NODE 73c3f481Public Key Confusion
jfmesq@ibm.net (James F. Marshall)Mon, 31 Jul 95 16:39:18 PDT
I am a very confused over my PGP public key(s). I have signed my
public key and this is shown in a verbose listing of my public
keyring. The same date appears in my public keyring for my public key
as in my secret keyring for my secret key. The .asc file for my
public key has the same file date (per a file-manager program).
SOURCE OF CONFUSION: when I extract my public key from my public
keyring and insert the extracted public key into a message, the public
key that is inserted is bigger than and different from the public key
in the .asc file.
Am I correct to assume that the .asc version is a good public key but
*unsigned*, and that the larger public key extracted from my public
keyring is the same public key but has the additional component of my
signature built into the body of, or seemlessly incorporated into, or
otherwise coupled with, my public key?
People to whom I have sent the smaller .asc version of my public key
have sent me messages encrypted with that key, and I have been able to
decrypt them with no apparent problem. My confusion arose when
someone suggested that I sign my own public key, I clearsigned it (I
know, duh!), and PGP and a public key server could not find a key
block in the clearsigned message because the clearsigning put "- " at
the start of both PGP block delimiters.
Should I just stop distributing the .asc version and only let people
have the longer version extracted from my public keyring? Is that the
properly signed copy?
Tampering can be ruled out as a practical matter.
-- Best Regards, Jim
NODE b1fcf606Re: Public Key Confusion
Derek Atkins <warlord@MIT.EDU>Mon, 31 Jul 95 16:54:53 PDT
When you want to sign a key, you should use "pgp -ks". You should
never clearsign a public key -- it buys you absolutely nothing other
than saying that "I saw this key at some point, and this message
(which is a public key block) came from me".
Have you signed your own key using "pgp -ks"? Have you extracted your
key (using "pgp -kxa") since you signed it? Or did you only extract
it before you signed it? This would be the cause of the confusion.
If you sign a key, the signature gets attached to the key certificate.
However you do not need that signature in order to _use_ the key. So,
people to whom you gave your key without a signature can still use
that key, it just doesn't have your signature on it.
As for the keyserver, it _ONLY_ accepts keys; if you clearsign your
key before you send it, then you are not sending a key, you are
sending a message that contains a key. This is not the same thing.
That is why the keyserver rejected it.
> Should I just stop distributing the .asc version and only let people
> have the longer version extracted from my public keyring? Is that the
> properly signed copy?
If you performed the pgp -ks, then you should re-perform the pgp -kxa
and distribute the newly extracted key.
I hope this answers all your questions. All of this, and more, should
be explained in the PGP Documentation which is included with PGP.
Good Luck.
-derek