Lets say that I have a situation where a friend of mine has my OpenPGP public key(which is publicly visible on a web page, but I handed it him personally on a piece of paper), I do not know his public key and I need to send encrypted data to him. This means that I need to get his public key in a secure manner so that I can encrypt data with his public key. All the communication needs to happen over e-mail.

At first I thought that he simply encrypts(not for hiding but for ensuring that his public key is not changed during the transmission) his public key with my public key and sends it to me with an e-mail, but actually this does not work because in case of MiT attacker could replace the original e-mail with a forged one and also encrypt it with my public key. In other words it is not possible for me to tell that the public key I received is actually my friends public key.

Am I correct that there is no other solution to this other than I need to get his public key on a piece of paper, I verify his public key through a trusted introducer(e.g. a Certification Authority), etc?

  • you can personally give him a shared secret, or you must know his public key.
    – dandavis
    Oct 25, 2016 at 17:02

1 Answer 1


Yes. There must be a trusted entity, be that the connection between a and b that c cant access or a CA who can confirm that a is a and that b trusts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .