[Q] Uploading my public key to a key server.

Neil Williams linux@codehelp.co.uk
Sun May 11 12:23:02 2003

Content-Type: text/plain;
Content-Transfer-Encoding: 7bit
Content-Description: signed data
Content-Disposition: inline

On Sunday 11 May 2003 4:07 am, Daniel Carrera wrote:
> > > Alright, I have a brand-new 2048-bit ElGamal key and I want to
> > > upload it to a keyserver.  How do I do that?

> Who assigns the keyid?  Is that derived from my public key?

Yes. The keyid is part of the keypair. When you generate a new key, a new 
keyid is calculated. (It was displayed when you created the key.)

> If so, who do I find out what my keyid is?

You get the keyid from the --list-keys output:
gpg --list-keys

pub  1024D/28BCB3E3 2002-01-27 Neil Williams (CodeHelp) <linux@codehelp.co.uk>

The keyid follows the / so mine is 28BCB3E3.
pub = public key
1024 = keysize
D = keytype (I think)
then the creation date, name, comment and email address.

List the keys, locate your own (sounds like you only have your own or maybe a 
few others in your ring so far) and make a note of it. With more use of 
GnuPG, you'll be able to remember the keyid. You'll need the keyid for all 
your future work with GnuPG and if you want to use other email clients - like 
KMail - to sign emails.

> For that matter, how do I find out what my public key is so I can post it
> somewhere?

The public key should be exported as a text file and then you can post it to a 
site, either as a .txt file or as .asc - take a look at 

To create the file, use:
gpg -a --output mykey.asc --export <keyid> 

You can then view the contents of the file to verify that it contains a 
cat mykey.asc

> > Indirectly it does.  When you sign a message, the keyid of the
> > signing key is included in the signature.
> Could you show me where?  Here is your signature.  I can't discern where
> the keyid is (yes, I know you also had your keyid elsewhere in your email,
> but not everyone does that).

The way that the signature is displayed is down to your choice of email 
client. I use KMail which clearly shows the keyid of all signed emails, my 
own and everyone else's, between the headers and the body of the message. 
Others here should be able to help you find the keyid and verification 
details in Mutt.

> > Version: GnuPG v1.2.2 (GNU/Linux)
> >
> > iD8DBQE+vbq8cieIIFcDdHIRArPhAJ9Z4u+gH5noEUxwJsPY38vfE5q/YgCfd3NB
> > mZpb4qvkGSeFUnMwSo9Osdo=
> > =tLPX
> > -----END PGP SIGNATURE-----

The keyid is retrievable from this sig but only with the original email. It 
depends on how the email has been constructed and the easiest ones I've 
verified on the command line are ones that use the old 'inline' signature, 
not the MIME type (as used in this email). I'm not sure how Mutt helps you 
distinguish between the two as KMail does.

I think you are referring to the email from Brian Minton sent on Sun May 11 
03:51:41 2003 - this is actually an 'inline' message. Save this email to a 
file (unchanged) with a simple filename: test.asc and use gpg to verify:

gpg --verify test.asc

gpg: Signature made Sun May 11 03:51:40 2003 BST using DSA key ID 57037472
gpg: Good signature from "Brian Minton <brian@minton.name>"
gpg:                 aka "Brian Minton <bminton@efn.org>"
gpg:                 aka "Brian Minton <minton@csc.smsu.edu>"
gpg:                 aka "Brian Minton <minton@math.smsu.edu>"
gpg:                 aka "Brian Minton <bminton@freeshell.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 81BE 3A84 A502 ABDD B2CC  4BFD 7227 8820 5703 7472

The keyid is clearly shown. The key is not certified because I haven't met 
Brian to exchange and verify the key so I haven't signed it. You should get 
the same warning. Don't start signing keys until you've learnt more about key 
verification, keysigning events and fingerprint verification. (Most of the 
keys I have signed have also signed my own key. gpg --list-sigs will show 
those - most will show up as unknown because they aren't members of this list 
but all are available from keyservers.) Before I signed these keys, I 
verified their email addresses over a period of many months of private and 
list correspondence (using mostly signed emails), I arranged a meeting with 
the people concerned, verified photographic ID for each one to match the name 
against the physical person (new photo type driving licence or passport) and 
then verified the fingerprint of the key with a printed copy given to me by 
that person at the meeting. Each stage is important to make sure you really 
do have the right person, the right email address and the right key - by 
signing a key, you are claiming to have verified all three as accurate.

> Thanks again,


Neil Williams


Content-Type: application/pgp-signature
Content-Description: signature

Version: GnuPG v1.2.1 (GNU/Linux)