1

Looking for "Barack Obama" in Ubuntu's keyserver return these results

For example, take the first search result:

pub rsa2048/86678817fca9987e2d9a3d3ea2437f33d4266cc0 2017-07-08T04:17:08Z
     Hash=40135e3a9da88180a317be949b301708

The first line is the key's fingerprint.

I can obtain the fingerprint of my keys using gpg --list-keys --fingerprint

  1. What is the second line? Why we need a hash if we already have the fingerprint?

  2. How can I retrieve the hash for my keys in gpg?

  3. If my friend calls me to verify that the public key is mine, should I give him the fingerprint or the hash?

1
  • 1
    Please note that tags make more sense when they directly relate to the question, so less is more here.
    – user163495
    Jan 28, 2021 at 23:18

1 Answer 1

1

I think you're mistaken. The top hexidecimal value is the key ID. That's what they're explaining at the top of the search results page with: Type bits/keyID cr. time exp time key expir. The second line with "Hash=" is the fingerprint of the public key calculated with MD5.

Fingerprints and hashes are functionally similar in that they are both produced by one-way functions. They both take arbitrarily large inputs and produce a smaller output. The important distinction is that cryptographic hash functions require collision resistence while fingerprints do not. The trade-off is that hashes are slower than fingerprints to calculate. So for large amounts of data, use fingerprints. For security-critical applications, hashes. Or both, starting with the faster fingerprint and using it like a Bloom filter. This specific case is a little confusing because MD5 is a cryptographic hash function used for fingerprints. MD5 is no longer considered trustworthy for cryptographic applications but can still function for fingerprints.

If you want the SHA256 hash you can use ssh-keygen -i -e "SHA256" -f yourkeyfile.

If you and your friend are using out-of-band communications to verify your keys then good job. Just use the fingerprint provided by gpg --fingerprint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.