5

Here is a few questions revolving around the same core problem.

  1. Let's say I generate a PGP keypair.
  2. I now get the keypair signed by person A at signing party X.
  3. In the evening, I give my now-signed public key to person B.
  4. Next day I get my public key signed by person C at signing party Y.
  5. In the evening, I give my now-signed public key to person D.
    • Person B and person D now both have my public key, but different versions (I don't know if version is the right word).
  6. Imagine a person E obtains my public key from both person B and person D.

How does person E determine which one to use?

Similar, I could start by making two copies of my public key and then get them signed by two mutually different groups of people.

Again, how can a later-coming person's PGP software determine which one to use?

I wonder if it can automatically merge the signatures in to an all-containing key, if and only if the list of attached signatures need to be self-signed by my private key.

Finally, do people keep uploading their keys to keyservers as they get signed by more and more people?

5

A public key like published on the keyservers actually consists of a set of single packets. One is your public key, then there are user IDs, and the incoming signatures from other keys (and some more stuff which is not important here).

How does person E determine which one to use? Again, how later-coming person's PGP software determine which one to use?

As stated above, the key is the same, just the signature packets are differents. You can have a look at them using gpg --listpackets [file], also have a look at this answer on how to view OpenPGP key files. I strongly recommend to have a look at the rather lengthy output to understand what's going on.

When "updating" the key (gpg --recv-keys [key]) from a key server, all the new packages will get merged with the ones already on the disk. The keys do not "branch" in any kind. Imagine this as the union of signatures sets. This can also be done by exporting and importing using gpg --import [file].

Finally, do people keep uploading the[ir] keys to keyservers as they get signed by more and more people?

I hope I got your question right, and you want to know whether people upload their key from time to time to distribute their new signatures using gpg --send-keys [key]. Then, the answer is a clear "yes and no". Most do, a lot only now and then, and some not at all.

  • Good answers leads to more questions: So each sigature only signs the owner package and not also the previous attached signatures. Can I sign they key of person X, with a mock user ID like 'Name: Person X is a git' and then upload my signature to they key-server, or do I need the private key to upload new signature packages? – Einar Mar 12 '14 at 13:10
  • 1
    In the end, signatures are attached to user IDs (which is done by signing it with a special signature by the primary key). You might create such a fake UID and signature packet, but an implementation reading it should ignore it as the UID packet is missing the binding signature. – Jens Erat Mar 12 '14 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.