I understand the utility of the key block itself, and of a hash of the key, but I don't know why additional information would be necessary, so I can't begin to guess the utility of an additional bit of information.

Specifically,

  • What does it signify,
  • where is it used, and
  • (how) can it be determined given the public key block?

It tends to be mentioned tangentially and in passing, which leads to confusion since clearly spacewalk recognizes a difference between fingerprint and ID, while some GPG documentation put out by Fedora includes the phrase

For KEYNAME, substitute the key ID or fingerprint of your primary keypair,

which makes it seem as if the two share the same purpose; but that doesn't make sense because if that were the case why would you need both to begin with?

  • The gpg utility lets you specify either as a convenience to you. If you specify a fingerprint it will look up the fingerprint and if you specify the ID it will look for an ID that equals or contains the string you specify. The ID is often a human-readable identifier for the key. The fingerprint in general is described at en.wikipedia.org/wiki/Public_key_fingerprint. What is the problem you are actually having? – Jason C Jun 16 '14 at 14:41
  • @JasonC Spacewalk wants an ID as well as a fingerprint and URL for the key block, but repos (e.g. EPEL) only provide the key block. Now, I know I can get the fingerprint just by taking a hash of the key block, but I don't know whether I'm supposed to get the ID from somewhere else, decide on one and load it into a database before I tell spacewalk about it, or just make one up for spacewalk. Basically, it's a spacewalk problem that gets a lot easier once I know more about how GPG IDs are used. – Parthian Shot Jun 16 '14 at 14:50
  • @JasonC More succinctly: I'll be downloading signed RPMs, and all I have is the key block, so I need to know whether I decide on an ID or the issuer decides on an ID. – Parthian Shot Jun 16 '14 at 14:57
  • Did you follow the EPEL/Spacewalk installation instructions from fedorahosted.org/spacewalk/wiki/HowToInstall#EPELrepository or wiki.centos.org/HowTos/PackageManagement/… and is Spacewalk actually failing to manage packages from EPEL? Is access.redhat.com/site/solutions/308983 relevant? – Jason C Jun 16 '14 at 15:04
  • 1
    If it works without you filling it in, then it knows how to manage without you specifying, and filling it in is not helpful. However, check out web.archive.org/web/20130821232554/http://centosforge.com/node/… which tells you how to obtain a fingerprint and ID for Spacewalk. Similar instructions at darkoperator.com/blog/2011/12/16/…. More info at google.com/search?q=spacewalk%20package%20key%20id – Jason C Jun 16 '14 at 15:22
up vote 23 down vote accepted

From RFC 4880:

A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field. The Key ID is the low-order 64 bits of the fingerprint.

For V3 keys, calculation is similar, but the key length is omitted.

In other words, the fingerprint is calculated from a constant, the packet length and finally a part of the public key packet. Further explanation on what's included (and thus how to calculate it) in the linked RFC.

The (long) key id is represented by the lowest 64 bits, and is used as the full fingerprint is an unhandy and long value. Even more often, the short key id formed by the lowest-order 32 bits is used. These short key IDs are often considered to have a too high chance of collisions and usage of at least the long ID, if not even full fingerprint is recommended.

Recapped in a few words:

The fingerprint is the hash value calculated from the public key packet. The key IDs are a part of the fingerprint:

Fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279
Long key ID:                                4E1F 799A A4FF 2279
Short key ID:                                         A4FF 2279

Sometimes, the IDs get prefixed by 0x as they're hex values.

  • 1
    Very useful link to the information on collisions, thanks. You might want to change the answer to say that even long keys are forgeable and therefore not recommended. – zkilnbqi Apr 3 '15 at 7:34
  • While short key IDs are forged very easily, long key IDs are 2^32 times harder to collide and still considered appropriate. Even fingerprints can be forged, they're just even even harder to forge (due to the vast number of possible fingerprints). – Jens Erat Apr 3 '15 at 9:29
  • 1
    I was convinced by the link you included in your answer. Now my signature says "harold@foo.com pgp.mit.edu ID as of 2015-03-22" Makes much more sense. If someone wants to send you an encrypted message or verify that you have signed one, they are going to have to find your public key on the keyserver anyway, so there is no advantage in using the key ID. – zkilnbqi Apr 4 '15 at 4:52

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.