Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Am not sure where this is the right place to ask this

Someone has asked me to sign their public key, how do i do that?

His public key has Version: GnuPG v1.2.1 (GNU/Linux)

share|improve this question

4 Answers 4

up vote 4 down vote accepted

This answer describes digital signatures which are not necessarily what is needed. While digital signatures can be used with GPG, they are not required.

When using a digital signature, to sign a public key you need a public/private key pair of your own. The way in which you generate the public/private key pair and sign the document/key depend on the protocol you are using.

When you sign a document/key you will use your private key to encrypt the document (called signing) and then distribute your public key to others so that they can decrypt your document and verify that they receive the original text back.

The idea is that the private and public keys come as a pair and it is extremely difficult to generate an encrypted copy of the original document that will properly decrypt with your public key without access to your private key (which you keep secret).

Your public keys should be "well known" in the sense that it should not be only distributed with the signed document or the public/private key used to sign could have been entirely forged.

Note that since this your public key is known "publicly" anyone can decrypt this document. Digital signatures are simply used to verify the authenticity of the document, not keep it secret. For a broader description of public-key cryptography and its many uses please check the public-key cryptography page on Wikipedia.

This link on PGP may be of use, and here is some information on key exchange protocols.

share|improve this answer
1  
signing doesn't necessarily mean encrypting. signing a document encapsulates the document in a pgp/gpg signature, the signature can then be checked to verify that the data has not been modified. –  cpbills May 12 '10 at 18:48
    
@cpbills: I think my phrasing was too ambiguously. From my understanding, the act of signing must involve encrypting the document, a hash of the document, or something else using the private key so that the public key can then be used to decrypt the signature for the purposes of authenticity and non-repudiation. –  Trey Hunner May 12 '10 at 19:11
    
perhaps one of the steps is encrypting the document with your private key to generate the hash, but the resulting document is plain text, encapsulated with the user's signature. –  cpbills May 12 '10 at 19:24
    
How do i get a public/private key for myself –  Gatura May 13 '10 at 5:21
    
@Gatura: it entirely depends on what type of signature is being used and what algorithm you are using. You should ask the person that asked you for specifics and update or reask your question. –  Trey Hunner May 13 '10 at 5:41

To sign someone's public key, you would have to have your own public/private key pair. We'd need more detail, but it sounds like somebody is trying to build up a "web of trust" around their public key. I am sure the kind of person who asked you to do that would enjoy explaining in more detail how to do what they're asking, or you might try searching for "Web of Trust". If that's not what you're looking for then please expand and we'll try to help.

share|improve this answer
    
Signing a key with a fresh public key from an unknown source does not really add trust to the signed key. Gatura, If the person asking is trying to build a "Web of Trust", you should probably inform him/her that you do not yet have a public/private key pair and ask them if they would still like your signature. –  Trey Hunner May 12 '10 at 6:55
    
How do i get a public/private key for myself –  Gatura May 13 '10 at 5:16

There are some good answers in this thread on the theory, but not much on the practice.

The best way to learn PGP (GnuPG is an alternate implementation) is to use it. I'd recommend, even if you don't use Thunderbird as your primary email client, install Thunderbird and install Enigmail with GnuPG. http://enigmail.mozdev.org/documentation/quickstart.php

PGP is a really good idea, but it's hard to wrap your head around. The longer you spend using it, the more sense it will make.

share|improve this answer

For mac users you can download a software known as wija link text, this will help you with many issues with regards to public and private keys also signing

share|improve this answer
    
Wija doesn't seem to have anything to do with key signing, other than it can use GPG. It's a messaging client. –  Bill Weiss Jun 2 '10 at 17:22
    
surely i used it to generate a public/private key pair and sign a friends public key, on the PGP menu, there is the key rings option which can be used to do this. Check again –  Gatura Jun 3 '10 at 6:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.