Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For example, if I have a friend's public key that's associated with, say, email address john@domain.com, but I want to send him a message at john@other.net, is there a sensible way to do this? Is there a way to permanently associate john@other.net with the original public key?

I realize I could manually encrypt from the command-line (via the original email handle) and subsequently email that content, but I'm looking for something 'usable' that would properly integrate with my email client and other standard GPG/PGP tools.

I also realize it's possible to add a secondary uid/email address to a key you own, but neither is that what I'm looking for.

share|improve this question
    
You should mention which client software you're using. Some clients could be able to do this. –  Jens Erat Apr 25 '13 at 16:50
    
At present I'm using Evolution, but I was hoping for a solution (like the one below) that is "agnostic". I did notice that the Thunderbird GPG plugin (Enigmail) has functionality for associating secondary addresses... But I'm not a big fan of that client. :) –  Chris W. Apr 26 '13 at 17:42
add comment

3 Answers

up vote 2 down vote accepted

You can add aliases to ~/.gnupg/gpg.conf by abusing "groups":

group john@other.net fingerprint-of-john@domain.com
share|improve this answer
    
@Ramhound: No. The names and addresses you give to GPG when creating an OpenPGP cert are only ever used as labels for that cert, and as hints for senders which cert to choose for which recipient. The owner can add multiple such labels to a single cert (I've seen people add their ICQ UINs instead of email addresses), and multiple cryptographic keypairs too (in fact, almost all certs have two keypairs: one for signing, one for encryption)... –  grawity Apr 25 '13 at 21:46
    
@Ramhound: ... Those have no relation other than being in the same cert, and they have no relation to the delivery method used. If I encrypt something with gpg -r grawity@gmail.com, there is absolutely nothing that would require me to actually send it by email to that address: it can be sent to a different address, sent over Usenet or XMPP or IRC or Twitter, pastebinned, or even printed and sent by post. Thus the group option only tells GnuPG which cert to use for a given -r. –  grawity Apr 25 '13 at 21:48
add comment

No, a key pair (public and private) can not be changed after they were created. If the keys are for john@domain.com then that's it.

The reason for that is that the owner of the e-mail address has to be authenticated before a key pair is issued. If you could change the address after, you could pretend to be someone else and that would make the whole process useless.

If you make your own key pair you can add more than one e-mail address, but such keys can not be authenticated by others (they have to trust you)

share|improve this answer
    
Be careful with putting trust in the e-mail-address. E-mail addresses tend to change over time and could be reoccupied; and not everybody is checking the e-mail addresses (and eg. directly uploading signatures to keyservers). –  Jens Erat Apr 25 '13 at 16:49
1  
The email addresses (UIDs) and the key pairs are stored separately in OpenPGP "keys", so the first sentence is not very correct. –  grawity Apr 25 '13 at 17:29
add comment

Actually, Simon is wrong. You can add new user IDs and revoke old ones on an existing key. Attempting to masquerade as others aside, it would achieve very little to prevent this type of modification since the worst that can happen is that someone receives an encrypted message that they cannot decrypt. At which point they would discover that someone is playing games.

However, if a key has been signed by a third party and then a second UID is added to the key, the previous signatures are not applied to the new UID. You can actually see evidence of this on my key (0x321E4E2373590E5D) because I added two UIDs to my current key earlier this year.

Grawity's recommendation of using group lines is the quick and easy way around the UID disparity issue, especially when the other party either doesn't know how to update their key or doesn't care.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.