we want to encrypt emails that we send to the user with his public key. this works great, however the user can also type in a broken/invalid public key ("asdf123") and then the encryption won't work obviously.

how can i validate, that the user inputted a pgp public key with correct format?

  • 2
    That depends on the environment. Would you like to do this in the context of an application or a shell? – MechMK1 Oct 30 '19 at 13:38

You might want to try using pgpdump to test if the format of the public key that the user entered is valid. See https://superuser.com/questions/696941/human-readable-dump-of-gpg-public-key for more information.

| improve this answer | |

"@mti2935"'s answer tells you how to validate the format of a public key. This may not help if an adversary uses a correctly formatted public key. There is another way to validate and find out if a correctly formatted key came from the original sender.

PGP supports that creation and use of certificate authorities (CA) for the public keys. A CA distributes public and private keys (only kept by the owner of the private key). Each of these public keys belong to a specific CA. The CAs hands out certificates that match to specific public keys. The certificate includes information about the SHA hash of the public key, the current owner of the public key, and both the issue and expiration date of the certificate. With the involvement of a secure hash algorithm in the certificate, it will be almost impossible to forge a public key with the same hash as the original sender’s public key. If a CA is involved, you can look at the hash of the key in the public key certificate. Calculate the secure hash of the public key and try to match it with the one in the certificate. If it does not match, then you do not have the original senders public key. If it matches, check to see if the date you received the key is within the issue and expiration date of the certificate. If it is outside of that range, then the certificate was not valid when the key was created. An invalid certificate when a key was created mean the key should not be trusted.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.