# Is it possible to verify a clearsigned message with a short public key (fingerprints)?

For practical reasons, I'd like people to be able to post clearsigned messages with their public key fingerprints (8E570D9F7F70256595769E49F9BC5BCAD7E18635) for the system to check. However, the libraries I see all seem to require a full public key certificate to do verification. Is there a way to do it with just fingerprints?

• Not really, but you can use the xkcd method May 24 '20 at 1:13

No, it isn't possible to use a fingerprint as a key to verify signatures.

The PGP fingerprint is a hash of the public key material, see RFC 4880 section 12.2; it doesn't actually contain the public key, and as such it is not correct to speak of a fingerprint as a “short public key” as you did in your question—it is more like a unique key identifier.

A hash function maps an arbitrary-length input to a fixed-length output. One of the requirements for a cryptographic hash function is preimage resistance, i.e. given an output hash, it is difficult to find the input value to the hash. In this case, the input value to the hash would be the public key that was put into the hash. More to the point, the hash function that is used to generate the fingerprint effectively “loses” the public key information that you need to verify signatures.

Considering the size of the public key data, just trying potential public keys by brute force until you re-create a fingerprint to re-discover the public key information at runtime will also not work because it is too computationally expensive.

You can look it up in a keyserver - that would be secure, as long as you have a sufficiently long fingerprint.

• What in your opinion is a "sufficiently large" fingerprint and how would you select a fingerprint of that size using PGP? May 23 '20 at 13:56
• @MaartenBodewes: I suspect Anon might be including the 32-bit and 64-bit key IDs within the term "fingerprint" (as they're made by truncating the PGP fingerprint, and people indeed use them to look up keys). Jun 6 '20 at 6:45
• That seems reasonable. However, I would have hoped that this would be included in the answer because answers that require guesswork are not good answers. I also believe that there is a bit of an issue with PGP key servers at the moment. As it stands, I think that the answer is incomplete. Jun 6 '20 at 9:16