4

If I run the following on a private key to install it in my keyserver:

gpg --allow-secret-key-import --import my_private.key

It will import an associated public key presumably from a keyserver?

gpg: key xyz...: public key "[email protected]" imported

My question is: How can I find out the ID of this public key without having to install the private key to my keychain?

1
  • 1
    That imports to your keyring and/or agent, depending on gpg version; no keyserver is involved. PGP privatekey format includes the corresponding publickey and the displayed publickey info is obtained from the privatekey; no keyserver is involved. The answer how to display a privatekey is the same as your previous Q about displaying a publickey Sep 26, 2017 at 2:03

4 Answers 4

5

Given the following public key in Privacy Enhanced Mail (Base64 encoded DER) format:

$ wget https://apt.dockerproject.org/gpg -O dockerproject.gpg.pub.key
$ cat dockerproject.gpg.pub.key
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFWln24BEADrBl5p99uKh8+rpvqJ48u4eTtjeXAWbslJotmC/CakbNSqOb9o
ddfzRvGVeJVERt/Q/mlvEqgnyTQy+e6oEYN2Y2kqXceUhXagThnqCoxcEJ3+KM4R
mYdoe/BJ/J/6rHOjq7Omk24z2qB3RU1uAv57iY5VGw5p45uZB4C4pNNsBJXoCvPn
TGAs/7IrekFZDDgVraPx/hdiwopQ8NltSfZCyu/jPpWFK28TR8yfVlzYFwibj5WK
dHM7ZTqlA1tHIG+agyPf3Rae0jPMsHR6q+arXVwMccyOi+ULU0z8mHUJ3iEMIrpT
X+80KaN/ZjibfsBOCjcfiJSB/acn4nxQQgNZigna32velafhQivsNREFeJpzENiG
HOoyC6qVeOgKrRiKxzymj0FIMLru/iFF5pSWcBQB7PYlt8J0G80lAcPr6VCiN+4c
NKv03SdvA69dCOj79PuO9IIvQsJXsSq96HB+TeEmmL+xSdpGtGdCJHHM1fDeCqkZ
hT+RtBGQL2SEdWjxbF43oQopocT8cHvyX6Zaltn0svoGs+wX3Z/H6/8P5anog43U
65c0A+64Jj00rNDr8j31izhtQMRo892kGeQAaaxg4Pz6HnS7hRC+cOMHUU4HA7iM
zHrouAdYeTZeZEQOA7SxtCME9ZnGwe2grxPXh/U/80WJGkzLFNcTKdv+rwARAQAB
tDdEb2NrZXIgUmVsZWFzZSBUb29sIChyZWxlYXNlZG9ja2VyKSA8ZG9ja2VyQGRv
Y2tlci5jb20+iQI4BBMBAgAiBQJVpZ9uAhsvBgsJCAcDAgYVCAIJCgsEFgIDAQIe
AQIXgAAKCRD3YiFXLFJgnbRfEAC9Uai7Rv20QIDlDogRzd+Vebg4ahyoUdj0CH+n
Ak40RIoq6G26u1e+sdgjpCa8jF6vrx+smpgd1HeJdmpahUX0XN3X9f9qU9oj9A4I
1WDalRWJh+tP5WNv2ySy6AwcP9QnjuBMRTnTK27pk1sEMg9oJHK5p+ts8hlSC4Sl
uyMKH5NMVy9c+A9yqq9NF6M6d6/ehKfBFFLG9BX+XLBATvf1ZemGVHQusCQebTGv
0C0V9yqtdPdRWVIEhHxyNHATaVYOafTj/EF0lDxLl6zDT6trRV5n9F1VCEh4Aal8
L5MxVPcIZVO7NHT2EkQgn8CvWjV3oKl2GopZF8V4XdJRl90U/WDv/6cmfI08GkzD
YBHhS8ULWRFwGKobsSTyIvnbk4NtKdnTGyTJCQ8+6i52s+C54PiNgfj2ieNn6oOR
7d+bNCcG1CdOYY+ZXVOcsjl73UYvtJrO0Rl/NpYERkZ5d/tzw4jZ6FCXgggA/Zxc
jk6Y1ZvIm8Mt8wLRFH9Nww+FVsCtaCXJLP8DlJLASMD9rl5QS9Ku3u7ZNrr5HWXP
HXITX660jglyshch6CWeiUATqjIAzkEQom/kEnOrvJAtkypRJ59vYQOedZ1sFVEL
MXg2UCkD/FwojfnVtjzYaTCeGwFQeqzHmM241iuOmBYPeyTY5veF49aBJA1gEJOQ
TvBR8Q==
=Fm3p
-----END PGP PUBLIC KEY BLOCK-----

The following commands will all show the long key id without adding it to your keyring:

$ gpg --list-packets dockerproject.gpg.pub.key | \
awk '/keyid:/{ print $2 }'
F76221572C52609D
$ gpg --with-colons dockerproject.gpg.pub.key 2>&1 | \
awk -F':' '/pub/{ print $5 }'
F76221572C52609D
$ gpg --dry-run --verbose --import dockerproject.gpg.pub.key 2>&1 | \
awk '/pub/{ print $3 }' | awk -F'/' '{ print $2 }'
F76221572C52609D
$ gpg --with-fingerprint --verbose dockerproject.gpg.pub.key 2>&1 | \
awk '/^sig/{ print $2 }'
F76221572C52609D

When using this version of gpg:

$ gpg --version | head -n 1
gpg (GnuPG) 2.2.4

These commands are not very friendly or intuitive and spit out confusing messages like gpg: WARNING: no command supplied. Trying to guess what you mean ... on STDERR. They also seem to often be subtly different between versions, for example my version sometimes requires --verbose compared to some answers out there. This version does not have the --show-keys flag which looks easier than most of the commands above.

Some useful information about key ids:

  • Key ID Short Format: 2C52609D
  • Key ID Long Format: F76221572C52609D
  • Key Signature: 58118E89F3A912897C070ADBF76221572C52609D

You should use long format as the short format is insecure

1
  • This works with GPG 1.4.16, but it doesn't work with GPG 2.1.18.
    – pts
    Apr 30, 2020 at 10:45
4

To get the key IDs (8 bytes, 16 hex digits), this is the command which worked for me in GPG 1.4.16, 2.1.18 and 2.2.19:

gpg --list-packets <key.asc | awk '$1=="keyid:"{print$2}'

To get some more information (in addition to the key ID):

gpg --list-packets <key.asc

To get even more information:

gpg --list-packets -vvv --debug 0x2 <key.asc

The command

gpg --dry-run --import <key.asc

also works in all 3 versions, but in GPG 1.4.16 it prints only a short (4 bytes, 8 hex digits) key ID, so it's less secure to identify keys.

Commands in other answers (e.g. gpg --show-keys, gpg --with-fingerprint, gpg --import --import-options show-only) don't work in some of the 3 GPG versions above, thus they are not portable when targeting multiple versions of GPG.

1
  • Wow! Last post is the one that did it. Thanks!
    – Gaspa79
    Aug 12, 2021 at 10:37
4

Just call the gpg command line tool and pass it the keyfile as an option

$ gpg my_private.key
sec  4096R/1234ABCD 2017-09-12 [email protected]

The long version (without warning "gpg: WARNING: no command supplied. ..." - since gnupg-version >= 2.1.23 - found this here):

gpg --import-options show-only --import my_private.key
4
  • 3
    Annoyingly, it also prints gpg: WARNING: no command supplied. Trying to guess what you mean .... I would prefer knowing the actual command, both to remove ambiguity and the warning.
    – Hubro
    Jan 19, 2018 at 9:23
  • Interesting. I do not get the warning on my machine (Ubuntu Xenial). It also shouldn't be a problem according to the man page: gpg may be run with no commands, in which case it will perform a reasonable action depending on the type of file it is given as input (an encrypted message is decrypted, a signature is verified, a file containing keys is listed)
    – mat
    Jan 25, 2018 at 18:29
  • This works with GPG 1.4.16, but it doesn't work with GPG 2.1.18.
    – pts
    Apr 30, 2020 at 10:44
  • I found here (iditect.com/how-to/56283822.html) how to GET RID OF THE WARNING: "Since GnuPG 2.1.23, the gpg: WARNING: no command supplied. Trying to guess what you mean ... warning can be omitted by using the --import-options show-only option together with the --import command" so the 'simple' command to just get information about a file without an error would be: gpg --import-options show-only --import my_keyfile.key
    – MacMartin
    Oct 22, 2020 at 8:51
1

If you refer to a PGP key then this may be the answer.

From the gpg manual (gpg (GnuPG) 2.2.11):

--show-keys

This commands takes OpenPGP keys as input and prints information about them in the same way the command --list-keys does for locally stored key. In addition the list options show-unusable-uids, show-unusable-subkeys, show-notations and show-policy-urls are also enabled. As usual for automated processing, this command should be combined with the option --with-colons.

For instance:

$ gpg --show-keys docker-ce.gpg pub rsa4096 2017-02-22 [SCEA] 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 uid Docker Release (CE deb) <[email protected]> sub rsa4096 2017-02-22 [S]

where 9DC858229FC7DD38854AE2D88D81803C0EBFCD88 is the key id.

1
  • This doesn't work with GPG 1.4.16 or GPG 2.1.18.
    – pts
    Apr 30, 2020 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .