1

I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about HTTPS. Can I use it on my signing key?

  • Let's Encrypt does not sign GPG keys. What kind of warning is a user displayed when attempting to verify a file you signed? – MechMK1 Feb 10 at 12:21
  • @MechMK1 gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. – UnicornsOnLSD Feb 10 at 19:48
2

GPG and Browsers trust certificates in fundamentally different ways.

How do Browsers do it?

Browsers need a set of trusted root certificates. These either come bundled with the browser, or the browser relies on the root certificates that the OS provides.

When trying to validate a certificate, the browser checks first if the certificate matches what the browser is trying to access (e.g. if a browser tries to access security.stackexchange.com, does the certificate claim to be from security.stackexchange.com?) and then checks who signed that certificate. Then the browser checks that certificate, all the way up to the root. If the root is found in the browser's trust store, the certificate is considered valid.

How does GPG do it?

The above mentioned approach requires trusting certain third parties not to issue bogus certificates. Instead, GPG tries to distribute trust among peers. The way this works is that you generate a key that originally nobody trusts. You then share your key with your peers, and your peers then sign your key. They can choose the following options:

  • Marginal trust: This option means that you trust that key a little bit, but not necessarily completely. This should be used if you got that key through some means, but can't actually 100% verify that the key is legitimate.
  • Full trust: You trust that the key belongs to whoever you believe it to belong, and you also trust that the person will make sane signing decisions.
  • Ultimate trust: This is for your own keys. You will trust everything these keys do, and everything signed by these keys.

How do I fix this weird GPG error?

First of all, your friend needs to verify through some means that the public key they received is actually yours. This can be done through any channel which you think is unlikely to be compromised - most favorably in person.

Then, your friend should sign your key. It doesn't matter what trust they give it, just that they signed it. As a result, your friend's GPG installation will consider the key trustworthy.

Why would you even do such a complicated thing?

GPG is notoriously user-unfriendly, which is likely a reason why it is not widely used outside of enthusiast circles. The core idea behind it, however, is that solid trust established by meeting in person and exchanging keys is very very difficult to subvert. No compromised CA could get you to trust a key which you did not manually set to trust.

If this is something you are worried about is a different story. If you want to learn more about GPG's trust model, this article gives some good insights.

| improve this answer | |
  • Thanks for the great answer :) When I use other signing keys, for example qbittorrent's signing key, I do not get this error. Is there a common "key signer" or would that not apply to me? – UnicornsOnLSD Feb 11 at 21:39
  • @UnicornsOnLSD It depends who you trust already, or if the instructions on their page include you trusting their key. Or your GPG installation uses a different way of establishing trust than the web-of-trust, which is possible as well. – MechMK1 Feb 12 at 11:26
1

No.

GPG has various strategies for letting the user configure what keys they trust, but it's up to the user to do that. There is no central authority that can vouch for you, like there is for HTTPS.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.