1

I have a dual-boot setup with Mac OS X Mountain Lion and Debian GNU/Linux Sid (fully up-to-date).

I installed gpg in OS X by executing brew install gpg. I then generated a keypair for myself to use.

The gnupg (and gnupg2, although this isn't the default gpg) and seahorse packages were installed during the Debian installation.

When I open Seahorse, I get a window with one item that says my name, my email, and "Personal PGP Key". When I double-click on it and get a details view that says "Private PGP Key", the key ID, my email and my name.

Here's my question: when I click the Names and Signatures tab in the key details window, it gives me one item in the list - my key. However, when I click on the key, the button to sign the key is enabled. Is this normal behavior? If it is, what would be the use for signing your own key?

3

If you generate a public / private PGP key pair and publish the public half without signing it with the private half you're leaving yourself susceptible to a denial of service attack. Once you push your public key to a PGP server, it can be modified by an attacker and redistributed.

The attack goes something like this: attacker gets your key from the PGP server, modifies the user ID (email) while the key fingerprint will remain unchanged so the key will still look authentic. They then redistribute they key as widely as possible, maybe through another PGP database.

Anyone who doesn't already know your email and has to rely on the public PGP database to find it will send messages to this new ID and you'll never get the mail. Still, the attacker won't be able to decrypt them without getting your private key so it's just a DoS and one that isn't very effective IMHO. Very few people use PGP servers as address books these days.

Still it's a possibility and one that's well known and easily defeated. Last I remember most PGP applications sign they public key when the pair is created by default but it's been a long time since I've created a new key.

There's a good write-up about this here: http://www.heureka.clara.net/sunrise/pgpsign.htm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.