start a new shell).
>
> and
>
>   - Make sure /usr/local/lib is known to ldconfig.  That is put this
> directory name into /etc/ld.so.conf or a separate file under
> /etc/ld.so.conf.d/.  Then run ldconfig
>
> the second option is to
>
>   - Add 
>   --with-libgcrypt-prefix=/usr/local
> (note: without the "/bin" part)
> or whereever you installed libgcrypt 1.7
> to the configure invocation
>
>   - To actually run things you need to make /usr/local/lib also known to
> the runtime linke, as described above.  Alternatively you can set
> LD_LIBRARY_PATH to that directory.
>
>
> Shalom-Salam,
>
>Werner
>

-- 
Reynold DeMarco Jr.
socal2...@gmail.com
sent from Thunderbird


___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to show fingerprint in email header?

[Satoshi Yoshida]

Peter Lebbing  writes:

> Enigmail puts the following in my mails:
>
> Openpgp: id=8FA94E79AD6AB56EE38CE5CBAC46EFE6DE500B3E;
>  url=http://digitalbrains.com/2012/openpgp-key-peter
>
> I think that is the generally accepted method to give both a fingerprint
> and a URL. I'd wager the following is just the fingerprint:
>
> Openpgp: id=8FA94E79AD6AB56EE38CE5CBAC46EFE6DE500B3E

I see. Your answer is perfect for my question.
Thank you very much.

-- 
Satoshi Yoshida
https://satoshi.blog

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to show fingerprint in email header?

[Satoshi Yoshida]

Daniel Kahn Gillmor  writes:

> This is probably more of a question for your mail user agent than for
> GnuPG, since GnuPG doesn't send mail.  What program do you use to send
> mail?

I am using Gnus. I know how to edit email header.
I want to know Openpgp: style still alive or not.
Sorry my poor English. I'm a Japanese.

-- 
Satoshi Yoshida
https://satoshi.blog

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to show fingerprint in email header?

[Satoshi Yoshida]

Werner Koch  writes:

> Here is what I use:
>
>   OpenPGP: url=https://k.gnupg.net/80615870F5BAD690333686D0F2AD85AC1E42B367
>
> This is a complete URL of our dedicated keyserver with the finperint
> appended.  How to configure this depends on your mailer.  I do this in
> Gnus:

Is this style still alive? Following URL shows it is expired.
https://datatracker.ietf.org/doc/draft-josefsson-openpgp-mailnews-header/

> (setq gnus-posting-styles
>   '((".*"
>(name "Werner Koch")
>(address "w...@gnupg.org" )
>  ("OpenPGP"  
> "url=https://k.gnupg.net/80615870F5BAD690333686D0F2AD85AC1E42B367; )
>  ("X-message-flag" "Mails containing HTML will not be read!\n\t 
> Please send only plain text.")
>(organisation "The GnuPG Project")
>  (signature
>   "Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.")
>)))

I'm using Gnus too.

> (X-message-flag is a hack for Outlook users ;-)

Hehehe.

-- 
Satoshi Yoshida
https://satoshi.blog

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to show fingerprint in email header?

[Daniel Kahn Gillmor]

On Thu 2017-06-08 22:05:40 +0900, Satoshi Yoshida wrote:
> How to show fingerprint in email header?
> I found
> https://datatracker.ietf.org/doc/draft-josefsson-openpgp-mailnews-header/
> But it is expired.

This is probably more of a question for your mail user agent than for
GnuPG, since GnuPG doesn't send mail.  What program do you use to send
mail?

Regards,

--dkg


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to show fingerprint in email header?

[Peter Lebbing]

On 08/06/17 15:05, Satoshi Yoshida wrote:
> How to show fingerprint in email header?

Enigmail puts the following in my mails:

Openpgp: id=8FA94E79AD6AB56EE38CE5CBAC46EFE6DE500B3E;
 url=http://digitalbrains.com/2012/openpgp-key-peter

I think that is the generally accepted method to give both a fingerprint
and a URL. I'd wager the following is just the fingerprint:

Openpgp: id=8FA94E79AD6AB56EE38CE5CBAC46EFE6DE500B3E

HTH,

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 



signature.asc
Description: OpenPGP digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: How to show fingerprint in email header?

