10 ms·
What is the point of a public key fingerprint?
- mark_l_watson 3y agoNice write up. I have had two customers who had me install PGP in Apple email, which was fairly painless. Until ProtonMail, which is what I use, using PGP was a great option. More people should try to encrypt communication.
- gruez 3y ago> Nice write up. I have had two customers who had me install PGP in Apple email, which was fairly painless. Mail.app supports PGP? How?
- kstrauser 3y agoI use to use this plugin: https://gpgtools.org/ https://gpgtools.org/
- eduction 3y agocan affirm that gpgtools + mail.app is close to seamless, once the keys are already exchanged.
- kstrauser 3y agoBut only if it works with your OS version. It always takes them a few months to support the update. I'm not complaining. It's not like they're a giant company making megabucks to support it. But if you buy a new Mac today with Sonoma pre-installed, you're gonna have to wait a while before you can encrypt your email.
- jeauxlb 3y agoThe free version of this software is available at https://github.com/Free-GPGMail/Free-GPGMail https://github.com/Free-GPGMail/Free-GPGMail
- kstrauser 3y agoWow, I didn't know that existed. Nice! When I used GPGMail, I didn't mind giving them a few dollars to support it. It's nice to not have to, though.
- asimpletune 3y agoSo I guess Apple Mail + Keychain Access is all it takes https://support.apple.com/guide/mail/sign-or-encrypt-emails-mlhlp1180/mac https://support.apple.com/guide/mail/sign-or-encrypt-emails-... Pretty neat! (Edit: not technically PGP, but PKI)
- rhuru 3y agoWhere I work we often have to exchange keys with partners. Key fingerprint is often used as a mechanism to make sure the partner really has OUR public key. We email the key first and then another known employee is expected to verify the fingerprint on phone. Another approach is to host the keys on a HTTPS endpoint on our official domain name and their servers can fetch it programmatically and rely on TLS to verify that it is indeed our endpoint.
- 0xDEAFBEAD 3y ago>Another approach is to host the keys on a HTTPS endpoint on our official domain name and their servers can fetch it programmatically and rely on TLS to verify that it is indeed our endpoint. That's only as secure as the weakest CA in their trust store though, right? https://en.wikipedia.org/wiki/Certificate_authority#CA_compromise https://en.wikipedia.org/wiki/Certificate_authority#CA_compr... IMO the best way is to put your key fingerprint on your business card and all your promotional materials. Then you just have to ensure that an adversary doesn't tamper with those :-) (Of course, use of additional verification for the sake of redundancy is great too) Spreading your Signal phone number is another approach. There was a recent HN thread discussing the merits of GPG vs Signal: https://news.ycombinator.com/item?id=38557888 https://news.ycombinator.com/item?id=38557888 https://news.ycombinator.com/item?id=38558231 https://news.ycombinator.com/item?id=38558231 https://news.ycombinator.com/item?id=38555803 https://news.ycombinator.com/item?id=38555803
- halJordan 3y agoNo public keys are meant to be public, either yes key will be correct or not. This is why (to my knowledge) package managers like apt still check http endpoints instead of https ones.
- 0xDEAFBEAD 3y ago>No public keys are meant to be public, either yes key will be correct or not. Yeah but how do you know if the key is correct if you're getting it for the first time? >This is why (to my knowledge) package managers like apt still check http endpoints instead of https ones. Your distro ships with a public key that lets you verify package signatures. TLS is redundant because you already have that trust anchor which came with the distro. (I would suggest using TLS anyway though, to force an attacker to break 2 layers of security.)
- naitgacem 3y agoThe first time I got on a telegram call using their Android client, the call had a string of 4 emojis and said something along the lines of "if you and the other person see the same emojis, this call is secure". I thought that was pretty neat!
- pndy 3y agoMatrix clients use similar way to verify login sessions
- llamaInSouth 3y agobut they only show a green check-mark... not sure how it works
- jonhohle 3y agoIf you see the same emojis as others, this comment is secure: <HN doesn’t support emoji>
- CharlesW 3y ago(╯°□°)╯︵ ┻━┻
- lucb1e 3y agoIn case anyone doesn't know: these code points are legit (Japanese) characters, whereas so-called emojis are a range of code points specifically for graphics. That's why I imagine HN software allows this to be posted even though emoji code points are removed
- CharlesW 3y agoI've informally referred to this as "ASCIImoji", but TIL that its proper name is "Kaomoji": https://en.wikipedia.org/wiki/Kaomoji https://en.wikipedia.org/wiki/Kaomoji
- ghgr 3y agoI'm not sold on this argument. Why is a 40-char long fingerprint better that verifying the last 40 chars of the public key?
- otachack 3y agoBecause of tampering. If an attacker can produce a pair where the public key's last 40 chars match the victim's public key last 40 chars they effectively have a public key to dish out via MITM. How feasible it is to produce said pair is another story.
- deleted 3y ago[deleted]
- tux3 3y agoIt doesn't sound too hard to generate an RSA "vanity key", with any value you want for some of the bytes. You can't control _all_ of the bytes, because it still needs to have the right structure and for you to have the corresponding private key, but 40 bytes of your choosing seems completely doable. And if you can do that, you can impersonate someone else whose pubkey has the same 40 bytes. With a hash, any bit difference in any part of the key should result in a completely different fingerprint (hash collisions being extremely hard to find).
- lucb1e 3y agoNote that this is specific to RSA keys. In no scenario (that doesn't involve extraterrestrial resources or perhaps nuclear fusion) can you create an ECC key, let alone a hash fingerprint, with 40 bytes of vanity. Afaik ECC keys are considered to be half the strength of a symmetric key (pre-quantum), so that's 20 fully random bytes or 160 bits of entropy. The sun simply doesn't hit the earth with enough energy even if you'd capture 100% of that and starve all life for it to do a computation of that magnitude. (The boundary is around the standard 128-bit key size iirc; I keep forgetting if the sun's energy would be sufficient for like ~120 bits or more like ~140 bits... and that's assuming perfectly efficient computational machines.) Since the person you're responding to didn't specify which public key type, and since it's not obvious that your mention of RSA is to the exclusion of other algorithms such as ECC, I felt like the comment is a bit misleading
- gruez 3y ago>What you’d really like is a cryptographic hash of the public key, short enough to conveniently compare, but long enough that it would be infeasible for someone to alter the public key in such a way as to produce the same hash. And that’s exactly what a fingerprint is. This seems overly specific to PGP. x509 (ie. "SSL") certificates have fingerprints as well, but they're almost always expressed in 128+bit formats, not truncated.
- dixie_land 3y agoIsn't the main problem to secure the distribution of the key? > Maybe my site has been hacked and I don’t even know it. How would the fingerprint help in this case? If the fingerprint is also hosted on the website.
- ytret 3y agoI think one can verify the fingerprint by other means, e.g. phone
- pengaru 3y ago`gpg --auto-key-locate` is a thing, except not many actually use DANE for key distribution... https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
- bluedino 3y agoI always wonder why randomart (or an improved version) never seemed to catch on
- upofadown 3y agoIsn't it much harder to compare a bunch of random characters scattered across a mostly blank field than some sort of number?
- rainsford 3y agoIt's one of those things that looks kind of useful but the more you think about it the more the use case doesn't actually make sense. A randomart image is actually harder to share than a hash (you can't read it over the phone for example) and any situation where you can share the image you can just as easily share a hash. It's visually easier to distinguish differences in randomart than with a hex encoded hash value, but there are very few situations where that's actually a useful property in practice. If you actually are able to share the whole value, you probably have a computerized way of sharing information that you trust and you might as well just programmatically compare it to what you expect and that can detect even a single bit difference regardless of the format. A version of the idea that might be more useful would be something that translates hex values into something that's easy for humans to share in any number of out-of-band ways. Translating a hex value into English words would be great for verbal verification for example. Or if we're being very 2023, maybe use the binary input to feed an AI image generation algorithm and you describe the image to the receiver.
- denton-scratch 3y agoI thought it was obvious that a fingerprint allows you to verify that you have the correct public key via some alternative channel. So I read the article to find out why I was wrong; perhaps the article detailed an obscure wetware hole in the verification process, or maybe a dramtically better way of verifying public keys. Nope: the article was a straight answer to the question in the title. Oh, well: it was short and to the point.
- password4321 3y agoYou haven't lived until you've manually typed your ed25519 public key into your Hyper-V VM authorized_keys because "Type clipboard text" still doesn't work out of the box...
- deleted 3y ago[deleted]
- Anunayj 3y agoHey atleast it wasn't a RSA key. Though for this reason I just have my public key publicly accessible (For instance github exposes all of user's public keys) and just curl it in.
- Retr0id 3y agoBy the way, if it's the same pubkey you use for github, you can curl https://github.com/username.keys https://github.com/username.keys
- yjftsjthsd-h 3y agoThere's gotta be some way to do it with autohotkey?
- Terr_ 3y agoI wonder if that's a situation where you could use a smartphone to mimic a keyboard (over USB or USB-to-PS2 or whatever), using it to "paste" content that way.
- forevernoob 3y agoI think you have to have WSL for this to work, but this is how I do it on Linux with Xorg: sleep 3 ; xdotool type --delay 5 "$(xclip -selection c -o)" ## Force-paste the secondary paste buffer (Ctrl+Shift+c)
- 1vuio0pswjnm7 3y ago"If I give you my public key, say I post it on my web site, how can you be sure that it's really my key? Maybe my site has been hacked and I don't even know it. Or maybe someone tampers with the site content between the time it leaves my server and arrives at your browser (though TLS is supposed to address that). We could get on a phone call and I you could read the key back to me. The problem with this approach is that keys are long. A 4096-bit RSA key, for example, encoded in hexadecimal, is 1024 characters long." If trust the "phone" and phone numbers but not the "internet" and IP numbers, then why not just use modems to transfer the public key. Is the assumption that it would be impossible for both the person's website and his phone to be simultaneously compromised.
- pants2 3y agoMy favorite solution to this is probably ENS (Ethereum Name Service) - you can link your public key to a domain name, essentially, and it's extremely verifiable and widely adopted.
- uxp8u61q 3y agoWhat does this bring to the table over having txt records at e.g., _key.example.com? Why add a bunch of intermediaries?
- 1vuio0pswjnm7 3y agoDNSCurve was putting public keys into NS records before Ethereum existed. The subdomain for the nameserver contains the public key. See https://dnscurve.org/integration.html https://dnscurve.org/integration.html For example, example.com. IN NS uz5bcx1nh80x1r17q653jf3guywz7cmyh5jv0qjz0unm56lq7rpj8l.example.com.
- archero 3y agoWhen I read that I thought about the ability to replicate someone’s voice using AI. How would you know it’s me on the other end reading you my key over the phone? Then again, you would need a substantial amount of audio from me to accurately train a model of my voice.
- eterps 3y agoI like that https://github.com/FiloSottile/age https://github.com/FiloSottile/age has small public keys.
- Retr0id 3y agoBeware of having too-small fingerprint hashes though, or not checking enough of the digits. $ echo -n retr0id_662d970782071aa7a038dce6 | sha256sum 307e0e71a409d2bf67e76c676d81bd0ff87ee228cd8f991714589d0564e6ea9a - $ echo -n retr0id_430d19a6c51814d895666635 | sha256sum 307e0e71a4098e7fb7d72c86cd041a006181c6d8e29882b581d69d0564e6ea9a -
- ls65536 3y agoThis is a good point, and by your example it's obviously feasible to find enough of a "collision" on both ends of the digest to make it look like a match at a careless first glance. In your particular example, I counted at least 96 bits that match on the ends (in total...from 48 bits on each end), and now I'm curious what kind of hardware you used and how long it took to find this match.
- est31 3y agoIf you have the available RAM/SSD for a birthday attack, you only need 48 bits worth of complexity, which makes this a manageable problem. I suppose the ASICs for bitcoin mining don't have the needed bandwidth to storage devices which would put my guess onto GPUs. Assuming 32 bytes of storage per hash (probably more but you wouldn't store the full hash, instead a hash table with the prefix+postfix up to a certain amount, then of course some hash table management overhead), you'd have to write around 9 PB if you write once, 1 petabyte if you write 64 times, for the raw hashes only.
