3

Whenever I generate a new 4096 RSA key in my GPG program and export the public key to a text file, I get a text file containing a total of around 52 lines (it varies, one of them is 53 lines).

However, I just imported a public key from another guy I found on his website. My GPG program shows that his key length is also 4096. However, his key was only 30 lines, not even close to 52-53.

What explains this difference? How can he have such a short public key even for 4096?

The line width is 64 characters in every case (where the key is at full width, which is most of lines).

When I counted the liens, I started at "-----BEGIN PGP PUBLIC KEY BLOCK-----" and ended at "-----END PGP PUBLIC KEY BLOCK-----".

Updates:

I found the reason. My key contains both "sig" and "sig 3" with the same ID. The other guy's key contains only the "sig". This explains the difference, I guess.

My questions now:

Why should I keep the "sig 3"? Why where both "sig" and "sig 3" generated for me?

When I export the public key, my program doesn't give me any option to pick only one of them. It's either all or nothing.

Is there any good reasons to provide people with both "sig" and "sig 3"?

What do you recommend I do?

Improve this question
3
  • 1
    I suspect his key is encoded in a different format than yours (not sure if this is possible - I'm by all means no RSA specialist). If it is decoded to binary representation, both keys (yours and his) should be exactly 4096 bits.
    – Steven Volckaert
    Commented Apr 26, 2014 at 11:26
  • @Steven I found the reason. Will update question soon.
    – cryptonamus
    Commented Apr 26, 2014 at 11:40
  • Useful reading: we.riseup.net/riseuplabs+paow/openpgp-best-practices?
    – Deer Hunter
    Commented Apr 26, 2014 at 11:56

1 Answer 1

Reset to default
1

The signature levels are defined in the man page under --ask-cert-level and --default-cert-level. sig refers to cert level 0, "means you make no particular claims as to how carefully you verified the key." sig 3 refers to cert level 3, "means you did extensive verification of the key." So self-signatures, which are created at the time of key generation and which I believe are part of cross-signing, are level 3. sig would have likely been made by someone signing your key or by you signing your key with another key of your own, because the default cert-level when signing, is zero.

If you ever want to get rid of a signature, run --edit-key. Then, because signatures are associated with specific UID's you will have to select a UID associated with that signature. (See the digit in parenthesis next to the UID when you run list.) Select that UID with uid n, and then run delkey. I don't suggest you delete the self-signatures though, as that will destroy the integrity of your key (see the link regarding cross-signing).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .