Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can a PGP-Key without an e-mail address be an advantage?

Reasons, why this might be a good idea: - Avoid SPAM on the address - i am using many different E-Mail addresses, too many to add them all as identities. - Avoiding metadata, not everyone needs to know, with which addresses i want to use the key.

Possible disadvantages: - the key is harder to find, because it cannot be found automatically by mailclients. - maybe some softwares not expecting, that the key has no e-mail address? - any problems with usage? - are people reluctant to sign keys without e-mail addresses?

Are there other disadvantages? I did try to google if there were other people with this idea, or some existing keys without e-mail address, but its hard to find the right keywords / search for keys with an absent e-mail address.

share|improve this question

closed as primarily opinion-based by Mokubai, Tog, Breakthrough, Darth Android, Dave M Aug 8 '13 at 12:51

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

How much spam does it actually avoid? –  grawity Aug 3 '13 at 18:59

1 Answer 1

up vote 2 down vote accepted

Adding mail addresses in UIDs does not only help finding matching keys (key lookups using mail addresses are more reliable as names tend to be used in variations (umlauts, abbreviations, middle names, ...).

Disadvantages I see in not adding mail addresses:

  • Most well-connected people use tools like caff to sign keys and send those. Having keys which are not "linked" to a mail address breaks their use, and I guess quite a bunch of people will not perform the extra effort of manually sending out/uploading the keys.
  • Key lookup will be more difficult and less reliable or completely fail.
  • Users sending encrypted mail will have to select your key to encrypt to manually, assumed that's supported by their mail client.
  • Chance of warnings if you're signing mail.
  • Giving your mail address with a key, you're indicating that you're ready to receive encrypted mail with that address.
  • You will not be able to get your key signed by cacert.org if you want to or upload it to PGP's key servers; they're doing some authorization using email.
  • RFC 4880 defines including an e-mail address as convention (but does not enforce it).

Regarding your concerns for not using mail addresses in your UIDs:

  • Avoid SPAM on the address

Could be an issue of course, but -- at least for me -- seems not to be. Since about two years I'm including two mail addresses not used otherwise, but they're posted on lots of key servers. I never received a single spam message on those to addresses (disclaimer: which got through blacklist filters and graylisting).

  • I am using many different E-Mail addresses, too many to add them all as identities.

I do not know of a technical limit on the number of UIDs. And anyway; why not stick to the ones reasonable for receiving mail with, or only include the most important ones. No one stops you from using your key for sending encrypted mail with another mail address not included in the UIDs.

  • Avoiding metadata, not everyone needs to know, with which addresses I want to use the key.

If people don't know you will be using OpenPGP, they will probably not use it. If you want to separate different kinds of identities (for example, private and work), think about using multiple keys instead.

share|improve this answer
so your disadvantages seem to boild down to "some clients may have problems". The selection of key problem is there, but i think many clients have options to associate the Key with a Contact (i.e. enigmail has a nice option). CACert is a real issue, but on the other hand its only one of many possible signers, and they seem to see it as publicly confirming the e-mail address. On the other hand, i see that "indicating you're ready to receive encrypted e-mail" is a good argument. At the moment, i do have a key with e-mail address, and it gets a lot of spam in the spam-folder. –  allo Aug 4 '13 at 17:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.