- Retr0id 3y agoYou don't need to store all the hashes, just the Distinguished Points[1]. It took me a couple of days on a single AMD RX6700XT desktop GPU, using some negligible amount of RAM (it was a few GB of main system memory iirc). [1] https://www.cs.csi.cuny.edu/~zhangx/papers/P_2018_LISAT_Weber_Zhang.pdf https://www.cs.csi.cuny.edu/~zhangx/papers/P_2018_LISAT_Webe...
- rainsford 3y agoThe interesting thing about that is that while a fairly impressive number of the beginning and end values match, a trivial side-by-side comparison glance makes it clear they don't match even if you don't directly compare any of the digits. I think humans are actually pretty good at this task if they approach it more like humans than machines and just give the two values a quick glance with the intent of spotting differences rather than a nibble by nibble comparison.
- rl3 3y ago>We could get on a phone call and I you could read the key back to me Length isn't the only problem. In theory, real-time voice MITM with an AI swap on the verification readback such that it matches the modified key is a real possibility these days (albeit remote).
- rezonant 3y agoWay more possible today than in the past, but still would be insanely impressive if executed in reality.
- lucb1e 3y agoBy a criminal or as part of a prank at least. If security agencies turn out to invest the money needed for doing this, or just have a big enough pool of soundalikes (perhaps additionally trained as voice actor), that wouldn't surprise me much honestly. Also keep in mind that phone compression degrades the quality quite a bit. Still interesting to know about once it's actually happening, but not unexpected
- notfed 3y agoMy first thought is that RSA is outdated: EdDSA has 256-bit keys, and if you're lazy enough you can probably just read the equivalent of 160 of those bits without security loss (I think?). But then I remembered post-quantum crypto. Yeah, gonna need those fingerprints.
- demondemidi 3y agoIf your public key on your website is hacked and your hash is on the website, well, your hash will be hacked too. If you're going to transmit the hash via a secure side channel, just transmit the public key. I think the author is confusing secrecy with authenticity. The only way to prove the public key you received is really the intended public key is with a third party certificate authority that authenticates it. Which is what TLS does. But I will assume the author is smarter than me. Am I missing something or is this article useless? Just use the same secure channel for the hash but for the public key.
- Snawoot 3y agoSure you can. Fingerprint of key is just a shorter and more convenient option to reference key everywhere, including manual verification. Article tells just that and it's commonly used in the industry. And, by the way, signature in X.509 certificates ("TLS certificates") also hashes data to be signed - signed data input has to be smaller than sig size. Hence it also verifies pubkey indirectly.
- deleted 3y ago[deleted]
- pipes 3y agoCan someone tell me if I have understood this correctly: A public key thumb print is a hash of the public key. It useful because it is easy to manually validate. Edit: when would I need to manually validate? I'm guessing it is used as an identifier when configuring a deployment for a system to a particular environment, for example?
- jen729w 3y agoI wonder something every time I download Mullvad’s updated VPN client. ‘Verify this download with the GPG signature’, it tells me. But surely if I’m in a position where I’ve poisoned Mullvad’s executable, I’m also in a position where I’ve doctored the GPG sig to match? That sig just being something that I download from mullvad.net. Unless it’s somehow independently verified, I’m not sure that I see the point? (Or anything else similar. Not picking on Mullvad, it’s just the one that comes to mind.)
- uxp8u61q 3y agoIdeally, you'd have downloaded the GPG key on first use and check newer updates against that. It's a version of "Trust on First Use". It doesn't protect you against attacks during the initial installation, but it protects you against fake updates.
- throwaway64643 3y agoYou've gotta check if they published their GPG signature somewhere else before, either in their social media pages, internet web cache, or forum.
- eviks 3y ago> We could get on a phone call and I you could read the key back to me. This makes no sense, the article is not from the 80-s, copy-pasteable modes of immediate communication has reached even grannies! > Manually verifying 40 characters is feasible; manually verifying 1024 characters is not. It's not, no user should ever be exposed to this nonsense of manual verification of such long strings
- deleted 3y ago[deleted]