Is it possible to get the public key from PGP message in PEM(Base64) format? Here is the message:



I sent this to someone and I was just wondering what if someone other than us knows the PGP message and wants information like the recipient's pubkey or other info.

  • $\begingroup$ What constitutes "knowing the recipients pubkey"? PGP will include a key fingerprint. It does not include the entirety of the person's public key, so their key cannot be derived directly from it, but public keys are intended to be just that, publicly known. If an attacker has intercepted the public key as it is being transmitted to you (which it is assumed they can, as it is public), they will be able to match the public key to the message you send from the fingerprint. It does not directly include the full pubkey, but it has identifying information which could easily reveal the pubkey. $\endgroup$ – arcaynia Jul 14 '20 at 16:30
  • 1
    $\begingroup$ Almost dupe security.stackexchange.com/questions/199427/… where it is considered ontopic, and more linked there; several previous Qs here have been closed as offtopic, and at least one I know I answered deleted. $\endgroup$ – dave_thompson_085 Jul 15 '20 at 3:29

No, the PGP format doesn't contain the public key of the sender. But it does include a key ID of the key (pair) so that you know which private key to use to decrypt the message. It is rather easy to verify this by reading the OpenPGP specifications which defines the packet format(s) used. Or you can take a look using gpg --list-packets --verbose.

It is possible to lookup the public key (which in the case of PGP acts more like a certificate, containing more information than just the key value) using one of the various PGP servers. However, the use of these servers has become a problem in itself. Knowing the key ID is of little help if the key is not registered in a known key server or location (i.e. communicated out of band or kept locally).

  • $\begingroup$ Um, currently still on different computer, you'll have to try the command yourself. $\endgroup$ – Maarten Bodewes Jul 14 '20 at 20:31
  • $\begingroup$ Once someone has the fingerprint, they can search for the public key on a public key server such as this one: pgp.mit.edu If the public key had been uploaded by anyone, other information will also be shown; namely, what the creator of the key gave as name and e-mail address. $\endgroup$ – Patriot Jul 15 '20 at 1:58
  • 1
    $\begingroup$ The long (64-bit) keyid, not the full fingerprint. But that is enough to check keyserver(s). For the message posted, pubkey enc packet: version 3, algo 1, keyid 55B6E24604AE28A9 which one of my configs finds as the encryption subkey for pgp.EncryptedChat <a1mtarabichi@gmail.com> $\endgroup$ – dave_thompson_085 Jul 15 '20 at 3:33
  • 1
    $\begingroup$ That's of course only a problem (or feature, whichever way you look at it) if the public key is stored on a server in the first place (something that has become under attack lately). I usually processed keys using out-of-band procedures. $\endgroup$ – Maarten Bodewes Jul 15 '20 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.