The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity:
- the public key
- the signature
- the fingerprint of the public key
Assuming that the author keeps his private key secured properly, my question is that is it necessary to only know 1 element for sure to ensure the authenticity of a file signed with that particular key from the genuine author?
Or in other words if at least 1 element of it we know for sure it belongs to the genuine author, can we detect any discrepancy or manipulation with a confidence level provided by the RSA bit count (like RSA 4096 = 128bit security, and attacker would need to brute force at least this to manipulate the signed file)
- If we know for sure the hash of the public key, we can compute the genuine fingerprint, and if either the signature is manipulated (like an adversary trying to give us a malwared file) or they give us a fake fingerprint, we will be able to tell it
- If we know for sure the signature of the genuine file, then if the adversary is giving us a phony public key with a phony fingerprint, we will know that it won't match to the signature.
- If we know for sure the fingerprint, while we downloaded a fake public key and a fake signature, then the fingerprint of that won't match to that signature and public key.
So in either case we only need to be able to know at least 1 part of it for sure to be able to authenticate somebody's RSA key.
Presumably the fingerprint is the easiest to authenticate, the trusted counterparty could send it over via a phone call for example and then we would be able to authenticate his signed files from then onwards with certainty?
Is this the case, or am I missing something behind this theory?