33

I'm going to print some business cards, and along with my email address I was thinking of putting my PGP ID on it as well.

After doing some research I found that using the short ID is not a good idea.

What is the best way of doing this - or should I forget about it?

Improve this question
6

7 Answers 7

Reset to default
26

Considering that your public key is only usable by a computer1; you can remove clutter from your business card by having all electronic data accessible online and referred to by a QR code.

The link could refer to a vCard file stored on, say, a public Dropbox. As the vCard format can store any business or contact information including OpenPGP keys.

Alternately a high resolution QR code could store the entire public key on the back of your business card. Which has certain security advantages.

1. Hand ciphers notwithstanding.

Improve this answer
9
  • 2
    Such a high resolution QR code would require a business card foldable multiple times. I was able to put a revocation certificate on a printer sheet, but I wouldn't bet for a whole key on a business card.
    – Jens Erat
    Commented Oct 13, 2014 at 7:12
  • 1
    @JensErat A version 40 QR code with low error correction could store about 2,900 bytes of information; this would fit a public key. Your main problem might be that whilst a version 40 QR code would be crisp with the high quality printing used for business cards, mobile phones might not focus successfully on the card at any other than point blank range closer than the minimum focus distance of the camera.
    – LateralFractal
    Commented Oct 13, 2014 at 7:25
  • 2
    A URL link to your vCard would only need a much smaller/coarse QR code. Which is probably for the best; as articles suggest that the error rate increases with larger codes such that lighting conditions, contrast and focal distance become impractical for normal mobile phone cameras reading very large QR codes.
    – LateralFractal
    Commented Oct 13, 2014 at 7:32
  • @LateralFractal a few years ago I worked on something on Android using QR codes around v13 in size (~400 bytes); and even printed ~3.5" on a side we had trouble getting anything below a flagship level device to read them reliably. Cameras are better now; but I'm still skeptical of them being able to read that much off a business card sized code.
    – Dan Is Fiddling By Firelight
    Commented Oct 13, 2014 at 13:18
  • 1
    Uh, this recommendation is absurd. The whole point of the PGP key is to verify your cryptographic signature. Until you can do that, the webserver could be easily MITM'd!
    – Luke Dashjr
    Commented Feb 17, 2016 at 4:18
18

I'd recommend putting your OpenPGP key's fingerprint in textual form and as QR code on your business card.

To do so, you would create an URI with OPENPGP4FPR as scheme and your OpenPGP fingerprint in all caps as data. Then use something like qrencode to create a QR code of the resulting String. Apps like OpenKeychain on Android will understand this.

You can show you fingerprint with:

gpg --fingerprint <email|keyid>

For example:

$ gpg --fingerprint [email protected]
pub   rsa2048/0x8CAC2A9678548E35 2010-07-13 [expires: 2016-06-06]
     Key fingerprint = 1357 B018 65B2 503C 1845  3D20 8CAC 2A96 7854 8E35
...
sub   rsa2048/0x933A3EA0850A0B28 2010-07-13

Look for Key fingerprint value

Key fingerprint = 1357 B018 65B2 503C 1845  3D20 8CAC 2A96 7854 8E35

This is the value you want to give to your peers. You could easily put it on your business card in text form. I would suggest to prefix it with 'OpenPGP' and to keep the spaces for easier readability:

John Doe
Senior Expert

[email protected]
OpenPGP: 1357 B018 65B2 503C 1845 3D20 8CAC 2A96 7854 8E35

But I also recommend additionally creating a QR code with your OpenPGP key's fingerprint. To do so, we first remove all the whitespace from your fingerprint's value, which yields:

1357B01865B2503C18453D208CAC2A9678548E35

Then create the URI by prefixing OPENPGP4FPR: (which stands for OpenPGP v4 Fingerprint).

