Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block?

I found the hexa value of the key in the binary file, but I guess the position is based on the key kind/size.

Basically, I have the base64 formatted public key and I would like to retrieve the key ID from it, without importing it with GnuPG.

share|improve this question

3 Answers 3

up vote 6 down vote accepted

RFC 4880 on OpenPGP message format talks about how to calculate key ID from public key.

Excerpts from section 12.2:

For a V3 key, the eight-octet Key ID consists of the low 64 bits of the public modulus of the RSA key.

And for V4 keys:

A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field. The Key ID is the low-order 64 bits of the fingerprint.

You can easily parse the last 64 bits from the base64 encoded public keys, which is the key ID for the corresponding public key.

share|improve this answer
could you please elaborate more on "easily parse the last 64 bits..."? I generated a pgp key (Got its MPI in base64 format. Is it what is meant by public key?), copy-n-pasted it to here, for example, and counted last 8 bytes in hex representation. Is that correct? – rightaway717 Mar 27 at 14:50

You can use gpg --dry-run to prevent changes.

Following line will print the key id in its output (can be modified using the usual modifiers like --with-colons for further processing). A4FF2279 is the key ID in here.

$ gpg --dry-run --import pubkey.asc
gpg: key A4FF2279: public key "[User ID not found]" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: no ultimately trusted keys found

Just tried it, the key did not get stored to my keychain, but the key ID was printed. But watch out with --dry-run, the man page has a warning:

         Don't make any changes (this is not completely implemented).
share|improve this answer
Is the ID the part after 'key' in the command's output? – Urhixidur Nov 25 at 15:13
Not originally written for answering this question, but includes a detailled description of OpenPGP key IDs in the first paragraphs: – Jens Erat Nov 25 at 15:15
Thanks for trying, but that doesn't answer the question. If I do something like $ gpg --import RPM-GPG-KEY-CentOS-5 (--dry-run won't work), I get a bunch of output including this line: gpg: key E8562897: public key "CentOS-5 Key (CentOS 5 Official Signing Key) <>" imported Is E8562897 the key ID? – Urhixidur Nov 25 at 16:46
This is a completely unrelated question, comments are not meant for intense discussions. Please ask a new question instead. – Jens Erat Nov 27 at 14:16
Jens Erat, I disagree, the comment is related since it asks for clarification of the answer. – Urhixidur 2 days ago

To avoid the "not completely implemented" issue mentioned in Jens Erat's answer, use gpg --homedir on a temporary directory. You may need to modify the mktemp command based on your platform:

gpg --homedir $( mktemp -d -t '' ) --import /tmp/somekey.asc
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.