11

There are many questions I have about GnuPG, but what stops me asking is knowing that I may add output to a question that I shouldn't release publicly.

  • Is it a risk to paste in the result of gpg -K?

  • What about gpg --edit my@email.address?

  • Are all fingerprint outputs ok to see?

  • Is there any other data I should exclude from questions?

I'm running gpg (GnuPG/MacGPG2) 2.0.27 with libgcrypt 1.6.3.

  • 2
    You don't need to be so apologetic, this is a good question! – Mike Ounsworth Sep 3 '15 at 15:26
  • 3
    such a good question, I'm editing out the justification :) – schroeder Sep 3 '15 at 16:22
4

Publising Information on Your Key

Hiding your private key is obvious, and you already noted that.

The only further thing not to publish (without intent to do so) is the revocation certificate you might have pregenerated (and GnuPG 2.1 is doing so by default for a good reason). With such a revocation certificate, others could revoke your key by uploading it to the key servers. Sharing with a trusted friend or family member on the other hand might be a good thing to do: they could still revoke your key in case anything happens to you (consider it a kind of digital last will).

Other things are hardly a problem. If you publish your public key (or fingerprint, mail address, user ID: all of those could be used to retrieve your key from a key server, given it is uploaded; and if you use your key, expect it to get uploaded by anybody by mistake or intent). This might allow to connect your Stack Exchange account with your real identity (which on the other hand does not seem to be a problem to you, looking at your profile).

From all further information like key IDs, fingerprints, user IDs, ... neither your private key nor revocation certificate can be calculated. Key IDs are the lower parts of the fingerprint, which again is calculated from the creation time of your key and public key.

Publishing Information Created Using Your Key

If you do not want to reveal your identity, be aware when publishing encrypted and/or signed data for/from your key, even if your strip parts of the ASCII-armored or binary output; or publish parts from your public key. It includes the whole key fingerprint, and does so in the very first parts. If you have something like

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1

owEBOgLF/ZANAwACAY545E37G1XpAcsKYgBV6J49Zm9vCokCHAQAAQIABgUCVeie
PQAKCRCOeORN+xtV6fZxD/oCEDFuXBwdF07UDZOh0v2x7CX7UmruCRs2MwcmZoHV
Uiiag9ibc3951pxCdNfDdB6rKKYc4fqqkMOTFqdi9DXBs6u7r8oiuuDTpqSJxyaM
lgUTiE/8oiF2/JtLgrFTVr5Kq7tgSs5WJ++zW0bPBNQHZoQ58fQsuAc0cn408m1j
[snipped some lines for assumed privacy]
iJiQoufmmGZdXFhFKW3hVxabEvfCxHqfvdMDhYh257r69AXTwsLsvXTJ6XXms9xy
LQ==
=pNoP
-----END PGP MESSAGE-----

an attacker will still be able to parse the packets manually (although neither gpg --list-packets nor pgpdump will help at analyzing such broken information without modifying their code), and you need some understanding of RFC 4880 (and a hex editor).

3

It depends what you're comfortable with. Personally I don't make much of an effort to hide my identity online. Since I use my real name for all my accounts, and I've uploaded my gpg keys to the public key servers, my keys aren't hard to find, here they are.

Clicking through your profile, it took me about 10 seconds to find your email address, and then your public keys which you uploaded to the key servers. This is you, right?

For both of us, any information that's that easy to find isn't really worth hiding, is it? You definitely need to at least read what you post to make sure you're comfortable making it public, but as long as you don't publish your private key, it really just comes down to what you're comfortable with.

If there is information that you want to protect you can always redact parts of the key with standard and obvious placeholders:

uid Random User <username@example.com>
sig  sig3  AAAAAAA 1970-01-01 __________ 2100-01-01

and just leave the parts that are relevant to the question.

  • 1
    Thanks Mike, that's good to know, and yes, that is me. I haven't hidden myself too well, I expect the Feds will be banging my door down at any mome… <muffled shouting and scuffles> That's not me, he just looks like me… I DIDN'T DO IT! (o_O) – Iain Sep 3 '15 at 17:30
  • I guess the answer should address connections of general advise (don't publish your private key) with more specific action, for example, whether or not commands like gpg -K reveal anything about said key. – Cthulhu Sep 4 '15 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.