Information on my PGP public key

What is this about?

I could not explain better than our dear Wikipedia friend: GPG on Wikipedia. Another good reference is this wikibook on GPG.

I suggest you go read these, to learn more on GPG or to refresh your ideas on the subject, before reading more this page.

Where and when do I use it?

Sign to ensure the origin of a file

I tried to take the habit of signing the important files (binaries, PDF etc) that can be downloaded on this website (and the other websites I use).

This allow any one to be sure that she/he downloaded the correct file: my signing key is private, so I should (hopefully) be the only one able to produce these digital signatures.

Most of the addresses (URLs) of files I give on these web-pages can be appended with a short .asc at the end of the address to download the signature: for instance, cv.en.pdf and cv.en.pdf.asc, or for this page: pgp.en.html has its signature in this file pgp.en.html.asc.

More examples

For instance, my Bash profile file, .bashrc, has a signature .bashrc.asc.

With the sphinx-doc extension sphinx.ext.runblock, it is possible to include here in this web-page the command that was used to generate this digital signature (and its output):

$ LANG=en gpg --detach-sign --armor --quiet -o - /home/lilian/.bashrc
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE/DSleRq5aEZtX0W7LaPXUOHniXEFAmEmIRQACgkQLaPXUOHn
iXFnXBAAn+8IcD3X//CmK6BEE6xeLGLdfOMDM0fPSJzpnkH1sRni524QI2sC+3kb
wtKfsHZVyL5cAge/9peQ4n/uDJ3mWHlAWoXItfRA68kmiZY5WSKP5FB4srICHhJy
qDwhm7N9Q75ADEOqnHxooKahdKp/nn1eP2KHuzz+vPq9Jew56vNANb7SmXvbjUGU
9rmXc2FIQw5AClH9/0IneSw4oNmRdc74PEvm50dQtDTC1FENq8A1EqSJbpzxijiD
BiZnLAhfHXgBp5U0UwfFEwAQFRPsSH/Z/ud94LmVKiibbNANwy7ih/pRhsgF33eU
BT8EN4M/z1q2k6QnRk2nNCzfQK/YDzbCvxZJO+spSsuYNi6XjapTvX9unyPkPTlG
QNvVyyJe+/Rn2E6Bts0XYtPUa0+cJ7pRvZX0dqJCVMpBPFxDgJ47BmJy6CVNVZ4b
2xHSTrHn8lf3GhPT0vOq32OYsWwZxuEWUtkja+acno3OdkUXMghUP4O/AUV7+xyP
vzz8e+gflS7qeA0gP+PFSBjk3CZkYmuFvANqztFftPpsZa8zUEn8Hkf6+xTiP/WL
me7Ohmy9QHUTzVzsxnmc2DYVYrCLsmzO9hrFa8Mg40IqP6OfSGWL94nS46Z2lVFC
FZF6MlzpYHz7RGJtvvQle3OsbTpi/mVFVffgKomglWXv0V41mNo=
=mTdN
-----END PGP SIGNATURE-----

How to use these .asc files?

It is possible to check these signatures, with my public key. And that’s the main purpose of the .asc files!

First, you have to import my public key in your list of trusted keys (trust-ring).

R4096/C1108F8A0

In this case, my public key is in this file Lilian_Besson.asc, and you need:

  1. to download it, as explained in the next paragraph;

  2. and then check its MD5 and SHA256 checksums, to be sure you downloaded the good file! Simply compare the output of the md5sum and sha256sum commands to the one bellow.

    From my trust ring:

    $ LANG=en GPGKEY=`gpg.sh` gpg --export --armor $GPGKEY | md5sum
    $ LANG=en GPGKEY=`gpg.sh` gpg --export --armor $GPGKEY | sha256sum
    bash: ligne 1: gpg.sh : commande introuvable
    gpg: WARNING: nothing exported
    bash: ligne 2: gpg.sh : commande introuvable
    gpg: WARNING: nothing exported
    

    And from the file you downloaded Lilian_Besson.asc :

    $ # Use ./Lilian_Besson.asc to check the file in the current directory
    $ md5sum ~/Lilian_Besson.asc
    $ sha256sum ~/Lilian_Besson.asc
    md5sum: /home/lilian/Lilian_Besson.asc: Aucun fichier ou dossier de ce type
    sha256sum: /home/lilian/Lilian_Besson.asc: Aucun fichier ou dossier de ce type
    

This step is simply here to check that you downloaded the good public key (the .asc file is its armor-art, ie. an ASCII representation of its content).

  1. Then you have to import it in your trust ring (locally on your machine) :

    gpg --import Lilian_Besson.asc
    

And now, you can check the signature file.asc of any file file, with this simple command:

gpg --verify file.asc file

Example (2)

And so for the .bashrc file, if you downloaded it and its signature, you just have to do:

gpg --verify .bashrc.asc .bashrc

Then, hopefully, if you downloaded the files, and have imported my public key, it should give you a message like this one:

$ LANG=en gpg --verify ~/.bashrc.asc ~/.bashrc
gpg: Signature made Sun Feb 21 23:28:38 2021 CET
gpg:                using RSA key FC34A5791AB968466D5F45BB2DA3D750E1E78971
gpg: Good signature from "Lilian Besson (@Naereen) <lilian@besson.link>" [ultimate]

It should work just fine!

My public key

The public footprint of my key is C108F8A0.

R4096/C1108F8A0

One simpler way of importing my key is to simply look for it directly! From one of these two servers:

  • keyserver.ubuntu.com;

  • pgp.mit.edu.

A quick look-up on these PGP key server gives: