The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity:

  • the public key
  • the signature
  • the fingerprint of the public key

Assuming that the author keeps his private key secured properly, my question is that is it necessary to only know 1 element for sure to ensure the authenticity of a file signed with that particular key from the genuine author?

Or in other words if at least 1 element of it we know for sure it belongs to the genuine author, can we detect any discrepancy or manipulation with a confidence level provided by the RSA bit count (like RSA 4096 = 128bit security, and attacker would need to brute force at least this to manipulate the signed file)

  • If we know for sure the hash of the public key, we can compute the genuine fingerprint, and if either the signature is manipulated (like an adversary trying to give us a malwared file) or they give us a fake fingerprint, we will be able to tell it
  • If we know for sure the signature of the genuine file, then if the adversary is giving us a phony public key with a phony fingerprint, we will know that it won't match to the signature.
  • If we know for sure the fingerprint, while we downloaded a fake public key and a fake signature, then the fingerprint of that won't match to that signature and public key.

So in either case we only need to be able to know at least 1 part of it for sure to be able to authenticate somebody's RSA key.

Presumably the fingerprint is the easiest to authenticate, the trusted counterparty could send it over via a phone call for example and then we would be able to authenticate his signed files from then onwards with certainty?

Is this the case, or am I missing something behind this theory?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.