Linked Questions

41 votes
6 answers

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
golja's user avatar
  • 513
27 votes
2 answers

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
Mert Nuhoglu's user avatar
11 votes
2 answers

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers ( What does the term collision refer to?
user2449761's user avatar
5 votes
2 answers

Verifying a downloaded file with gpg

I'm trying to follow the instructions to verify a downloaded file here: Get a local copy of the signing key You will ...
7stud's user avatar
  • 151
3 votes
2 answers

Will the OpenPGP key fingerprint change if the certificate is extended?

Should the fingerprint of a renewed (extended) OpenPGP Key be the same? Is there any documentation on it (RFC)? Quoting from RFC 4880: There are many ways possible for two keys to have the same key ...
cyzczy's user avatar
  • 1,558
0 votes
1 answer

What's the minimal way of sharing your public PGP key in email signature?

What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
Samuel Shifterovich's user avatar
3 votes
2 answers

Exact meaning of RSA key in `gpg --verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following: gpg: Signature made Fr 07 Jan 2022 13:42:21 CET gpg: using RSA key ...
Maximilian Keßler's user avatar
1 vote
1 answer

What to share (OpenPGP key ID or fingerprint) once key uploaded on key server?

I have uploaded my public key on: When sending mails, I want to notify the recipients about my public key just in case they want to use it. Since the key is on key server,...
RPK's user avatar
  • 195
1 vote
1 answer

Verify GnuPG download with signature file - and it fails

I'm trying to verify the new GnuPG download (for OS X) using GnuPG. (First of all I'm not sure if you should verify a file with the old version of it, which I probably didn't verify back then to be ...
SPRBRN's user avatar
  • 7,519
3 votes
1 answer

Combating Networks of Forged OpenPGP Keys on Public Keyservers

I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
afourney's user avatar
  • 419
3 votes
1 answer

Are expired keys eligible default keys?

From GnuPG's man page: [...] the default key is the first key found in the secret keyring. Are expired keys eligible default keys? Or should I manually set the default key in gpg.conf? I'm asking ...
Antoine's user avatar
  • 669
0 votes
1 answer

What are the Consequences of OpenPGP Key Collisions?

In this answer to GPG keys & SHA-1, there's the sentence: However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
Ohnana's user avatar
  • 4,727
2 votes
1 answer

How do we 'initiate' mail exchange with PGP

I am totally new with PGP, and I would like to know how I can initiate a mail exchange with it. I created my public/private keys, and posted my private key on the MIT PGP Public Key Server. I can ...
Miky98's user avatar
  • 23
0 votes
1 answer

Receiving mails with strange PGP Key ID

I have received encrypted emails which I can not decrypt because the key used for encryption seems not to be correct. Usually I have a key ID with 8 hex characters. This key can be found on public ...
radix's user avatar
  • 123