Public Key Confusion
I am a very confused over my PGP public key(s). I have signed my public key and this is shown in a verbose listing of my public keyring. The same date appears in my public keyring for my public key as in my secret keyring for my secret key. The .asc file for my public key has the same file date (per a file-manager program). SOURCE OF CONFUSION: when I extract my public key from my public keyring and insert the extracted public key into a message, the public key that is inserted is bigger than and different from the public key in the .asc file. Am I correct to assume that the .asc version is a good public key but *unsigned*, and that the larger public key extracted from my public keyring is the same public key but has the additional component of my signature built into the body of, or seemlessly incorporated into, or otherwise coupled with, my public key? People to whom I have sent the smaller .asc version of my public key have sent me messages encrypted with that key, and I have been able to decrypt them with no apparent problem. My confusion arose when someone suggested that I sign my own public key, I clearsigned it (I know, duh!), and PGP and a public key server could not find a key block in the clearsigned message because the clearsigning put "- " at the start of both PGP block delimiters. Should I just stop distributing the .asc version and only let people have the longer version extracted from my public keyring? Is that the properly signed copy? Tampering can be ruled out as a practical matter. -- Best Regards, Jim
When you want to sign a key, you should use "pgp -ks". You should never clearsign a public key -- it buys you absolutely nothing other than saying that "I saw this key at some point, and this message (which is a public key block) came from me". Have you signed your own key using "pgp -ks"? Have you extracted your key (using "pgp -kxa") since you signed it? Or did you only extract it before you signed it? This would be the cause of the confusion. If you sign a key, the signature gets attached to the key certificate. However you do not need that signature in order to _use_ the key. So, people to whom you gave your key without a signature can still use that key, it just doesn't have your signature on it. As for the keyserver, it _ONLY_ accepts keys; if you clearsign your key before you send it, then you are not sending a key, you are sending a message that contains a key. This is not the same thing. That is why the keyserver rejected it.
Should I just stop distributing the .asc version and only let people have the longer version extracted from my public keyring? Is that the properly signed copy?
If you performed the pgp -ks, then you should re-perform the pgp -kxa and distribute the newly extracted key. I hope this answers all your questions. All of this, and more, should be explained in the PGP Documentation which is included with PGP. Good Luck. -derek
participants (2)
-
Derek Atkins -
jfmesq@ibm.net