Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, packages, etc. will other users who use OpenSSL, GnuPG, Putty, etc. be able to use it or descrypt the signed packages? Or do I need to generate separate public/private key pairs in all of these packages and upload the public key separately?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Usually you do not upload private keys on key servers, just public keys... private keys are meant to be, well, private. No point in shouting them far and wide.

OpenPGP is a standard format for messages and keys. The mathematical object which is a RSA public key (technically a list of eight integers for the private key, two integers for the public key) can be encoded in many ways and OpenPGP is one of them. GnuPG follows this format.

OpenSSL is a library (and some command-line tool) which was primarily focused on SSL/TLS and includes implementation of cryptographic algorithms. SSL uses public keys in X.509 certificates, which is another format, quite distinct from OpenPGP. Same kind of mathematical objects (RSA keys...), but different encoding. GnuPG internally uses OpenSSL for the cryptographic algorithms themselves, but applies its own encoding.

PuTTY is a SSH client which uses again keys (RSA, DSA...) with yet another encoding format. Again, the same mathematical objects are represented as distinct sequences of bytes.

Some people are working on bridges between these competing formats. It is still a great source of inconvenience.

share|improve this answer
1  
Yeah, that was a stupid typo. No uploading of private keys! –  Frank Feb 27 '13 at 20:29
add comment

All of these use the same formatting standard, so yes. In cases where a different format is used, you can usually generate new key containers of different types from a saved asymmetric key pair, as long as the applications you're targeting support the algorithm and key size that you're working with.

share|improve this answer
    
What is an example of a software package that doesn't follow this standard? I thought the three I listed, along with perhaps makecert and whatever GUI ones like Seahorse use internally, are the major ones. –  Frank Feb 27 '13 at 20:13
    
@Frank There are other tools for things like executable signing that use alternative formats. –  Polynomial Feb 27 '13 at 20:18
add comment

Since all of these follow the same standard, yes!

share|improve this answer
    
So it doesn't matter which I use to generate the key pair that I upload? –  Frank Feb 27 '13 at 20:12
    
Well I haven't encountered any issues yet –  Lucas Kauffman Feb 27 '13 at 20:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.