When to use GPG flags

2016-02-19 Thread Eric Pruitt
I'm writing an email client with support for PGP encrypted and signed messages using GPG. I've noticed that GPG seems to do the right thing in may situations regardless of the flags used which makes it hard to know if I'm passing it the correct flags. For example, if I pipe a clearsigned message in

RE: Use of --passphrase-file

2016-02-19 Thread Harman, Michael
Thanks Brian. I think I tried this but I couldn’t figure out how to completely hide the passphrase so no one could get to it. Maybe I was using it incorrectly. Since this is an unattended operation that runs day and night, I wanted to secure the passphrase so gpg could get to it without human i

Re: How to configure Smartcard without 'toggle'

2016-02-19 Thread Nick Zbinden
Hi, Sorry. The information is basically in the linked issue. I had the problem moths ago and their was no solution. Now I retried and I still have the same problem. Back then it was probably 'gnupg-2.1.3.3' now it is the newest version from Arch Linux Repo '2.1.11-1'. I want to set up a Yubikey

RE: Use of --passphrase-file

2016-02-19 Thread Harman, Michael
Thanks Steve for your feedback! I spent a lot of time jotting down all the different ways to do this, including encrypting the passphrase file, adding some kind of trust to the key if possible or putting the passphrase inline in the code and then locking down the code itself. As you point out, a

Re: Documentation format

2016-02-19 Thread listo factor
On 02/06/2016 12:08 PM, Robert J. Hansen - r...@sixdemonbag.org wrote: Since I seem to have become the doyen of documentation, I figure I should ask: what markup language and/or output formats should we be pursuing for future documentation work? Whatever you decide to use, I suggest to consider

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Peter Lebbing
On 19/02/16 19:47, Andrea Dari wrote: > This time gpg didn't run that command by itself. Huh. That's odd. I've never observed GnuPG neglecting to update it automatically when something might have changed. But I'm glad you figured it out, it was pretty weird. Peter. -- I use the GNU Privacy Gua

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrea Dari
Nop I didn't, now it works! This time gpg didn't run that command by itself. Thanks Ingo Andrea 2016-02-19 19:20 GMT+01:00 Ingo Klöcker : > On Friday 19 February 2016 15:12:34 Andrea Dari wrote: > > 1) This is the general situation: > > > > http://pastebin.com/NXuJj2h5 > > > > User one is the

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Ingo Klöcker
On Friday 19 February 2016 15:12:34 Andrea Dari wrote: > 1) This is the general situation: > > http://pastebin.com/NXuJj2h5 > > User one is the user that i fully trust and has a revocation dated on > 18 February 2016 > > 2) Here you can see User one pbkey details: > > http://pastebin.com/g2tQKz

Re: How to configure Smartcard without 'toggle'

2016-02-19 Thread Werner Koch
Hi, if you have a problem with GnuPG, please always specify the version you are using and best also the OS. For cars it is also useful to tell us the reader you are using. The first few lines of gpg --version are the best way to show us the version (you may need to type "gpg2"). Shalom-Sa

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrea Dari
I use the default Debian gnupg packet config, I have only Andrea Dari's private key. I tested it also with gnupg v2.x but it still have the same problem. 2016-02-19 15:27 GMT+01:00 Peter Lebbing : > On 19/02/16 15:12, Andrea Dari wrote: > > 1) This is the general situation: > > I don't see why th

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Peter Lebbing
On 19/02/16 15:12, Andrea Dari wrote: > 1) This is the general situation: I don't see why this unexpectedly keeps user three fully valid... it looks like you're right and three should be invalid. Do you have any funny stuff in gpg.conf? For which of these keys do you have the private key installed

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrea Dari
1) This is the general situation: http://pastebin.com/NXuJj2h5 User one is the user that i fully trust and has a revocation dated on 18 February 2016 2) Here you can see User one pbkey details: http://pastebin.com/g2tQKzPN 3) Here you can see that user three is treated with validity = full eve

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Peter Lebbing
I can't reproduce this. A revocation correctly invalidates any certifications *both* before or after the moment of revocation. After all, the time can be faked.[1] I tested with no "revocation reason" specified, by the way. But I don't think GnuPG uses the revocation reason for anything, although

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrea Dari
Yes, both GMT. 2016-02-19 12:33 GMT+01:00 Andrew Gallagher : > On 19/02/16 10:25, Andrea Dari wrote: > > Hi, > > > > In my public keyring I have a public key signed in date 19 February 2016 > > by a user (pbkey) that I trust fully, but the same pbkey of the user > > that I trust is revoked in dat

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrea Dari
Yes, both GMT. Andrea 2016-02-19 12:33 GMT+01:00 Andrew Gallagher : > On 19/02/16 10:25, Andrea Dari wrote: > > Hi, > > > > In my public keyring I have a public key signed in date 19 February 2016 > > by a user (pbkey) that I trust fully, but the same pbkey of the user > > that I trust is revoke

Re: A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrew Gallagher
On 19/02/16 10:25, Andrea Dari wrote: > Hi, > > In my public keyring I have a public key signed in date 19 February 2016 > by a user (pbkey) that I trust fully, but the same pbkey of the user > that I trust is revoked in date 18 February 2016. Are both dates in GMT? A signature.asc Descriptio

A problem in the web of trust model or a gnupg bug?

2016-02-19 Thread Andrea Dari
Hi, In my public keyring I have a public key signed in date 19 February 2016 by a user (pbkey) that I trust fully, but the same pbkey of the user that I trust is revoked in date 18 February 2016. So the question is, how can be possible that a pbkey signed after a key revocation, which could be ea

How to configure Smartcard without 'toggle'

2016-02-19 Thread Nick Zbinden
Hallo all, I have the same issue as in this bug [1]. When I '--edit-key' the 'toggle' command will not show the private keys. I don't understand the comments in the bugticket and the question asked by 'einalex' seems relevant. "perhaps I missed something but...with the command removed how are we