I'm making an e-mail system/client. I'm trying to correctly detect incoming e-mails which can be replied to with PGP encryption. This means finding out their public PGP key. I currently do:

  • Parse the e-mail body for a PGP public key block.

I suspect that these could be done:

  • Check for attachments with some kind of standard file name?
  • Check for a special hidden header which either spells out the public PGP key directly, or links to an external resource where it can be fetched?

Thanks in advance for clarifying how one properly detects/sends PGP public keys in e-mail context for maximum support.

  • Usually you scan a keyserver (search for PGP keyserver) to see if the owner of the email have a key there. – ThoriumBR Jul 23 '20 at 23:11

There's no one particular way to do this. Just signing all outgoing mail is one way people advertise that they support PGP provided their key is on a public keyserver.

Enigmail (Thunderbird plugin) has an option to include a public key as an attachment in all outgoing mail. It has a type of application/pgp-keys and the name is 0x<KEYID>.asc where <KEYID> is the key ID in hex.

There are several clients which support Autocrypt, a protocol for opportunistic encryption by storing public keys in headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.