29

Is there some tool to write out the actual content of a GnuPG public key in a way a human can unserstand? I mean not only ascii-armor which a human can read and type, but something which really breaks down the data into large decimal numbers for the crypto part, strings for the UIDs, and so on? I'd really like to see what's in there.

Actual application today: I've two keys from the same person, created at the same date, but differing in fingerprint. The assumption is that one of them was created from the other by some kind of conversion, probably by importing the older key into a keychaing using recent software. I'd like to see what actually changed. Perhaps it's only the fingerprinting algorithm which changed, but perhaps there is more to it.

Improve this question
1
  • I found all the suggested answers before getting to this question. Unfortunately, this still sucks in being "human readable", espcially when the key has many signatures. I really expected gpg2 to readily give this information in some kind of show-key command :-(
    – Bluehorn
    Commented Nov 9, 2018 at 9:29

5 Answers 5

Reset to default
28

Try 

gpg --list-packets --verbose < pubkey.asc

It doesn't dump the key data, but it shows all the other details. To dump additional raw data parts you need debug flag 2, so add --debug 0x02, this will dump the keys and other data in hex. This works in GPG versions 1.2 and 1.4, but sadly not in 2.0 as support for dumping bignum (MPI) data is not enabled (see DBG_MPI in g10/parse-packet.c) for some reason.

Also try pgpdump:

pgpdump < pubkey.asc
Improve this answer
4
  • Looks good, but it still omits some data: some things are abbreviated as [1024 bits] or the likes. I'd like to see those bits. I know you wrote that those aren't included.
    – MvG
    Commented Jan 4, 2014 at 14:39
  • 1
    Found it, debug flag 2, updated.
    – mr.spuratic
    Commented Jan 4, 2014 at 15:25
  • That debug flag doesn't work for me, for some reason. It prints a message abozt the flag being enabled, but does not print debugging info for it. Will probably have to dig through sources to find out why… @grawity: pgpdump looks very much like what I had in mind, thank you. Any particular reason you chose to edit an existing answer instead of posting a new one. After all, both are different suggestions, each with its own merits and drawbacks, so users might want to vote independently.
    – MvG
    Commented Jan 4, 2014 at 16:03
  • 3
    This debug flag is for MPI (bignum) debugging (DBG_MPI), it works as indicated in GPG 1.2/1.4, but it's not properly supported in GPG 2.0.x (it's commented out in g10/parse-packet.c) with a "FIXME" beside it... @grawity thanks for the tip on pgpdump, looks useful.
    – mr.spuratic
    Commented Jan 6, 2014 at 21:34
4

While waiting for answers, I read RFC4880 (OpenPGP) and came up with some code of my own to parse and print the relevant portion of an exported packet stream. Far from complete, but it might be useful to others, so I'm posting this as well. Right now I see little benefit over that pgpdump suggested by @grawity, but who knows…

Improve this answer
3

I've used pgpdump It works well, and shows nice human-readable output. It doesn't yet print Elliptic Curve keys, but it will at least tell you it is an EC key. If you select the "dump literals" option, it will show you the actual key data.

Improve this answer
3
  • pastebin.com/pRezWQfP is an example of the output using my public key.
    – Brian Minton
    Commented Sep 22, 2014 at 18:32
  • 1
    Seems that site is gone, just some domain squatters there now...
    – npostavs
    Commented May 17, 2018 at 0:16
  • Yes, it seems that way.
    – Brian Minton
    Commented May 18, 2018 at 12:26
1

pgpdump is good, and there is also sq packet dump, from the sequoia project, which I find more readable:

sq packet dump /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
Public-Key Packet, old CTB, 525 bytes
    Version: 4
    Creation time: 2018-09-17 15:01:46 UTC
    Pk algo: RSA
    Pk size: 4096 bits
    Fingerprint: F6ECB3762474EDA9D21B7022871920D1991BC93C
    KeyID: 871920D1991BC93C
  
User ID Packet, old CTB, 66 bytes
    Value: Ubuntu Archive Automatic Signing Key (2018) <[email protected]>
  
Signature Packet, old CTB, 568 bytes
    Version: 4
    Type: PositiveCertification
    Pk algo: RSA
    Hash algo: SHA512
    Hashed area:
      Signature creation time: 2018-09-17 15:01:46 UTC
      Key flags: CS
      Symmetric algo preferences: AES256, AES192, AES128, CAST5, TripleDES
      Hash preferences: SHA256, SHA1, SHA384, SHA512, SHA224
      Compression preferences: Zlib, BZip2, Zip
      Features: MDC
      Keyserver preferences: no modify
    Unhashed area:
      Issuer: 871920D1991BC93C
    Digest prefix: 2C73
    Level: 0 (signature over data)
  
Signature Packet, old CTB, 563 bytes
    Version: 4
    Type: GenericCertification
    Pk algo: RSA
    Hash algo: SHA512
    Hashed area:
      Issuer Fingerprint: 153F1C9EF1395FBF00352E8D0BFB847F3F272F5B
      Signature creation time: 2018-09-17 15:12:03 UTC
    Unhashed area:
      Issuer: 0BFB847F3F272F5B
    Digest prefix: 6E17
    Level: 0 (signature over data)

Repo is at https://gitlab.com/sequoia-pgp/sequoia, crate is at https://lib.rs/crates/sequoia-sq), installable from cargo and many good package managers (Debian/Ubuntu/Arch/Fedora…)

Improve this answer
0

Is someone able to expalain to me where "gpg --list-packets --verbose < pubkey.asc" or any other snippit? i dont even know what they are called, mini scripts. what is done with them, and what program or app is used to run that snippit or add that snippit or use. Is there a 101 link to understand this? i have a problem where, kleopatra's exported public key is denied by mozilla thunderbird when i am trying ty add encryption.

Improve this answer
1
  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented May 16 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .