31

I understand the utility of the key block itself, and of a hash of the key, but I don't know why additional information would be necessary, so I can't begin to guess the utility of an additional bit of information.

Specifically,

  • What does it signify,
  • where is it used, and
  • (how) can it be determined given the public key block?

It tends to be mentioned tangentially and in passing, which leads to confusion since clearly spacewalk recognizes a difference between fingerprint and ID, while some GPG documentation put out by Fedora includes the phrase

For KEYNAME, substitute the key ID or fingerprint of your primary keypair,

which makes it seem as if the two share the same purpose; but that doesn't make sense because if that were the case why would you need both to begin with?

6
  • The gpg utility lets you specify either as a convenience to you. If you specify a fingerprint it will look up the fingerprint and if you specify the ID it will look for an ID that equals or contains the string you specify. The ID is often a human-readable identifier for the key. The fingerprint in general is described at en.wikipedia.org/wiki/Public_key_fingerprint. What is the problem you are actually having?
    – Jason C
    Jun 16, 2014 at 14:41
  • @JasonC Spacewalk wants an ID as well as a fingerprint and URL for the key block, but repos (e.g. EPEL) only provide the key block. Now, I know I can get the fingerprint just by taking a hash of the key block, but I don't know whether I'm supposed to get the ID from somewhere else, decide on one and load it into a database before I tell spacewalk about it, or just make one up for spacewalk. Basically, it's a spacewalk problem that gets a lot easier once I know more about how GPG IDs are used. Jun 16, 2014 at 14:50
  • @JasonC More succinctly: I'll be downloading signed RPMs, and all I have is the key block, so I need to know whether I decide on an ID or the issuer decides on an ID. Jun 16, 2014 at 14:57
  • Did you follow the EPEL/Spacewalk installation instructions from fedorahosted.org/spacewalk/wiki/HowToInstall#EPELrepository or wiki.centos.org/HowTos/PackageManagement/… and is Spacewalk actually failing to manage packages from EPEL? Is access.redhat.com/site/solutions/308983 relevant?
    – Jason C
    Jun 16, 2014 at 15:04
  • 1
    If it works without you filling it in, then it knows how to manage without you specifying, and filling it in is not helpful. However, check out web.archive.org/web/20130821232554/http://centosforge.com/node/… which tells you how to obtain a fingerprint and ID for Spacewalk. Similar instructions at darkoperator.com/blog/2011/12/16/…. More info at google.com/search?q=spacewalk%20package%20key%20id
    – Jason C
    Jun 16, 2014 at 15:22

1 Answer 1

39

From RFC 4880:

A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field. The Key ID is the low-order 64 bits of the fingerprint.

For V3 keys, calculation is similar, but the key length is omitted.

In other words, the fingerprint is calculated from a constant, the packet length and finally a part of the public key packet. Further explanation on what's included (and thus how to calculate it) in the linked RFC.

The (long) key id is represented by the lowest 64 bits, and is used as the full fingerprint is an unhandy and long value. Even more often, the short key id formed by the lowest-order 32 bits is used. These short key IDs are often considered to have a too high chance of collisions and usage of at least the long ID, if not even full fingerprint is recommended.

Recapped in a few words:

The fingerprint is the hash value calculated from the public key packet. The key IDs are a part of the fingerprint:

Fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279
Long key ID:                                4E1F 799A A4FF 2279
Short key ID:                                         A4FF 2279

Sometimes, the IDs get prefixed by 0x as they're hex values.

3
  • 1
    Very useful link to the information on collisions, thanks. You might want to change the answer to say that even long keys are forgeable and therefore not recommended.
    – zkilnbqi
    Apr 3, 2015 at 7:34
  • 1
    While short key IDs are forged very easily, long key IDs are 2^32 times harder to collide and still considered appropriate. Even fingerprints can be forged, they're just even even harder to forge (due to the vast number of possible fingerprints).
    – Jens Erat
    Apr 3, 2015 at 9:29
  • 1
    I was convinced by the link you included in your answer. Now my signature says "[email protected] pgp.mit.edu ID as of 2015-03-22" Makes much more sense. If someone wants to send you an encrypted message or verify that you have signed one, they are going to have to find your public key on the keyserver anyway, so there is no advantage in using the key ID.
    – zkilnbqi
    Apr 4, 2015 at 4:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .