1
$\begingroup$

For practical reasons, I'd like people to be able to post clearsigned messages with their public key fingerprints (8E570D9F7F70256595769E49F9BC5BCAD7E18635) for the system to check. However, the libraries I see all seem to require a full public key certificate to do verification. Is there a way to do it with just fingerprints?

$\endgroup$
1
2
$\begingroup$

No, it isn't possible to use a fingerprint as a key to verify signatures.

The PGP fingerprint is a hash of the public key material, see RFC 4880 section 12.2; it doesn't actually contain the public key, and as such it is not correct to speak of a fingerprint as a “short public key” as you did in your question—it is more like a unique key identifier.

A hash function maps an arbitrary-length input to a fixed-length output. One of the requirements for a cryptographic hash function is preimage resistance, i.e. given an output hash, it is difficult to find the input value to the hash. In this case, the input value to the hash would be the public key that was put into the hash. More to the point, the hash function that is used to generate the fingerprint effectively “loses” the public key information that you need to verify signatures.

Considering the size of the public key data, just trying potential public keys by brute force until you re-create a fingerprint to re-discover the public key information at runtime will also not work because it is too computationally expensive.

$\endgroup$
-1
$\begingroup$

You can look it up in a keyserver - that would be secure, as long as you have a sufficiently long fingerprint.

$\endgroup$
3
  • 1
    $\begingroup$ What in your opinion is a "sufficiently large" fingerprint and how would you select a fingerprint of that size using PGP? $\endgroup$
    – Maarten Bodewes
    May 23 '20 at 13:56
  • $\begingroup$ @MaartenBodewes: I suspect Anon might be including the 32-bit and 64-bit key IDs within the term "fingerprint" (as they're made by truncating the PGP fingerprint, and people indeed use them to look up keys). $\endgroup$
    – user1686
    Jun 6 '20 at 6:45
  • $\begingroup$ That seems reasonable. However, I would have hoped that this would be included in the answer because answers that require guesswork are not good answers. I also believe that there is a bit of an issue with PGP key servers at the moment. As it stands, I think that the answer is incomplete. $\endgroup$
    – Maarten Bodewes
    Jun 6 '20 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.