Gpgtools GPG Keychain Access → 1.2

Comments and changes to this ticket

• You flagged this item as spam.
  

  Alex (via GPGTools) February 4th, 2012 @ 11:12 AM

  • State changed from “new” to “open”
  • Assigned user set to “Mento”

  [bulk edit]

• You flagged this item as spam.
  

  Mento February 9th, 2012 @ 02:03 PM

  • State changed from “open” to “waiting”

  Can you import the key using the Terminal?

  gpg2 --import "NameOfTheKeyFile.p7b"
  

• You flagged this item as spam.
  

  Askre February 15th, 2012 @ 10:17 AM

  Sorry for the delay, i did not find the ticket anymore..
  Ok, then:
  I am not able to open it via the terminal. This is perhaps be due to the fact i am not able to use it well.
  I have my key "publickey.cer" on the desktop, I typed
  cd desktop
  gpg2 --import "publickey.cer"
  But i end up with something that reads like: No valid PGP data found. Total number examined: 0
  Now i'll be reading the ticket again in less time.

• 

  Luke Le February 15th, 2012 @ 10:39 AM

  Hi Askre,

  could you please attach the publickey.cer file so we can have a look at it?

• You flagged this item as spam.
  

  Askre February 15th, 2012 @ 11:56 AM

  Of course. Please note that i have the same problem with every key, saved in every format the Mac Os keychain allows me to use, unless that ones created in the GPG keychain, exported and imported again.
  So this is a public-only key, but i encounter problems even importing my own key.

  BTW, can you explain me how GPG keychain manages the certification authorities?
  In the Mac Os keychain they are stored in System Root, and the user can trust/revoke CA certificates.
  I don't see anything similar in GPG keychain

  • publickey.cer 1.3 KB
• 

  Askre February 15th, 2012 @ 11:56 AM

  • no changes were found...

  • publickey.p7b 1.4 KB
• 

  Askre February 15th, 2012 @ 11:56 AM

  • no changes were found...

  • publickey.pem 1.9 KB
• 

  Luke Le February 15th, 2012 @ 12:01 PM

  Hi Askre,

  the certificate you attached seems to be a SSL or S/MIME certificate.
  You can't really use that certificate together with GPG Keychain Access
  since GPG and SSL|S/MIME certificates are a different thing.

  Is that what you were trying to do?

  P.S.: Sei italiano?

• You flagged this item as spam.
  

  Askre February 16th, 2012 @ 03:47 PM

  OK, thank you for the clarification.
  Not-so-useful-to-know reason i was wrong:
  I thought that GPG might work with both of them. This was since i am relatively new to Mac Os X built-in Mail.app. I knew that it is possible to get it to work with S/Mime encryption but i could not find how to enable it.
  This is because the padlock button is hidden until you import a certificate (and i had to import it yet). I thought the way to enable it was to install the GPG mail plugin. (The user inferfaces are the same)

  Now i solved my problem, thanks again.
  Another thing: after i deleted a key i created in GPG keychain it was possible to undo the operation.
  This means that the key is not actually deleted from the disk: and this is dangerous, let's say, when i sell my PC.
  You should implement a safe key deletion by overwriting the data several times to avoid this,

  PS: yes, i'm italian, but let other people understand too :)

• 

  Luke Le February 16th, 2012 @ 03:52 PM

  Hi Askre,

  yeah, we've had to completely rewrite GPGMail for Lion and in that process it was
  the best way from a user perspective to mimic the S/MIME UI. It's very unintrusive and we've added missing parts.

  As to the undoing of deleting keys. The keys are kept in cache, so once you quit the application you should no longer be able to undo the action.
  This way, if you don't sell your PC with GPG Keychain Access running you should be fine.

  There's a way to use S/MIME certificates with GPG but it exceeds the goal of our project,
  and seeing that we're a very small and team with very limited time I don't think we're gonna
  be able to add support for that any time soon.

  P.S.: me too :)

• 

  steve February 16th, 2012 @ 09:41 PM

  Is this solved? Please update the ticket status accordingly.

• 

  Luke Le February 16th, 2012 @ 10:44 PM

  Not solved yet completely, not ticket status change.

• You flagged this item as spam.
  

  Askre February 16th, 2012 @ 11:47 PM

  Feel free to consider me to be paranoid, but things are not so simple.
  In fact, deletion of a file usually involves only the deletion from the file system. The actual data are still in the disk, and someone can just use a data recovery tool to get back MY private key and even represent me.
  Data remanence can be mitigated overwriting the disk sector many times. You can do this when you empty the trash in the secure way.
  The simplest way to obtain this is with the command line srm or shred.
  Another way (but i would bet not all users are aware of this) would be to use the disk utility to do exactly the same to all the empty space on the disk. But it's a long and tedious process.
  My two cents..

• 

  Luke Le February 17th, 2012 @ 09:22 AM

  I completely understand your concerns regarding security here, what I wanted to point out though, is, that the file is not actually kept on disk for undoing but rather the key data kept in memory which is safer than an actual file even though surely not bulletproof.

  Before you sell your PC you should definitely overwrite your hard disk with zeros for > 15 times to rest assured files can't be recovered.
  But let's pretend the gpg keyfile (all private keys are stored in one file, all public keys in another) is indeed recovered, you would not be completely lost, due to the fact the keyfile itself is encrypted and can't only be decrypted using your passphrase.
  So considering you chose a safe enough passphrase, a cracker would still need a depending on the passphrase sizable amount of time to get access to your keys.

  Another point is also, since all keys are stored in the same file, the key file is not deleted but rather edited and this is all done by the gnupg binary itself.
  GPG Keychain Access is a mere UI for gnupg key management in that sense.

• You flagged this item as spam.
  

  Mento February 17th, 2012 @ 11:41 AM

  • State changed from “waiting” to “wontfix”
• 

  steve June 18th, 2015 @ 01:15 PM

  • Milestone set to “1.2”
  • Importance cleared.

  [bulk edit]