4

By chance, I typed gpg2 --search myemailaddress on the command line, and searched public keyservers for my email address (I'd actually just meant to search my local keyring, for which I should have used gpg2 -k myemailaddress).

To my surprise, I discovered that there was a public key, created just a few days ago, which as far as I know I did not create. It wasn't on my local keyring, or on the keyrings of other computers on which I've ever used GPG.

I'm at a loss how this may have happened. Are there any applications that would "helpfully" create OpenPGP keys and publish them, without telling me or attaching them to my local keychain? Is there some scam for which this would be useful?

4

GPG can upload your public key automatically, and there may be other utilities that do so. The thing to do is compare the public key on the web with the one on your keyring. If they match then it must have originated from your system as nobody could create it in isolation (that's the whole point of public private key pairs).

If the public key is different from the one you generated then it's possible that someone is attempting to use your identity. It seems pretty unlikely though, so I'd look for other explanations.

  • It definitely doesn't match the keys on my keyring. Different fingerprint, different creation date, different key size. Curiously, though, it uses my full name, as does the key I produced and published -- I rarely spell out my middle name, but I did so on the recommendation that it match the name on my government-issued ID exactly. Also, looking for other explanations is kinda why I'm here. – bgvaughan Oct 15 '13 at 9:32
3

OpenPGP key pairs do not have the same built-in trust chain as X509 key pairs (certificates).

OpenPGP keys can be signed in a Web-of-Trust manner but this is not as strongly encouraged as the hierarchical trust chain of X509 certificates, where self-signed certs have to jump great hurdles to be recognised in browsers, email clients and PDF readers.

Put simply, there is no practical way to ensure no one publishes a OpenPGP key pair with the same metadata. It simply comes down to trust; or more specifically that no one should take key meta data on face value.


Why would someone publish a key with the same meta data?

Well, how well known is your email address? Would someone assume they are communicating with you if they saw a public key with your name or email address?

I'm assuming unless you are journalist or a politically exposed person, this was probably some application or website thinking it was doing you a favour - perhaps for an app feature or website service you never ended up using. It might never have even stated that it would do so - as it assumed you'd use the service sufficiently to become aware of this "feature".

As GdD mentions, this might be also some background PGP-aware application auto-posting a key pair that wasn't cached correctly in your primary keystore.

  • GnuPG isn't configured to automatically publish keys on my systems. Are you aware of any other applications that would generate keys and publish them? – bgvaughan Oct 15 '13 at 14:23
  • @bgvaughan Is your system Windows or *Nix based? – LateralFractal Oct 15 '13 at 21:31
  • My main desktop dual-boots Fedora 19 and Windows 7; I haven't installed anything related to OpenPGP on Windows. At work, I have a Fedora VM running on a Windows 8 host; similarly, there aren't any OpenPGP tools that I know of on the host OS. I've also used GnuPrivacyGuard on my Android phone, but that's not been installed for weeks. My master signing key is not stored on any of my computers. The mystery key was self-signed. And I'm pretty sure that on the day the mystery key was generated, my computer was only active for a few hours, in Windows, for gaming purposes. – bgvaughan Oct 15 '13 at 23:43
  • 1
    @bgvaughan Which is why I'm assuming unless you are journalist or a politically exposed person, this was probably some application or website thinking it was doing you a favour - perhaps for an app feature or website service you never ended up using. It might never have even stated that it would do so - as it assumed you'd use the service sufficiently to become aware of this "feature". – LateralFractal Oct 16 '13 at 2:48
  • 1
    @bgvaughan I've added some of my comments to the main answer. Good luck finding which app/website did it :-) I myself download/use about 30 - 50 "I'll try this out" applications per month. – LateralFractal Oct 16 '13 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.