如何判断我的 OpenPGP 公钥是否是自签名的?

信息安全 加密 pgp gnupg
2021-08-23 09:29:15

我最近读到:

您应该在生成您的公钥/私钥对后立即签署您的 PGP 公钥。

现在我想知道如何检查我是否已经这样做了。所以我的问题是:如何判断我自己的 pgp 公钥是否是自签名的?

我正在使用 GnuPG/MacGPG2 v2.0。

1个回答

OpenPGP 自签名

自签名应用于用户 ID 和子密钥,让其他任何人都可以清楚地看到 ID 或子密钥确实 是您自己添加的。任何人都可以添加非自签名的用户 ID 和子密钥并上传到密钥服务器。

通常,自签名是由 GnuPG 自动创建的,所以你不需要关心任何事情。

检查自签名

使用终端,检查自签名非常容易。自签名列在其他列表中,因此您需要做的就是过滤用户 ID、子密钥及其各自的下一行(应包含自签名)。

gpg --list-sigs [key-id] |grep -EA1 '^(sub|uid)'

如果您的用户 ID 或子密钥在下一行中没有您自己的密钥签发的签名,您仍然可能需要查看此用户 ID/子密钥之后的整个输出 - 所以查看整个gpg --list-sigs [key-id]输出,找到子键,看看下面是否有自签名行。

在我自己的密钥的示例输出中,您可以很容易地看到每一行uid或每一sub行后面都有一个由主密钥本身发出的签名,确认它们都是自签名的。

$ gpg --list-sigs a4ff2279 |grep -EA1 '^(sub|uid)'
uid                            Jens Erat (born 1988-01-19 in Stuttgart, Germany)
sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
--
uid                            Jens Erat <jens.erat@fsfe.org>
sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
--
uid                            Jens Erat <jens.erat@uni-konstanz.de>
sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
--
uid                            Jens Erat <jabber@jenserat.de>
sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
--
uid                            Jens Erat <email@jenserat.de>
sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
--
uid                            [jpeg image of size 12899]
sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
--
sub   2048R/0x9FF7E53ACB4BD3EE 2013-01-23 [expires: 2023-01-21]
sig          0x4E1F799AA4FF2279 2013-01-23  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
sub   2048R/0x5C88F5D83E2554DF 2013-01-23 [expires: 2023-01-21]
sig          0x4E1F799AA4FF2279 2013-01-23  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
sub   4096R/0x8E78E44DFB1B55E9 2014-03-26 [expires: 2017-03-25]
sig          0x4E1F799AA4FF2279 2014-03-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
sub   4096R/0xCC73B287A4388025 2014-03-26 [expires: 2017-03-25]
sig          0x4E1F799AA4FF2279 2014-03-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
sub   4096R/0x382D23D4C9773A5C 2014-11-22 [expires: 2016-11-21]
sig     P    0x4E1F799AA4FF2279 2014-11-22  Jens Erat (born 1988-01-19 in Stuttgart, Germany)