OPENPGP4FPR:1357B01865B2503C18453D208CAC2A9678548E35

Finally use qrencode to create the QR code. Here we use PNG as output format but qrencode is also able to create SVG, ASCII or UTF8 output.

qrencode -t PNG 'OPENPGP4FPR:1357B01865B2503C18453D208CAC2A9678548E35' \
    > myopenpgpfpr.png

Which results in:

My OpenPGP fingerprint as QRcode

Improve this answer
5
  • 4
    This is by far the best answer: the QR code is small enough to fit on a business card, OpenKeyChain imports the key instantly and suggests to confirm the key (which is the goal of the QR code: you have normally just met the person in real life).
    – Futal
    Commented Nov 27, 2018 at 13:20
  • @Futal, it is a decent answer, but not the best answer, because it does not allow for people who lack QR code readers.
    – sampablokuper
    Commented Jan 27, 2019 at 20:44
  • 2
    It is trivial to add the fingerprint as pure textual content. I've attempted to clarify the answer on that. Hope it helps.
    – Flow
    Commented Jan 27, 2019 at 21:55
  • Am I understanding correctly that this just encodes the fingerprint, and then the actual key is downloade by (e.g.) OpenKeyChain from the public keyservers? If so, this might be good to clarify that you also have to still upload your key to the keyservers for this to work.
    – Matthijs Kooijman
    Commented Aug 8, 2020 at 13:04
  • @MatthijsKooijman You are right that this is not the whole key, just its fingerprint. This is what the question explicitly asked about and people usually do not expect that your whole key is there (because your public key material is somewhat dynamic). It is also prominently mentioned in the first sentence of the answer.
    – Flow
    Commented Aug 10, 2020 at 13:23
15

I've put the whole fingerprint on my cards, but highlighted the short ID (being the last eight characters of the fingerprint). It's at the other's side to verify correctly.

Regarding putting a link on a business card; consider the possible use cases. The normal way of fetching a key is through the key server network; and for doing so no URL is needed: Either people (mail clients) search for your mail address (UID), which will already contained on your card anyway, or they fetch it by entering the fingerprint or ID - and hopefully verify against the whole fingerprint, or at least long ID.

Sadly there's nothing like a URI scheme for OpenPGP, something like hkp://[keyserver]/fingerprint would provide a way to have an actual link which can be designated to an OpenPGP client application, and at the same time point to an (optional) preferred key server.

Upcoming, but not yet widely spread: put your OpenPGP key (possibly after stripping images and incoming certifications) on a NFC token. I know some applications exist to read them (eg. OpenKeychain, though I don't know whether there's an (possible informal) standard behind.

Improve this answer
1
  • There are solutions for hosting/referring OpenPGP-keys with DNS, but the clients need to enable it. For three known ways of setting it up in DNS, I recommend reading do the client can retrieve the key based on the e-mailaddress.
    – hspaans
    Commented Oct 13, 2014 at 0:18
5

Put your whole key as qr-code on it, see near the end of this discussion, search for "monkeysign":

http://www.gossamer-threads.com/lists/gnupg/users/64465

Improve this answer
0
3

Two ways I can think of

  1. Submit your key to a public key server like pgp.mit.edu/. On your business card you can provide the link with the unique id that you are given. I don't know exactly how you should word it, but it is just an idea.

  2. You could put your key on a webpage and provide the link to that webpage. This might, of course, mean that you would need your own domain (unless you can find a way to put it on someone else's website ... like your Stack Exchange profile or something like that).

Improve this answer
2
  • I see that you can create a link directly to your key, with the following format: pgp.mit.edu/pks/lookup?op=get&search=0xB1234567890ABCDE. I could create a QR code for this URL and use that. I don't want to link to my website, as I can't guarantee uptime. This is a business card, but this is not for business, it's for personal use.
    – SPRBRN
    Commented Oct 13, 2014 at 12:59
  • 1
    @SPRBRN: I had thought about suggesting a QR code, but not all would be able to read it.
    – Thomas
    Commented Oct 13, 2014 at 14:10
1

You can put a link to your PGP and other information by simply linking to your website itself. What I do is actually have a link on my card that says: mysite.com/cv the cv page is a nice (enough) page that has my CV (resume) both online and pdf as well as a few other things. You can always update your CV & contact info there and there is the added bonus of statistics...

Alternatively, you can always use the QR code (either of the PGP key or a url to your PGP key).

Improve this answer
1

You can certainly use one of the publicly available keyservers; I would recommend the pool of SKS keyservers, since this will help distribute our load. A QR code can encode the link to your key, and it's easy to use an online generator.

Alternatively, keep your eye on a service such as keybase.io. A number of folks have invites now...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .