X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=gnupg%2Fgpg.conf;h=5697d171b89b7e09d5b3fc5e219eda9395ee0389;hb=24ae9a560857f589323d837416bec064657c57ca;hp=57be26fbac0a5a056445a08ad2f8c50aa31cabbd;hpb=ddbb97e0f525662b44e8346ffd713e42933475bd;p=config%2Fdotfiles.git

diff --git a/gnupg/gpg.conf b/gnupg/gpg.conf
index 57be26f..5697d17 100644
--- a/gnupg/gpg.conf
+++ b/gnupg/gpg.conf
@@ -1,6 +1,10 @@
 # Configuration file for GnuPG.
+#
+# Thanks to [1] for some hints to generate stronger keys (read on 2013-04-04).
+#
+# [1]: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices
 
-# Copyright (C) 2009-2012  Simon Ruderich
+# Copyright (C) 2009-2013  Simon Ruderich
 #
 # This file is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -16,17 +20,46 @@
 # along with this file.  If not, see <http://www.gnu.org/licenses/>.
 
 
+# DISPLAY
+
 # Don't display the copyright notice.
 no-greeting
 
-# Use my newest key as default key.
-default-key 0xE44C32F9
+# Use long keyids because the short ones have collisions.
+keyid-format 0xlong
+
+
+# KEY GENERATION
+
+# Use stronger preferences. These are not enforced, but tried in the given
+# order and the first supported by all recipients is used.
+#
+# Ciphers for encryption.
+personal-cipher-preferences AES256 AES192 AES CAST5
+# Don't use insecure hashes like SHA1 or MD5 and prefer stronger hashes.
+personal-digest-preferences SHA512 SHA384 SHA256 SHA224
+# Prefer better compression methods.
+personal-compress-preferences BZIP2 ZLIB ZIP Uncompressed
+
+# Default preferences when generating a new key. Use the three settings above
+# combined to create stronger keys.
+default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed
+
+# Don't use SHA1 when signing keys, this includes self-certificates. This
+# setting is separate from the settings above and needs to be explicitly set
+# or SHA1 will be used! Thanks to [1].
+cert-digest-algo SHA512
+
+
+# KEYSERVERS
 
 # Use the given keyserver.
 keyserver hkp://pool.sks-keyservers.net
 
-# Use AES256, SHA256 and zlib when possible (when the receiver's key allows
-# it).
-personal-cipher-preferences AES256
-personal-digest-preferences SHA256
-personal-compress-preferences ZLIB
+
+# MY KEYS
+
+# Use my newest key as default key.
+default-key 0x92FEFDB7E44C32F9
+
+# vim: ft=gpg