I am a new user of GnuPG. I am very much familiar with concept of public and private keys, as well as Web of Trust after reading The GNU Privacy Handbook and a couple of blogs. Still, I don't how I should proceed if I have just started with an empty keyring and trustdb, and need to check new files downloaded from internet.

For instance, I would like to compile Emacs from sources. I downloaded two files from its website Gnu Emacs: emacs-25.3.tar.gz.sig and emacs-25.3.tar.gz. I checked signature and have got this output:

gpg: Signature made Mon 11 Sep 2017 20:52:45 BST
gpg:                using RSA key 28D3BED851FDF3AB57FEF93C233587A47C207910
gpg: Can't check signature: No public key

For some reason, I cannot retrieve the key "7C207910" as gpg states:

[fw@localhost~ ]$ gpg --recv-keys 7C207910
gpg: Note: signatures using the SHA1 algorithm are rejected
gpg: key 0x233587A47C207910: 19 signatures not checked due to missing keys
gpg: key 0x233587A47C207910: 10 bad signatures
gpg: key 0x233587A47C207910: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

After verification, it looks to me that the key belons to Nicolas Petton, whose key ID ends with 7C207910. I guess if I received the key from keyserver, I would know its fingerprint. If both fingerprints matched, on the website and in my newly received key, would that be enough to confirm the key belogs to Nicolas Petton? Would it be enough information to confirm the key and set its trust to full?

What is your routine?



You or your distribution have added the option weak-digest SHA1 to the GnuPG config (~/.gnupg/gpg.conf), causing it to reject signatures made with SHA-1 as "weak". (By default only MD5 is rejected. SHA-1 is still acceptable, but only barely.)

Without that option, the expected output is:

$ gpg --recv-keys 28D3BED851FDF3AB57FEF93C233587A47C207910
gpg: key 233587A47C207910: public key "Nicolas Petton <nicolas@petton.fr>" imported
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   2  signed:   9  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: depth: 1  valid:   9  signed:  78  trust: 3-, 0q, 0n, 6m, 0f, 0u
gpg: depth: 2  valid:  68  signed:  18  trust: 31-, 20q, 2n, 15m, 0f, 0u
gpg: depth: 3  valid:   2  signed:   2  trust: 1-, 1q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2018-06-25
gpg: Total number processed: 1
gpg:               imported: 1

I guess if I received the key from keyserver, I would know its fingerprint

Not necessarily. You don't know yet whether you received the real key, or some other key that happens to have the same key ID. 'Short' (8-digit) key IDs are very easy to duplicate, and the future for 'long' (16-digit) ones isn't looking good either. If you already know the fingerprint, you should directly use it with --recv-keys and other commands.

In any case, you should not obtain fingerprints from the keyserver; that kind of defeats the whole point of verification by fingerprint.

Would it be enough information to confirm the key and set its trust to full?

Yes and no. You can confirm the key as valid, but setting a key's trust isn't the same thing – it actually lets that key contribute to the validity of other keys (that's how the "web of trust" is built).

If you don't know the person (or in particular don't know their PGP practices), you shouldn't assign any trust to their keys. It's enough to mark the key as valid, using --lsign-key <fingerprint> if you want to keep it local only, or using --sign-key if you want to publish the "confirmation".

  • Hi. Thanks for helping with SHA1 key rejection. I managed to import the key using the fingerprint from website. It tools that the key belongs to Nicolas Petton whose name is on website as well. Fingerprint is the same and a file is also singed by his key--the same fingerprint. – Celdor May 13 '18 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.