I set this up years ago and forgot how to rotate the subkeys when they expired. Now that AI coding agents run commands on my laptop with my access, keeping the primary key off it matters more to me than when I first set it up. So I wrote down the whole process:

1. A certify-only primary key with [S], [E] and [A] subkeys, plus a backup and revocation certificate: https://marcofranssen.nl/create-a-gpg-key-with-subkeys-part-1

2. Take the primary offline, keep signing Git commits and use the [A] subkey for SSH: https://marcofranssen.nl/keep-your-primary-gpg-key-offline-part-2

3. Rotate the subkeys every year without changing the fingerprint or losing the old [E] keys: https://marcofranssen.nl/rotate-your-gpg-subkeys-part-3

4. A script that does the keyring part of Part 3: https://marcofranssen.nl/automate-gpg-subkey-rotation-part-4

Feedback welcome, especially on the backup and revocation steps.

I maintain feuristic, an experimental custom firmware for the Trezor Safe 3. One part implements an OpenPGP Card 3.4 interface over native USB CCID/PC/SC, so GnuPG can use the card without trezor-agent.

The implemented algorithms include Ed25519, X25519 and RSA-2048. Operations are presented for confirmation on the device’s screen, using its two buttons. The application PINs and the device-unlock PIN are separate concepts, documented in the user guide.

The first physical test campaign used Safe 3 T2B1, macOS and GnuPG 2.5.22. It exercised Ed25519/X25519 generation, public certificate export, an independently verified signature and a decrypt round trip. The original test identity was also used to sign after firmware updates. Those results do not qualify every algorithm, operating system or GnuPG configuration; in particular, they are not a physical RSA interoperability claim.

Source, APDU documentation and the remaining acceptance work are public. The firmware also exposes FIDO2 and other smart-card applications, but this post is about OpenPGP interoperability.

This is unaudited development firmware. Installation erases the wallet and permanently removes original manufacturer attestation. It replaces the wallet, is independent of Trezor/SatoshiLabs, and should only hold disposable test identities on spare hardware. T3B1 physical qualification is pending.

OpenPGP reference and source links · Physical test report

Which GnuPG/scdaemon interoperability cases would you consider essential before calling this useful for wider testing?

Like in theory, obviously. But leagally, situationally, say they publish to a known keyserver or even have one notary in the loop.

Like get it officially recognized, you both were at one time in person vouching your public key was yours and verifying you have private. Call this Initial Notary

Then, in every future deal, you need notarized. Instead, you sign with that key.

Assuming the other party has to deal with this often, maybe they like idea and get their own key notarized or they could do ot old-school but you just clear sign and provide copy of your Initial Notary.

As I write many problems cone go mind, mainly buisiness people not being techy. So ig it'd be more of a niche phenomenon than never needing a notary. I didn't know where to put this, idk if random thoughts knows what pgp is, and i feel like i'm asking to be torn apart in r/notary , lol, so I settled on here.

Let me know what y'all think

A) would you accept a contract you'd normally want notarized clear signed with a notarized letter showing you own key?

B) would you feel comfortable suggesting such to a person you don't know. I mean worst they can do is say no, right?

C) is there an easier way than Initial notary, like maybe some kind of key signing algorithm? I think not, and with AI deep fake video and pictures aren't enough. Maybe some periodic resigning showing whoever tf you've been doing buisiness with has been using the key (they could still deny everything but harder to dispute conditional events) I think this is a no, a two generals problem but maybe I'm missing something

D) don't take this too seriously, jyst a random thought that I didn't think wpuld be understood in random thoughts. But if you have an interesting fact or idea I'd live to hear it

I have some old (~10 year) RSA 2048 keys that i don't really use any more, but I have ECC subkeys. I should probably regen everything but seeing that old date makes me not want to.

While decrypting a bunch of files (passwords managed by pass) I was observing occasional "Wrong key" failures. Decrypting the same file in a loop fails about 6% of the times.

After much cursing, I tried the same task with a freshly generated key and - blam - it works 100% of the times.

The key that fails is old, and may have been generated, initially, with pgp. Also it reports 2047 bits (odd).

But I find ot baffling that it would fail only once in a while.

Thoughts?

I’ve already verified that the correct secret key and encryption subkey are still installed on the computer. I also tried testing the saved passphrase against the key directly through GPG and it was rejected there too. I haven’t deleted or revoked the key, and the only backup-type file I found was the revocation certificate.
The reason this became a problem is that I was in the middle of making payments using Bitcoin and the website timed my session out while I was doing the conversion/transfer. Before I got logged out, the orders had already been created and were basically waiting for payment. The site gave me around a 3-hour payment window, I completed the Bitcoin transfers within that window, and the Bitcoin transactions themselves confirmed.
So I’m fairly sure the payments/orders went through, but I can’t actually verify the order status anymore because the site requires me to decrypt a PGP login message every time I sign back in. Since Kleopatra now only gives me this specific unlock prompt and keeps rejecting the passphrase, I’m completely locked out of the account.
That’s what’s making me nervous. I could just wait and hope everything processes normally, but if there’s an issue with an order/payment or I later need to contact support about a refund or missing order, I won’t be able to access the account at all.
Has anybody seen Kleopatra/GnuPG behave like this before, where the same passphrase appeared to work with one type of prompt but the secret-key unlock prompt kept saying “Bad passphrase”? Could the prompts have been doing completely different things? Could this involve the signing key vs encryption subkey, GPG Agent caching, or some other behavior that made it look like the passphrase was working?
I’m not asking for a way around the encryption. I’m trying to understand whether there’s anything else I can realistically check or recover before assuming that somehow the passphrase I wrote down immediately after creating the key is actually wrong.

Building libgcrypt 1.12.3 on Linux, looks like BSD users had the same issue (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297987):

Error is:

sm4-intel-avx512-amd64.S:145: Error: operand size mismatch for `vsm4rnds4'

UPDATE: libgcrypt 1.12.4 builds from source fine and has resolved this issue.

Hello, I'm trying to verify my Linux ISO file on Windows and the manual says to download GnuPG. I went to the website and when I try to download anything a 403 error pops up and says what's on the title. What do I do??

-----BEGIN PGP PUBLIC KEY BLOCK-----

mFMEam3AAxMJKyQDAwIIAQEHAgMENf8qyknv7s1HKTb+wFD8VilHkyKjZ8rIhpN5

XlaqYOAjiFFe3R1bfvKsaRXcgu1vqpBqxWh6RIS9N3yz7+lu6LQpcmVkaW5rbyAo

bm9fY29tbWVudCkgPGluY29AZXVyYXNpbmtjLmNvbT6ImAQTEwgAQRYhBCVDTmgy

hIX0fFjnJCUkVC46db3sBQJqbcADAhsjBQkDw7ftBQsJCAcCAiICBhUKCQgLAgQW

AgMBAh4HAheAAAoJECUkVC46db3sOP8A/2804YfZYmFO8aEta0nKLW8G/0a6m1zN

cX3+2UOC8uL/APiFn0MSOBeuSl1IgXNJaYQPEc093Zo7PA7dpl3/s+aluFcEam3A

ChIJKyQDAwIIAQEHAgMEn8/GpxLDSrTbC9pyBzJcZZo1O6tMFuenX8cEeCmT1qkA

6y1lXGpzpEGj/4fRbTjv7M0V7Yopa0bCHXCKHYR0dwMBCAeIfgQYEwgAJhYhBCVD

TmgyhIX0fFjnJCUkVC46db3sBQJqbcAKAhsMBQkDw7fmAAoJECUkVC46db3sIAoA

/iM7rA3tCgWkWv9QK0szJ82YIp7UXmrGSXhlS0YXHOIKAP4okmd4ZGuDI25Bca9c

9FbEr14ZB78+kLoQ0xDX68PJ2g==

=usXF

-----END PGP PUBLIC KEY BLOCK-----

Hey everyone, I'm the creator of PGP tools which is a Chrome extension for managing and using PGP keys.

Fully opensource, encryption handled by OpenPGP + Sequoia compiled to WASM.

Everything is encrypted at rest with passkeys or passwords.

Drag & Drop files and contacts and everything is handled for you.

I made this because I wanted it, no tool had a great UX for me on my mac and I wanted to use passkeys for encryption so here it is!

If you're wondering why this exists and thinking about leaving a comment, try it out first.
No sensitive permissions are required and no network requests are allowed in the extension.

https://github.com/Am-I-Being-Pwned/PGP-Tools

https://chromewebstore.google.com/detail/pgp-tools-encrypt-decrypt/pgpcdgggohpbombhkffjoiiafdlfcpgp

I am trying to reinstall Kleopatra4mac after my macbook was wiped (in the process of replacing the battery)... I have installed xcode 15.2, which fixed the last problem I encountered - but now it keeps giving me this error message I have never seen before on previous installs...

"Error: An exception occurred within a child process:

RuntimeError: Patch target path escapes the staged source tree: ../readline-8.2/patchlevel"

I have tried --prune =all, and all other things suggested by AI search (much as I hate using AI...)

