Basic question on GPG Key

Discussion in 'privacy technology' started by dogbite, Jul 3, 2014.

Thread Status:
Not open for further replies.
  1. dogbite

    dogbite Registered Member

    Joined:
    Dec 13, 2012
    Posts:
    1,290
    Location:
    EU
    I saw mirimir's signature, I was wondering why also the Fingerprint is written.
    Should not be the Key ID enough for getting the Public Key from a directory?

    Thanks
     
    dogbite, Jul 3, 2014
    #1
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Yes, the Key ID is enough to find and download the key. But, the fingerprint let's you confirm that the key you get is legitimate.

    When you have gpg display the fingerprint of the key you got from the server, it must match what's shown in mirimir's signature to be valid.
     
    LowWaterMark, Jul 3, 2014
    #2
  3. mirimir

    mirimir Registered Member

    Joined:
    Oct 1, 2011
    Posts:
    9,252
    The Key ID can be spoofed, but not (as far as I know) the full fingerprint.

    By "spoofed", I mean that another key can be generated having the same Key ID. Just keep generating new keys until you find one that matches.
     
    mirimir, Jul 3, 2014
    #3
  4. dogbite

    dogbite Registered Member

    Joined:
    Dec 13, 2012
    Posts:
    1,290
    Location:
    EU
    Thanks. It's that realistic? I mean, generating a huge amount of keys until you get that specific ID?
     
    dogbite, Jul 4, 2014
    #4
  5. Creer

    Creer Registered Member

    Joined:
    Jun 29, 2008
    Posts:
    1,345
    Creer, Jul 4, 2014
    #5
  6. dogbite

    dogbite Registered Member

    Joined:
    Dec 13, 2012
    Posts:
    1,290
    Location:
    EU
    Interesting. But how to generate a longer (64-bit or more) key ID?
    In my case I generated my Keys with Mailvelope and they are pretty 32-bit standard ones.
     
    dogbite, Jul 4, 2014
    #6
  7. mirimir

    mirimir Registered Member

    Joined:
    Oct 1, 2011
    Posts:
    9,252
    The Key ID just by definition comprises the last eight characters of the Fingerprint. The only way to fix the problem would be to change the definition of Key ID, perhaps including more of the Fingerprint. But that would probably break stuff.
     
    mirimir, Jul 4, 2014
    #7
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...