Linked Questions

16
votes
6answers
29k views

Extracting the PGP keyid from the public key file

Is there a way via an CLI tool or some kind of API to extract the PGP key ID from the PGP public key block? I found the hexa value of the key in the binary file, but I guess the position is based on ...
14
votes
2answers
17k views

GnuPG asks for a key ID when sharing my public key, what is that?

I generated a public key using GnuPG. I can see it using --list-keys $ gpg --list-keys /Users/mertnuhoglu/.gnupg/pubring.gpg ------------------------------------- pub 4096R/CB3AF6E6 2015-12-24 [...
9
votes
2answers
4k views

What is an OpenPGP Key ID collision?

Recently an Evil32 project group announced that they have found collisions for all OpenPGP keys from public keyservers (https://evil32.com/). What does the term collision refer to?
5
votes
2answers
4k views

Verifying a downloaded file with gpg

I'm trying to follow the instructions to verify a downloaded file here: http://www.pps.univ-paris-diderot.fr/~jch/software/pgp-validating.html Get a local copy of the signing key You will ...
3
votes
2answers
503 views

Will the OpenPGP key fingerprint change if the certificate is extended?

Should the fingerprint of a renewed (extended) OpenPGP Key be the same? Is there any documentation on it (RFC)? Quoting from RFC 4880: There are many ways possible for two keys to have the same ...
1
vote
1answer
652 views

What's the minimal way of sharing your public PGP key in email signature?

What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?
1
vote
1answer
588 views

Verify GnuPG download with signature file - and it fails

I'm trying to verify the new GnuPG download (for OS X) using GnuPG. (First of all I'm not sure if you should verify a file with the old version of it, which I probably didn't verify back then to be ...
1
vote
1answer
279 views

What to share (OpenPGP key ID or fingerprint) once key uploaded on key server?

I have uploaded my public key on: https://sks-keyservers.net/ When sending mails, I want to notify the recipients about my public key just in case they want to use it. Since the key is on key server,...
3
votes
1answer
181 views

Combating Networks of Forged OpenPGP Keys on Public Keyservers

I recently noticed that someone has created an elaborate forgery of my OpenPGP key. Specifically, they orchestrated a short key (32-bit) fingerprint collision, and also forged additional keys to match ...
2
votes
1answer
142 views

Are expired keys eligible default keys?

From GnuPG's man page: [...] the default key is the first key found in the secret keyring. Are expired keys eligible default keys? Or should I manually set the default key in gpg.conf? I'm asking ...
0
votes
1answer
128 views

Receiving mails with strange PGP Key ID

I have received encrypted emails which I can not decrypt because the key used for encryption seems not to be correct. Usually I have a key ID with 8 hex characters. This key can be found on public ...
0
votes
1answer
53 views

What are the Consequences of OpenPGP Key Collisions?

In this answer to GPG keys & SHA-1, there's the sentence: However, since PGP keys are usually generated by their users, collision attacks are not a problem. They might conceivably be a problem ...
2
votes
1answer
82 views

How do we 'initiate' mail exchange with PGP

I am totally new with PGP, and I would like to know how I can initiate a mail exchange with it. I created my public/private keys, and posted my private key on the MIT PGP Public Key Server. I can ...