[Werner Koch]

On Thu,  8 Jun 2017 15:05, sato...@linux.com said:

> https://datatracker.ietf.org/doc/draft-josefsson-openpgp-mailnews-header/

Here is what I use:

  OpenPGP: url=https://k.gnupg.net/80615870F5BAD690333686D0F2AD85AC1E42B367

This is a complete URL of our dedicated keyserver with the finperint
appended.  How to configure this depends on your mailer.  I do this in
Gnus:

--8<---cut here---start->8---
(setq gnus-posting-styles
  '((".*"
 (name "Werner Koch")
 (address "w...@gnupg.org" )
 ("OpenPGP"  
"url=https://k.gnupg.net/80615870F5BAD690333686D0F2AD85AC1E42B367; )
 ("X-message-flag" "Mails containing HTML will not be read!\n\t Please 
send only plain text.")
 (organisation "The GnuPG Project")
 (signature
  "Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.")
 )))
--8<---cut here---end--->8---


(X-message-flag is a hack for Outlook users ;-)

However, I would much more like to see adoption of the Web Key Directory
which makes it much easier to find the right key.  If you are using
GnuPG 2.1 you can add 

--8<---cut here---start->8---
auto-key-locate local
auto-key-locate wkd
auto-key-locate dane
--8<---cut here---end--->8---

to your gpg.conf to enable it.  The fallback to DANE is optional; I
doubt that is much more deployed than WKD.  Note that WKD (and DANE)
contact the server of the mail provider, so they know that you will send
an encrypted mail - but that is something they will see
anyway.  Workaround is as usual Tor ("use-tor" in dirmngr.conf)


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


pgpBnrZg6JuOb.pgp
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

How to show fingerprint in email header?

[Satoshi Yoshida]

How to show fingerprint in email header?
I found
https://datatracker.ietf.org/doc/draft-josefsson-openpgp-mailnews-header/
But it is expired.

-- 
Satoshi Yoshida
https://satoshi.blog

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Fwd: RE: setting GnuPG card to 'not forces' does not let sign

[Ben McGinnes]

On Thu, Jun 08, 2017 at 01:18:35PM +0200, Peter Lebbing wrote:
> On 08/06/17 12:48, Matthias Apitz wrote:
> > Every time I write to gnupg-users@gnupg.org I get this crap from a robot
> > or from Sarah about dating. Can someone do anything that he/she/it is not
> > triggered.
> 
> Yes, same here. I thought it was rather funny that she told me:
> 
> > Hello again! My boyfriend can read my email!
> > It is not secure.
> 
> and later:
> 
> > Honey, I've told you, email is not secure enough!
> 
> How a spambot can be oddly on-topic for this mailing list...

Yeah, I thought that was a little amusing too ... then I reactivated
my filtering of everything from AOL, sent them a spam report and
forgot about it.


Regards,
Ben


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Fwd: RE: setting GnuPG card to 'not forces' does not let sign

[Matthias Apitz]

El día jueves, junio 08, 2017 a las 01:18:35p. m. +0200, Peter Lebbing escribió:

> On 08/06/17 12:48, Matthias Apitz wrote:
> > Every time I write to gnupg-users@gnupg.org I get this crap from a robot
> > or from Sarah about dating. Can someone do anything that he/she/it is not
> > triggered.
> 
> Yes, same here. I thought it was rather funny that she told me:
> 
> > Hello again! My boyfriend can read my email!
> > It is not secure.
> 
> and later:
> 
> > Honey, I've told you, email is not secure enough!
> 
> How a spambot can be oddly on-topic for this mailing list...

Perhaps, when the spambot sees part of his 1st message in the incoming
mail, it reacts on this.

I have it blacklisted now in my spamassassin config.

matthias
-- 
Matthias Apitz, ✉ g...@unixarea.de, ⌂ http://www.unixarea.de/  ☎ 
+49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
8 de mayo de 1945: Quien no festeja perdió la Guerra.
May 8, 1945: Who does not celebrate lost the War.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Fwd: RE: setting GnuPG card to 'not forces' does not let sign

[Peter Lebbing]

On 08/06/17 12:48, Matthias Apitz wrote:
> Every time I write to gnupg-users@gnupg.org I get this crap from a robot
> or from Sarah about dating. Can someone do anything that he/she/it is not
> triggered.

Yes, same here. I thought it was rather funny that she told me:

> Hello again! My boyfriend can read my email!
> It is not secure.

and later:

> Honey, I've told you, email is not secure enough!

How a spambot can be oddly on-topic for this mailing list...

But I doubt very much anyone can do anything about this. Somebody has
arranged their spambot to respond to messages on this list, but the list
is public, so anybody can see those messages to the list; it could be
anybody doing it. However, upon checking, all the 6 such messages I've
received over the last couple of days all originated from the IP
104.160.29.115. That's something.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 



signature.asc
Description: OpenPGP digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: error while trying to run make

[Szczepan Zalega | Nitrokey]

On 06/07/2017 02:45 PM, Marianne Hommer wrote:
> I am trying to run make on GPG 2.1.21 and get the following errors.
> I do not see any errors from installing the pre req programs.
> 

Hello,

Similar issue regarding `IN_EXCL_UNLINK` was solved earlier.
See thread from 05/09/2017 07:12 PM,
topic: `undeclared function identified during make - gnupg-2.1.20`.

-- 
Best regards,
Szczepan

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Fwd: RE: setting GnuPG card to 'not forces' does not let sign

[Matthias Apitz]

Every time I write to gnupg-users@gnupg.org I get this crap from a robot
or from Sarah about dating. Can someone do anything that he/she/it is not
triggered.

Sarah, I have no intention to click on the URL and much less to click on
you. Crap.

matthias

- Forwarded message from Sarah  -

Date: Thu, 8 Jun 2017 06:41:21 -0400
From: Sarah 
To: g...@unixarea.de
Subject: RE: setting GnuPG card to 'not forces' does not let sign
X-Mailer: JAS STD

Have you finally got my pix?
Let's meet tomorrow!
Write me only here: 
http://free-new-dating.online/?=35&:uni:2g-17=Sarah212





On Jun 08, 2017, at 10:29 AM, Matthias Apitz  wrote:

>
>--k1lZvvs/B4yU6o8G
>Content-Type: text/plain; charset=utf-8
>Content-Disposition: inline
>Content-Transfer-Encoding: quoted-printable
>
>
>Hello,
>
>I was tired of having always enter the PIN when sending mails to sign them
>and switched the card to 'not forces':
>
>Signature PIN : not forced
>
>After this (without withdrawing the card, i.e. the PIN was already
>entered around 10 times and the card unlocked), the signing says:
>
>$ echo bla > test.doc
>$ LANG=3DC
>$ gpg2 --armor --output test.doc.signed --sign test.doc
>gpg: signing failed: Bad PIN
>gpg: signing failed: Bad PIN
>
>The bad PIN counter in the card is not decremented. Switching the card
>back to 'forced' makes signing with PIN working again.
>
>What do I wrong?
>
>   matthias
>
>
>--=20
>Matthias Apitz, =E2=9C=89 g...@unixarea.de, =E2=8C=82 http://www.unixarea.d=
>e/  =E2=98=8E +49-176-38902045
>Public GnuPG key: http://www.unixarea.de/key.pub
>8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
>8 de mayo de 1945: Quien no festeja perdi=C3=B3 la Guerra.
>May 8, 1945: Who does not celebrate lost the War.
>
>--k1lZvvs/B4yU6o8G
>Content-Type: application/pgp-signature; name="signature.asc"
>
>-BEGIN PGP SIGNATURE-
>
>iQIzBAABCAAdFiEEXmn7rBYYViyzy/vBR8z35Hb+nREFAlk5JxMACgkQR8z35Hb+
>nRG0Pg//XxtBaoPPQN3uinfxxExnoNQcScfx/Eycxr1kDZjFQxp6LVIK1KZy+Dht
>V5Sx+ssn0lids22szU5uZlT60dqbaUAASzsBo74FPxsvJ03BishsCIvCCqArpj5S
>kZLe/iUExNj+hq4XRUh0Ia0MllI20rzjEF1sC0EC2r1YfYv2ePdFzgQtD8HvDMqo
>v0vPISHoPF7Xsswu9q3TFQGbiim6HEoOLgQlYGMB1egP4NS66RGWU/s3fVVXqEw5
>c8btka/S64hNVMiFEzNl573csiQDLdT/OHk9DvDpHDqzcSCZVuutCznj4sDmMIEx
>7GKZsfv4xLJT4CuKHDedm7AOctRw9fV2GqFCeIlc/sdELxg4MX+pYpmd6gN79Dno
>wDe5oCXXSmUvodvGS5iSfVYCmoJZ+Ww1oxWFG2YHl6kAGZP6h3Lam6GjOhoaoXLJ
>P4MD+4EG9GAs8cMpCtiCjbqW27eV6KeglGu2RCLhSp3pWGTXFxuXW2X4fMbhZrNC
>3pc2X3QTClcbmPaRActZ3Kt5KqxbHS7iAAWJr/Rna+SRsCxFpCQYnl+m6BOdJs9X
>rx86Ca/NAZBOtWbrnVlT5yCgUAZ2gNaQPVDXhKRNUmosdwC8RKG1y+JyEav8CmKc
>UbJa6pIIYknZQ+UGTbIuuZX/VM2PR+86Tr3FihuDKt/VA9IBpq4=
>=EM3I
>-END PGP SIGNATURE-
>
>--k1lZvvs/B4yU6o8G--
>
>

