I know that GnuPG follows the OpenPGP standard, but if I generate a public/private key pair using GnuPG and upload the public key to a key server, i.e. the one at MIT, or use it to sign files, packages, etc. will other users who use OpenSSL, GnuPG, Putty, etc. be able to use it or descrypt the signed packages? Or do I need to generate separate public/private key pairs in all of these packages and upload the public key separately?


Usually you do not upload private keys on key servers, just public keys... private keys are meant to be, well, private. No point in shouting them far and wide.

OpenPGP is a standard format for messages and keys. The mathematical object which is a RSA public key (technically a list of eight integers for the private key, two integers for the public key) can be encoded in many ways and OpenPGP is one of them. GnuPG follows this format.

OpenSSL is a library (and some command-line tool) which was primarily focused on SSL/TLS and includes implementation of cryptographic algorithms. SSL uses public keys in X.509 certificates, which is another format, quite distinct from OpenPGP. Same kind of mathematical objects (RSA keys...), but different encoding. GnuPG internally uses OpenSSL for the cryptographic algorithms themselves, but applies its own encoding.

PuTTY is a SSH client which uses again keys (RSA, DSA...) with yet another encoding format. Again, the same mathematical objects are represented as distinct sequences of bytes.

Some people are working on bridges between these competing formats. It is still a great source of inconvenience.

  • 1
    Yeah, that was a stupid typo. No uploading of private keys! – Frank Feb 27 '13 at 20:29

All of these use the same formatting standard, so yes. In cases where a different format is used, you can usually generate new key containers of different types from a saved asymmetric key pair, as long as the applications you're targeting support the algorithm and key size that you're working with.

  • What is an example of a software package that doesn't follow this standard? I thought the three I listed, along with perhaps makecert and whatever GUI ones like Seahorse use internally, are the major ones. – Frank Feb 27 '13 at 20:13
  • @Frank There are other tools for things like executable signing that use alternative formats. – Polynomial Feb 27 '13 at 20:18

Since all of these follow the same standard, yes!

  • So it doesn't matter which I use to generate the key pair that I upload? – Frank Feb 27 '13 at 20:12
  • Well I haven't encountered any issues yet – Lucas Kauffman Feb 27 '13 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.