2

Am not sure where this is the right place to ask this

Someone has asked me to sign their public key, how do i do that?

His public key has Version: GnuPG v1.2.1 (GNU/Linux)

4 Answers 4

4

This answer describes digital signatures which are not necessarily what is needed. While digital signatures can be used with GPG, they are not required.

When using a digital signature, to sign a public key you need a public/private key pair of your own. The way in which you generate the public/private key pair and sign the document/key depend on the protocol you are using.

When you sign a document/key you will use your private key to encrypt the document (called signing) and then distribute your public key to others so that they can decrypt your document and verify that they receive the original text back.

The idea is that the private and public keys come as a pair and it is extremely difficult to generate an encrypted copy of the original document that will properly decrypt with your public key without access to your private key (which you keep secret).

Your public keys should be "well known" in the sense that it should not be only distributed with the signed document or the public/private key used to sign could have been entirely forged.

Note that since this your public key is known "publicly" anyone can decrypt this document. Digital signatures are simply used to verify the authenticity of the document, not keep it secret. For a broader description of public-key cryptography and its many uses please check the public-key cryptography page on Wikipedia.

This link on PGP may be of use, and here is some information on key exchange protocols.

10
  • 1
    signing doesn't necessarily mean encrypting. signing a document encapsulates the document in a pgp/gpg signature, the signature can then be checked to verify that the data has not been modified.
    – cpbills
    May 12, 2010 at 18:48
  • @cpbills: I think my phrasing was too ambiguously. From my understanding, the act of signing must involve encrypting the document, a hash of the document, or something else using the private key so that the public key can then be used to decrypt the signature for the purposes of authenticity and non-repudiation. May 12, 2010 at 19:11
  • perhaps one of the steps is encrypting the document with your private key to generate the hash, but the resulting document is plain text, encapsulated with the user's signature.
    – cpbills
    May 12, 2010 at 19:24
  • How do i get a public/private key for myself
    – Gatura
    May 13, 2010 at 5:21
  • @Gatura: it entirely depends on what type of signature is being used and what algorithm you are using. You should ask the person that asked you for specifics and update or reask your question. May 13, 2010 at 5:41
1

To sign someone's public key, you would have to have your own public/private key pair. We'd need more detail, but it sounds like somebody is trying to build up a "web of trust" around their public key. I am sure the kind of person who asked you to do that would enjoy explaining in more detail how to do what they're asking, or you might try searching for "Web of Trust". If that's not what you're looking for then please expand and we'll try to help.

2
  • Signing a key with a fresh public key from an unknown source does not really add trust to the signed key. Gatura, If the person asking is trying to build a "Web of Trust", you should probably inform him/her that you do not yet have a public/private key pair and ask them if they would still like your signature. May 12, 2010 at 6:55
  • How do i get a public/private key for myself
    – Gatura
    May 13, 2010 at 5:16
0

There are some good answers in this thread on the theory, but not much on the practice.

The best way to learn PGP (GnuPG is an alternate implementation) is to use it. I'd recommend, even if you don't use Thunderbird as your primary email client, install Thunderbird and install Enigmail with GnuPG. http://enigmail.mozdev.org/documentation/quickstart.php

PGP is a really good idea, but it's hard to wrap your head around. The longer you spend using it, the more sense it will make.

-1

For mac users you can download a software known as wija link text, this will help you with many issues with regards to public and private keys also signing

2
  • Wija doesn't seem to have anything to do with key signing, other than it can use GPG. It's a messaging client.
    – Bill Weiss
    Jun 2, 2010 at 17:22
  • surely i used it to generate a public/private key pair and sign a friends public key, on the PGP menu, there is the key rings option which can be used to do this. Check again
    – Gatura
    Jun 3, 2010 at 6:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .