Why would someone create an OpenPGP public key with my name and email address?

Question

By chance, I typed gpg2 --search myemailaddress on the command line, and searched public keyservers for my email address (I'd actually just meant to search my local keyring, for which I should have used gpg2 -k myemailaddress).

To my surprise, I discovered that there was a public key, created just a few days ago, which as far as I know I did not create. It wasn't on my local keyring, or on the keyrings of other computers on which I've ever used GPG.

I'm at a loss how this may have happened. Are there any applications that would "helpfully" create OpenPGP keys and publish them, without telling me or attaching them to my local keychain? Is there some scam for which this would be useful?

Answer 1

GPG can upload your public key automatically, and there may be other utilities that do so. The thing to do is compare the public key on the web with the one on your keyring. If they match then it must have originated from your system as nobody could create it in isolation (that's the whole point of public private key pairs).

If the public key is different from the one you generated then it's possible that someone is attempting to use your identity. It seems pretty unlikely though, so I'd look for other explanations.

Answer 2

OpenPGP key pairs do not have the same built-in trust chain as X509 key pairs (certificates).

OpenPGP keys can be signed in a Web-of-Trust manner but this is not as strongly encouraged as the hierarchical trust chain of X509 certificates, where self-signed certs have to jump great hurdles to be recognised in browsers, email clients and PDF readers.

Put simply, there is no practical way to ensure no one publishes a OpenPGP key pair with the same metadata. It simply comes down to trust; or more specifically that no one should take key meta data on face value.

---

Why would someone publish a key with the same meta data?

Well, how well known is your email address? Would someone assume they are communicating with you if they saw a public key with your name or email address?

I'm assuming unless you are journalist or a politically exposed person, this was probably some application or website thinking it was doing you a favour - perhaps for an app feature or website service you never ended up using. It might never have even stated that it would do so - as it assumed you'd use the service sufficiently to become aware of this "feature".

As GdD mentions, this might be also some background PGP-aware application auto-posting a key pair that wasn't cached correctly in your primary keystore.