I'm using bouncycastle to access my public keys in gpg. Currently the public key, when read to base64 gives me this:


I thought that this should be a length 4096 RSA key but it's the wrong length. What I really want to do is to use this public key to verify a signature. Would anyone be able be help shed some light on what format this is?

1 Answer 1


This is base64 (but not full 'armor') of a public key block in OpenPGP (rfc4880 et pred) format used by GPG. Aside: there is no such thing as opengpg; PGP was the original software by Phil Zimmerman and the company he turned it over to, OpenPGP is the standard, and GNU Privacy Guard aka GnuPG aka GPG implements that standard, as also does BouncyCastle.

OpenPGP and thus GPG key blocks include much more than just the raw crypto key; in particular public keys (including this one) almost always are attached to a user-id and carry one or more signatures -- at least a 'self-signature' by the key or its parent, and often signatures by other (trusted) users to form the 'web of trust'. See 11.1 in the linked RFC for an overview.

After converting this base64 to binary, gpg --list-packets decodes it as:

:public key packet:
        version 4, algo 1, created 1484099607, expires 0
        pkey[0]: [2048 bits]
        pkey[1]: [17 bits]
        keyid: 1163CD81B25C13AC
:user ID packet: "Chris Zheng (czheng) <czheng@atlassian.com>"
:signature packet: algo 1, keyid 1163CD81B25C13AC
        version 4, created 1484099607, md5len 0, sigclass 0x13
        digest algo 8, begin of digest cb ed
        hashed subpkt 2 len 4 (sig created 2017-01-11)
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 11 len 6 (pref-sym-algos: 9 8 7 3 2 1)
        hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)
        hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
        hashed subpkt 30 len 1 (features: 01)
        hashed subpkt 23 len 1 (key server preferences: 80)
        subpkt 16 len 8 (issuer key ID 1163CD81B25C13AC)
        data: [2046 bits]
:trust packet: flag=00 sigcache=00

As you can see it is a 2048-bit RSA key, not 4096-bit. The algo in a pubkey packet or a signature packet is OpenPGP's encoding of a pubkey algorithm and 1 is RSA, see section 9.1.

I'm not sure how knowing the format helps you verify a signature, but that's what you asked.

  • the reason why I ask is because I want to be able to create a java.security. PublicKey object with the bytes and I don't know how to do that.
    – zcaudate
    Feb 5, 2017 at 20:42
  • please see stackoverflow.com/questions/42048932/… for more context
    – zcaudate
    Feb 5, 2017 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.