Master Key Best Practice with SmartCard

2016-01-25 Thread Antoine Michard
Hi all, In July when I've created my Master Key, I didn't use --expert option and now my master key is Cert and Sign and got 2 subkey for encryption (+1 revoke). pub 4096R/0882B381 créé : 2015-07-04 expire : jamais utilisation : SC confiance : ultimevalidité : ulti

Problems with 4096 keys on 2.1 card

2016-01-25 Thread Jorgen Ottosson
Hi, I've been having some problems using a GPG card 2.1 with Ubuntu repo GPG, think it was 2.0.22. I noticed some discussions in Sept-15 about this and got the impression that it should work. Can someone just make a short comment on this, should a 2.0.22 be able to generate 4096 keys and/or impo

Re: Problems with 4096 keys on 2.1 card

2016-01-25 Thread NIIBE Yutaka
On 01/25/2016 06:46 PM, Jorgen Ottosson wrote: > I noticed some discussions in Sept-15 about this and got the impression > that it should work. > > Can someone just make a short comment on this, should a 2.0.22 be able to > generate 4096 keys and/or import 4096 subkeys from keyring? > > The card

Re: Master Key Best Practice with SmartCard

2016-01-25 Thread Andrey Utkin
On 25.01.2016 12:08, Antoine Michard wrote: > It's work well except that for https://encrypt.to, he use my first > encryption key and I can't decrypt it with my Smartcard. I'd report an issue to encrypt.to maintainer. encrypt.to also doesn't handle correctly the case when more than one key matches

Re: Master Key Best Practice with SmartCard

2016-01-25 Thread Andrew Gallagher
On 25/01/16 10:08, Antoine Michard wrote: > > So I thinking what is the best to do next: > - Delete my useless first subkey encryption from my keyring and send > update to key server. Once you've published a subkey it stays published. Deleting a previously published subkey only removes it from yo

Re: Master Key Best Practice with SmartCard

2016-01-25 Thread Daniel Kahn Gillmor
On Mon 2016-01-25 05:08:31 -0500, Antoine Michard wrote: > So I thinking what is the best to do next: > - Delete my useless first subkey encryption from my keyring and send > update to key server. If you don't want people to encrypt messages to your D693C37C subkey, you should revoke that subkey (

Re: Master Key Best Practice with SmartCard

2016-01-25 Thread Antoine Michard
>> It's work well except that for https://encrypt.to, he use my first >> encryption key and I can't decrypt it with my Smartcard. > > I'd report an issue to encrypt.to maintainer. > encrypt.to also doesn't handle correctly the case when more than one key > matches speceificed short key id, e.g. htt

Re: Master Key Best Practice with SmartCard

2016-01-25 Thread Kristian Fiskerstrand
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 01/25/2016 02:55 PM, Andrew Gallagher wrote: > On 25/01/16 10:08, Antoine Michard wrote: >> >> So I thinking what is the best to do next: - Delete my useless >> first subkey encryption from my keyring and send update to key >> server. > > Once y

Re: Master Key Best Practice with SmartCard

2016-01-25 Thread Andrew Gallagher
On 25 Jan 2016, at 14:50, Antoine Michard wrote: > Thx Again Andrew. You are an incredible source of GPG knowledge I'm really not. Just trying to be helpful. Don't trust me any more than any other random person on the Internet. I'm quite likely to make a mistake or leave out something importa

Re: Problems with 4096 keys on 2.1 card

2016-01-25 Thread Jorgen Ottosson
On 25 Jan 2016 at 21:07, NIIBE Yutaka wrote: > However, please note that many card readers have problems with larger > APDU. Generating keys on card should be ok, but importing keys would > be failed with bad reader. Signing should be ok, but decryption would > be failed with bad reader. That's

Re: Problems with 4096 keys on 2.1 card

2016-01-25 Thread NIIBE Yutaka
On 01/26/2016 08:18 AM, Jorgen Ottosson wrote: > Can't really confirm that here, generating seem not to work either. > > gpg --card-status Please note that GnuPG 1.4 supports up to 3072-bit. This is because of internal library limitation. I believe that "gpg" in Ubuntu is GnuPG 1.4. It is "gpg

Re: Key signing with non-primary UID

2016-01-25 Thread stebe
Hi, some ways to achieve what you pretend, # sign (effectively) gpg2 --edit-key [name or email address or short/long keyID or, better, fingerprint of your contact] gpg> sign -u [your non-primary uid for signing given as name or email address] # sign only locally, i.e. it does not leave your com

BAD signatures for GnuPG Stable

2016-01-25 Thread Aaron Tovo
I downloaded gnupg-2.0.29.tar.bz2 and libgpg-error-1.21.tar.bz2 and their corresponding .sig files from www.gnupg.org/download. I tried to verify them using the gnupg (version 1.4.16) that came with my Ubuntu 14.04 distribution and got bad signature messages for both files: $ gpg --verify gnupg