Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Is there any point in signing an OpenPGP public key that has not been uploaded to a key server? In other words: does anyone except person A who signs person B's public key notice that the signing has taken place?

Background: since I haven't decided to upload my public key to a key server yet, I'm wondering if there's any point in asking friends to sign my key.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Web of trust? Instead of using a centralized, public key server, you and your friends could be exchanging key files directly. In which case the added signatures would be doing something.

However, if you are going to sign it, and then leave the file on your hard drive then you are correct that it doesn't do much good to others (though I think the GNOME Keyring gives some sort of priority to keys that you've signed).

share|improve this answer
    
Does that mean, after they sign it they have to send me (and potentially other friends) my public key with their added signature? By encrypte mail for example? –  docendo discimus Jun 3 at 16:03
    
@docendodiscimus I don't have a PGP to play with here, but I think you can export a signed version of someone else's certificate to a file. –  Mike Ounsworth Jun 3 at 17:25

Keeping Certifications Private or Public

The whole OpenPGP web of trust idea is build around certifications (signatures of other keys) being publicly available, so other users can build trust paths on these. Keeping certifications private is surely legit, but will not help others (also contacting you).

If you only share your key among your friends, they could still make use of certifications you issued. If you also share it with everybody, also others might make (some) use of them when building trust paths, depending on their need of certainty and trust they put into you (possibly without knowing you).

Procedure for Signing Keys not on the Keyserver Network

Others could very well manually import your key (gpg --import [file]), sign it (gpg --edit-key [key-id]) and finally export it again (gpg --export [key-id] > [file]). Now the exported key contains your signature, and they can sent it back to you. When importing the file, the certification gets merged to the other one's on your key. If you export it again, you could distribute your public key together with all the certifications together in one file to everybody that wants to use your key. This is pretty much the same operation like fetching keys from a keyserver using gpg --recv-keys [key-id] and finally sent it back to them using gpg --send-keys [key-id], just that latter one is public and makes distributing the key easier.

Probably Somebody Will Upload it by Accident

Most people are used to upload keys after putting certifications on them (or they use some software that just mails back the certifications). At some point, somebody will forget about your request not to upload it and just do so, or simply upload his full keyring using gpg --send-keys (yes, that's possible!). Expect every shared OpenPGP key to be available on the key server network at some time, by creating an OpenPGP key and sharing it you in agree with it being shared on the key server network to some extend (without wanting to have this being an excuse to upload everything anyway, but it will happen and you should be aware about this).

share|improve this answer
    
Thanks for your detailed answer, certainly helpful! As you can imagine I'm just getting started with this whole topic. –  docendo discimus Jun 4 at 14:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.