Existen varias opciones en gpg. Tenga en cuenta que puede usar todo esto en su archivo gpg.conf para configurarlos permanentemente (omitiendo el '-' delante de las opciones largas, pero tenga en cuenta que --try-secret-key es una opción solo disponible en la versión 2.1beta1 +, que ha estado en versión beta durante 3 años. La documentación se generó por error, creo que la mayoría de las personas no tendrán esta opción disponible):
--hidden-recipient name
-R Encrypt for user ID name, but hide the key ID of this user's key. This option
helps to hide the receiver of the message and is a limited countermeasure
against traffic analysis. If this option or --recipient is not specified,
GnuPG asks for the user ID unless --default-recipient is given.
--hidden-encrypt-to name
Same as --hidden-recipient but this one is intended for use in the options file
and may be used with your own user-id as a hidden "encrypt-to-self". These
keys are only used when there are other recipients given either by use of
--recipient or by the asked user id. No trust checking is performed for these user
ids and even disabled keys can be used.
--throw-keyids
--no-throw-keyids
Do not put the recipient key IDs into encrypted messages. This helps to hide the
receivers of the message and is a limited countermeasure against traffic analysis.
([Using a little social engineering anyone who is able to decrypt the message can
check whether one of the other recipients is the one he suspects.]) On the
receiving side, it may slow down the decryption process because all
available secret keys must be tried. --no-throw-keyids disables this option. This
option is essentially the same as using --hidden-recipient for all recipients.
En el extremo de recepción ... Tenga en cuenta que puede ser particularmente molesto si tiene muchas claves privadas porque gpg le pedirá su frase de contraseña para cada una hasta que se encuentre una que funcione. Para pasar rápidamente a través de las indicaciones, solo presione Intro para las teclas incorrectas, gpg no debería pedirle más de una vez por cada tecla como esta.
Hay una serie de técnicas posibles para recibir software (como clientes de correo) para aliviar este problema. Lo más práctico que conozco es generar un llavero temporal con la (s) clave (s) que se espera que sean el destinatario anónimo (por ejemplo, la dirección de correo electrónico en la que recibió el correo). En caso de fallar con esa / esas claves, se debería volver a llamar a gpg sin cambiar los llaveros para probar todas las claves secretas de los usuarios. Los comandos son como:
gpg --export-secret-keys <key(s)> > tmp_keyring
gpg --decrypt --no-default-keyring --secret-keyring tmp_keyring <...>
On failure:
gpg --decrypt <...>
Aquí están las opciones:
--try-secret-key name
For hidden recipients GPG needs to know the keys to use for trial decryption.
The key set with --default-key is always tried first, but this is often not
sufficient. This option allows to set more keys to be used for trial
decryption. Although any valid user-id specification may be used for name it makes
sense to use at least the long keyid to avoid ambiguities. Note that gpg-agent
might pop up a pinentry for a lot keys to do the trial decryption. If you want
to stop all further trial decryption you may use close-window button instead
of the cancel button.
--try-all-secrets
Don't look at the key ID as stored in the message but try all secret keys in turn
to find the right decryption key. This option forces the behaviour as used by
anonymous recipients (created by using --throw-keyids or --hidden-recipient)
and might come handy in case where an encrypted message contains a bogus key ID.
--skip-hidden-recipients
--no-skip-hidden-recipients
During decryption skip all anonymous recipients. This option helps in the case that
people use the hidden recipients feature to hide there own encrypt-to key from
others. If oneself has many secret keys this may lead to a major annoyance
because all keys are tried in turn to decrypt something which was not really
intended for it. The drawback of this option is that it is currently not possible
to decrypt a message which includes real anonymous recipients.
Si está interesado en la privacidad, otra opción podría interesarle. Es literalmente inútil y francamente malo para su privacidad emitir su sistema operativo y versión de software al enviar correos electrónicos:
--emit-version
--no-emit-version
Force inclusion of the version string in ASCII armored output. If given once only
the name of the program and the major number is emitted (default), given twice
the minor is also emitted, given triple the micro is added, and given quad an
operating system identification is also emitted. --no-emit-version disables
the version line.
Para obtener una descripción general de las mejores prácticas de gpg para seguridad y privacidad, consulte este manual por riseup labs .