I have a PGP signature of a known message. However, I am not sure who signed it.

Can I get the public key - or, at least, the fingerprint/other way of searching for it on a public keyserver - just from the message and a signature?

Example: I have this message/signature from here https://futureboy.us/pgp.html

Hash: SHA1

I vote YES on this important measure.

Alan Eliasen
Version: GnuPG v1.4.13 (GNU/Linux)


Can I somehow find who signed it, just by looking at it?

migrated from crypto.stackexchange.com Jul 11 '14 at 0:49

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • Bear in mind that, while it may be possible to get the public key, you should still also verify the key itself (e.g. verify trusted third-party signatures on the key, or contact the owner out-of-band) before trusting the signature. – Iszi Jul 14 '14 at 14:29
up vote 18 down vote accepted

Yes. The format of the signature is defined in RFC 4880. If you decode the base-64 and interpret the data, you will find that the bytes from position 19 to 26 (inclusive) are the issuer ID in this case:

ID hex: E48184B5B05676B1

which matches the "Long key ID" behind your link. If you convert the ID to base 64, you can find it in the original signature data, because 18 bytes happen to divide evenly into 24 base 64 characters:

ID b64: 5IGEtbBWdrE=
Signature: iEYEARECAAYFAlHZCvgACgkQ5IGEtbBWdrF5HgCfc4xhT29ouAWdo1PMlyDKIfaq...
  • 1
    I've never studied the format of the signature and I didn't know this way to recover the KeyID, interesting Could you add the commandline to recover the LingKeyID? using base64 -d I get an "invalid input" error – ddddavidee Jul 2 '14 at 9:17
  • @ddddavidee, no but I literally just did b16encode(b64decode(sig)). – otus Jul 2 '14 at 9:31

While the other answers are correct, you don't need additional software. You can get all of this information from gpg if you add the -vv command-line switch. (This means extra verbose.) For example, the easiest way to get detailed information about an OpenPGP-formatted message is to simply type:

gpg -vv

And then paste the message into it (or pass a filename as an argument.) For example, pasting in the message above gives you the following detailed and interesting information:

gpg: armor header: Hash: SHA1
:packet 63: length 19 - gpg control packet
gpg: armor header: Version: GnuPG v1.4.13 (GNU/Linux)
:literal data packet:
    mode t (74), created 0, name="",
    raw data: unknown length
gpg: original file name=''

I vote YES on this important measure.

Alan Eliasen
:signature packet: algo 17, keyid E48184B5B05676B1
    version 4, created 1373178616, md5len 0, sigclass 0x01
    digest algo 2, begin of digest 79 1e
    hashed subpkt 2 len 4 (sig created 2013-07-07)
    subpkt 16 len 8 (issuer key ID E48184B5B05676B1)
    data: [159 bits]
    data: [160 bits]
gpg: Signature made Sun 07 Jul 2013 12:30:16 AM MDT using DSA key ID B05676B1
gpg: using PGP trust model
gpg: key 92F88CF9: accepted as trusted key
gpg: key 6C77A726: accepted as trusted key
gpg: Good signature from "Alan Eliasen (http://futureboy.homeip.net/) <eliasen@mindspring.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 402C C0D3 D527 13E3 FB7C  7103 E481 84B5 B056 76B1
gpg: textmode signature, digest algorithm SHA1

In that output, you can see the 16-hex-digit key id clearly: E48184B5B05676B1

That will let you search for the signer in a keyserver using something like:

gpg --search-keys E48184B5B05676B1

By the way, I wrote the GPG guide that you reference, and I can assure you that I signed the above message. :)

  • Also note the WARNING starting on the fourth-from-last line. While you can get the public key information, it's of limited value unless you can also confirm the key itself is trustworthy. – Iszi Jul 14 '14 at 20:31
  • 1
    @lszi That's a very important point that bears repeating. In the GPG guide that I wrote (the one referenced by the original poster,) I note very strongly that unless you've validated the key with its owner, you have no guarantee at all that they actually signed it. Anyone can generate a public key for any e-mail address, and can post it to a keyserver. See this section: futureboy.us/pgp.html#ProcedureForVerification – Alan Eliasen Jul 15 '14 at 8:06

Yep, I actually can. With GnuPG, for example:

gpg --verify file.txt

(with the above file)

writes, at the end

Primary key fingerprint: 402C C0D3 D527 13E3 FB7C 7103 E481 84B5 B056 76B1

OpenPGP.js works too.


'Hash: SHA1',
'I vote YES on this important measure.',
'Alan Eliasen',
'Version: GnuPG v1.4.13 (GNU/Linux)',
'-----END PGP SIGNATURE-----']. join('\n')




Yes, you can.

At least you can easily recover the KeyID and with that you can recover the public key from a keyserver (if the user ever uploaded it).

You can recover the KeyID using pgpdump (locally if you install it or via the website: http://www.pgpdump.net/)

For example message you posted is signed by:

Sub: issuer key ID(sub 16)(8 bytes) Key ID - 0xE48184B5B05676B1

and finally: http://pgp.mit.edu/pks/lookup?op=get&search=0xE48184B5B05676B1 to get the Key or the key details (you can also use your gnupg installation to get the data from the commandline)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.