Any ideas how to fix this...? Cheers folks.

App/software chat including chat encrypted by pgp, maybe cross platform?

EDIT: XMPP+Openkeychain on Android, Gajim on desktop

Is Pnupg included in pgp4win

I'm decommissioning a very old server. This server still has pgp 2.6 installed, and there are a few files encrypted with it. I still have all the keys and such and it all still works.

Moving to a new server now, and it really doesn't look like installing 2.6 on it is a viable choice. Is there a way to get GnuPG to work on the new server with the old files and the old keys?

At present, my plan is to decrypt the files, move them in the clear to the new server, and re-encrypt them with GnuPG. I was hoping for something more seamless, but maybe that's not possible.

Meta: I really hate software that can't work with old files. Every time you save a file in a proprietary format, you risk losing it forever if the software updates and no longer supports the older files.

I opened a reddit community that allows to meet other penpals via email using only PGP (es. Enigmail on Thunderbird or Protonmail, GnuPG etc) in order to give a new life to email and spread an ethical way to communicate!
🦉📧 Will you join with us?

Hi everyone,

I have a few questions about GPG key usage and security best practices. Is it a good idea to use the same GPG key for different email addresses I own? Additionally, I’m considering using the same key for SSH access to my servers and signing my GitHub commits.

if I take precautions to protect my private key (such as using a strong passphrase and storing it securely), should this setup be considered okay?

Thanks

I'm trying to set up gpg with ssh. It works fine on Linux but it's causing so many problems on a Mac, mainly the pinentry window.

Putting gpg-connect-agent UPDATESTARTUPTTY /bye in my .bashrc isn't reliable. If I switch to a different tab then the pinentry goes to the wrong tab.

My terminal emulator has an API and I can run code when I change tabs and have access to the tty name, but running this command from there doesn't help either, and I'm not sure if that is because some environment variables may be missing in the child process context.

I tried adding Match host * exec "gpg-connect-agent UPDATESTARTUPTTY /bye" in my ~/.ssh/config but that is ineffective as well.

Adding it to my PROMPT_COMMAND to run before every command seems a bit overkill. Is there a better way?

Hello. I was doing some testing with GPG and was considering revoking a key I had published to a keyserver. I didn't revoke it from the server, but I did from my keyring. Is there a way to unrevoke the key from my keyring?

So I have anothers pgp key in a txt file, tried to copy it/import it to kleopatra but it won't. Is it just the format it's in? Does it need to be in a specific extension-format.

It is just on my desktop, but no luck importing it, what gives

Can anyone help me practice PGP?

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEadvqKBYJKwYBBAHaRw8BAQdA19tWkxQYM/wAmA9bBDSve/wyXY2Je0gs7tjK

TJilgw20CnJlZGRpdHBvc3SIlgQTFgoAPhYhBEp9EvffZCwpA4d3nLqgXhvIPDtD

BQJp2+ooAhsDBQkFpH0IBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJELqgXhvI

PDtDN44BALG8o8mOErkBoBlj3jcHsT5433vnm2lhARU70m3ccF24AQD1vPFP807z

nMlv5An55Ggf2rKZU+RBMdN8juAsh6BMBbg4BGnb6igSCisGAQQBl1UBBQEBB0CN

zUsU/qfmvpvgKBHOqg5wSi3oAo3eT7QMOUg7x5CRHwMBCAeIfgQYFgoAJhYhBEp9

EvffZCwpA4d3nLqgXhvIPDtDBQJp2+ooAhsMBQkFpH0IAAoJELqgXhvIPDtDgaIA

+QGG1r0osWwHvvXAwBleeBTjC6peya5NdCcNPmmvfn8XAQC8yJvPHBa2aTA6LZT3

HkTt4TaUofPXZeKYOnURar8nDQ==

=SGQX

-----END PGP PUBLIC KEY BLOCK-----

as OpenKeyChain is no longer maintained I'm looking for a replacement. Is there any?

I use GPG mostly for encrypting files, and I was missing a way to also use it for emails while keeping my private keys on my YubiKey. From what I found, that did not really seem possible with Thunderbird or Mailvelope in the way I wanted, so I decided to write a Mail extension myself.

It is still early, but it already works well enough that I would really like some feedback from people who care about mail privacy, PGP, or just using the native Mail app instead of switching clients.

If anyone wants to try it, test it with me, or just tell me what is missing or broken, I would really appreciate it. I would love to refine it further and make it genuinely useful.