2

I was wondering if I can put a download URL for my recipients to get my GPG public key easily in my email signature.

Is this a good practice? If not, what's a good alternative?

1

I submitted my keys to known key servers such as http://pgp.mit.edu and put the key ID in my outgoing email signatures.

1

Sort of. There is a time-honored practice by which people publicize their fingerprints and build a lasting association between their identity and that key. URLs are also useful for this purpose.

As @Philipp points out, it does not validate the current email. But if you always send the fingerprint, and the recipient can see that your fingerprint in an email from 6 months ago matches your fingerprint today, they gain some reassurance that that key is you. On the other hand, if you suddenly say "This is really important, you can decrypt it, here's my key" and that's the first time you've publicized it, that's fishier.

I want to draw a distinction here between publishing and publicizing. When you upload your key to a keyserver as @user3244085 suggests, you're publishing your key - putting it somewhere other people can get at it if they want to go get it. On the other hand, if you put your fingerprint or a key link in your email, your blog posts, your interactions on the net, then you're publicizing - you're actively creating a public record that other people can view when determining your authenticity.

1

You could. But keep in mind that:

  • it is useless to validate the current email, because anyone who forged it could also forge the key.
  • when the receiver saves your key and uses it to validate future correspondence, it only proves that both the old and the new email were manipulated by the same attacker.

Keys for validating one medium of communication should preferably be exchanged over a different medium, because then an attacker would have to control both channels of communication to impersonate you. Referring the other party to a keyserver is an option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.