2
$\begingroup$

When people say "Here's my PGP key", they tend to come up with all sorts of different stuff.

Sometimes they provide an 8-digit hexadecimal number, which seems to be a key ID (although I'm not sure).

I've also seen cases where people provide a 16-digit hex number, or even a 40-digit number (printed as 10 fields of 4 hex digits).

I've also seen cases where people send a file, containing the usual stuff:

-----public key----- 
....
(whole lot of base64 encoded data)
....

I can deal with the latter, but I have no idea how to obtain the key from the other formats. How do I go about this?

$\endgroup$
3
$\begingroup$

Exchanging full RSA keys can be very inconvenient, as they consist of very long numbers. In the OpenPGP ASCII-armored version, my public key (without any user IDs and certifications!) already is very long stream:

mQQNBFDaK/sBIADm2gjnw7aPoNIoCy7gj85btwZU+zGkvtGonznlLrXELdU6zR3u
VHNCn9vAl6OoU32r+suFvGdX+7MjiPbGKwJFOvICpAVh6bV55+hdqJbS02cpPmJH
1BrrUAmm6ZVEybGd+II1pTI6Mt/SAI1E/59VIBdC/1AwsxQtCTFeyaLqTdyd1FhQ
chkjcvdRHLb4cEqldAGqBL7SbiSNOP3p+vX8iwRN6PQ/erAGseawHnunuNIna+tA
t4te/MkI2uxT0KjsfF/NWHCB2aXt++egP8jGSaHRsVOlfHRVA3hHcUDlnW9DZRvG
QabHFcZvfcXAlNIRYKUzDIHEwpavAmHeGNhc2GNmDcDRF56741grVLNQT58vxK5o
dBLlC8ANckvE5ymdIKVPm+t5q10kFOAATcnmDV0oBt+15vzI3f+88yCoY904UWdY
LwTbNMiszIB4ngNfzdLWeXPOCDs4CYa9BBKb1VkVtWn6NTE7m0/urrAP3Mb9qTwz
AlBVHvDPo6BG2yVqoCVzDBNOjb7czO3cns2M8sThizD2gvdKUV5Bq7THp6MFAzP0
Wbad3JLVIn65BNzVKJYhC7rGAU2QjlRbXq+P08NsewNbFC/E3fct249PM5xVl4lW
vcsqBo1o+iuHuzb7tvveht1N79n3V+pPISLj8QCb9rEI09MJ93IQbn5yuyPCgXe6
/OiNyiv3QxY/x3zImLiiuSurbw1E0ILyX/qm+36XVSpewduXk2yen8x+eMmLWRfS
ZhyPXHFbO8am7niF1AuZjnIfhETsiyqAGmYmb9d7nL6GwCrvA7QCHrRl/EDd4r2a
Un2q6QYXQ78Wj6Ys1/jH49GkFUhBKl0PfLKtKPiPwL71wb6sD6nA30Ix6hMGreZk
B1697KPVLCP4v87xyrMJFNgXC2FBKML3PlokOyrZzbXLRM78yHmoBl13Tu3UZkFK
O1TV7cFzQScHMd+yBGN/AmVUF8Br2bExtuIvQqoQbj6gPIEk5xGWvGzSbR9LcAng
VRUHDlOy3dUd8QuhJANPk6knHZR0OT0C5c2Wzvcznr5ros5PQ8XZFCOJTaNLfc7u
9TGe/FVG3d7RMyB/9ILhS5ef3VarGzuyiYwwsC3P+w/3lHt+PhzVQRfeq0WrB+RK
3bfweIm30k1g8xJuQ0mg2JmmICYL/uihWVREZNOZZPboFBV8dZec+hif1tfuqchV
qVsy3cMuhg/K/EJafVbA3o59Z9IYIC3XN7NGoYYXuzbLgaDtVxGdcWTg8D4a1FaD
cEkeAR/Mm9FxVDK01itXatol/ZB0oBCrYS0DLdYQ/YWrAfoqR7Av7uY+hQiwvIo3
+lVlQGsr7rlhv/oNrf2P2M5aKPOdp2vPIEqpABEBAAE=
=pzM1

For this reason, the public key gets hashed into the key's fingerprint. From RFC 4880, 12.2 Key IDs and Fingerprints:

A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field. The Key ID is the low-order 64 bits of the fingerprint.

Long and short key IDs are the last 16 respectively 8 digits. Again with my own public key as an example:

fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279
long id:                                    4E1F 799A A4FF 2279
short id:                                             A4FF 2279

As the fingerprint and key IDs are derived from the public key through hashing, you cannot "convert them back" to the public key. So while they cannot be used immediately for cryptographic operations and must query a key server using them as search token, you can exchange them more easily, for example on business cards. Be aware that short key IDs are insecure and should not be used.

$\endgroup$
  • $\begingroup$ Thanks, very clear! So only the long base64 encoded bulk is the actual public key (well, that'd be the ascii armored version, I assume they can be exchanged in binary form as well). The rest (fingerprint and long and short ids) is just checksums, and can only be used to verify a public key but not to actually encrypt anything. Much appreciated! $\endgroup$ – RocketNuts Jun 2 '16 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.