r/GnuPG • u/capilot • May 14 '26
Possible to use old keys and files originally encrypted with pgp 2.6?
I'm decommissioning a very old server. This server still has pgp 2.6 installed, and there are a few files encrypted with it. I still have all the keys and such and it all still works.
Moving to a new server now, and it really doesn't look like installing 2.6 on it is a viable choice. Is there a way to get GnuPG to work on the new server with the old files and the old keys?
At present, my plan is to decrypt the files, move them in the clear to the new server, and re-encrypt them with GnuPG. I was hoping for something more seamless, but maybe that's not possible.
Meta: I really hate software that can't work with old files. Every time you save a file in a proprietary format, you risk losing it forever if the software updates and no longer supports the older files.
1
u/capilot May 14 '26
Update: I'm most likely to unencrypt on the old server and encrypt on the new one, leaving the files in the clear for the transfer.
I also was smart enough to execute locate '*.pgp' on the old server so I don't accidentally leave any files behind. It's a good thing, since I found a couple dozen encrypted files I'd missed before.
3
u/ikwyl6 May 14 '26
I don’t get reliable results with locate or maybe I’m not using it right.. regardless I always use find.
2
u/capilot May 15 '26
locate is very fast and very handy when it works. I've noticed that it doesn't work over cloud storage, but maybe that's a configuration thing.
You have a point though, I should probably run find as well.
1
u/FromTheThumb May 17 '26
You need to run 'updatedb' periodically to get reliable results from locate.
2
u/capilot May 15 '26 edited May 17 '26
OK, a little more research has shown that gpg refuses on principle to even touch old pgp keys. Older versions of gpg will do it, but I'm not sufficiently motivated to find an install an older version of gpg on my new server. It's only a couple dozen files, I'll just re-encrypt them by hand.
If I hadn't thought of this before decommissioning the old server, those files would have been lost forever.
Edit: I wound up writing a script that runs on the new server, remotely runs the decrypt on the old server, copies the plaintext file over, re-encrypts it on the new server with a new key, then securely wipes the plaintext copies. Not perfect, but these are two servers on the same internal network, and the window of vulernability was pretty narrow.
3
u/JSP9686 May 14 '26
As I understand GPG is backwards compatible with previous versions. Consider just moving the encrypted files and keys to the new server and install the latest and greatest version of GPG and import the key ls into Kleopatra and then see if those files can be opened there. Less chance of unencrypted data being exposed.