- End forwarded message -

-- 
Matthias Apitz, ✉ g...@unixarea.de, ⌂ http://www.unixarea.de/  ☎ 
+49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
8 de mayo de 1945: Quien no festeja perdió la Guerra.
May 8, 1945: Who does not celebrate lost the War.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

setting GnuPG card to 'not forces' does not let sign

[Matthias Apitz]

Hello,

I was tired of having always enter the PIN when sending mails to sign them
and switched the card to 'not forces':

Signature PIN : not forced

After this (without withdrawing the card, i.e. the PIN was already
entered around 10 times and the card unlocked), the signing says:

$ echo bla > test.doc
$ LANG=C
$ gpg2 --armor --output test.doc.signed --sign test.doc
gpg: signing failed: Bad PIN
gpg: signing failed: Bad PIN

The bad PIN counter in the card is not decremented. Switching the card
back to 'forced' makes signing with PIN working again.

What do I wrong?

matthias


-- 
Matthias Apitz, ✉ g...@unixarea.de, ⌂ http://www.unixarea.de/  ☎ 
+49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
8 de mayo de 1945: Quien no festeja perdió la Guerra.
May 8, 1945: Who does not celebrate lost the War.


signature.asc
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: libgcrypt

[Werner Koch]

On Wed,  7 Jun 2017 23:32, socal2...@gmail.com said:

> I installed libgcrypt 1.7.7 on this machine but it reverts to the
> distro installation of 1.6.6

Did you install the correct libgcrypt*-dev package (assuming you are
using a pre-packaged version) and can configure find it?  Enter

   libgcrypt-config --version

This should show you a 1.7 version number.  If it does not, try

  which libgcrypt-config 

this should show you from where it was executed.  Non-distro installed
packages will find that script in /usr/local/bin and not in /usr/bin/.

If not there are two ways to fix that:

  - Put /usr/local/bin into your PATH right before /usr/bin.  You will
also need to run "hash -r" to tell the shell to forget all cached
program locations (or start a new shell).

and

  - Make sure /usr/local/lib is known to ldconfig.  That is put this
directory name into /etc/ld.so.conf or a separate file under
/etc/ld.so.conf.d/.  Then run ldconfig

the second option is to

  - Add 
  --with-libgcrypt-prefix=/usr/local
(note: without the "/bin" part)
or whereever you installed libgcrypt 1.7
to the configure invocation

  - To actually run things you need to make /usr/local/lib also known to
the runtime linke, as described above.  Alternatively you can set
LD_LIBRARY_PATH to that directory.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


pgpDqpzvf6vJm.pgp
Description: PGP signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users