[newbie] GnuGP without keyring???
Jason Gunthorpe
jgg@wakko.deltatee.com
Thu, 27 May 1999 23:27:14 -0600 (MDT)
On Thu, 27 May 1999, Ron Brogden wrote:
> I realize that the whole concept of a "keyring" makes sense for a single
> user but in a multi-user scenario it seems bass-ackwards. What I would
> like to be able to do is have a user upload their public key and then,
> without having to add their key to a keyring do something like:
You should realize that this scheme is vunerable to a man in the middle
attack - it is entirely possible for an active attacker to substitute the
PGP key before it hits the server then intercept the encrypted reply. This
is why gpg has a trust mechanism. If you don't have a specially prepared
and trusted keyring then you have to establish trust for each key
seperately.
However, if you still what to do that then I'm guessing it is fairly
simple to do just by manipulating the keyring options, perhaps:
cat KeyMaterial | gpg --no-default-keyring --keyring /tmp/trash --import --with-colons
Extract the key fingerprint of the imported key then do an encrypt
operation using similar options
Jason