0

Please help me verify the Tails signing key. Without having access to the web of trust, I'm trying to collect fingerprint data from multiple sources to be more certain that I've downloaded the authentic key from the Tails website. If you have it in your keyring, would you please paste the data about it from the output of this command:

$ gpg --with-fingerprint --with-subkey-fingerprints --list-keys

That would allow me to gain some trust in it by comparing the primary and all subkey fingerprints with the ones from the key I've got.

If you don't have it in your keyring, would you please download it from https://tails.boum.org and use the same command, changing --list-keys with [path to key file] and pasting its output instead. That would still be helpful. Thanks to all who help!

0

I took the tails signing key and downloaded it. After that I used gpg to import the file

gpg --import tails-signing.key

Now that the key is imported I can enter your command. The output is as follows:

 ~> gpg --with-fingerprint --with-subkey-fingerprints --list-key DBB802B258ACD84F
pub   rsa4096 2015-01-18 [C] [expires: 2020-01-11]
      A490 D0F4 D311 A415 3E2B  B7CA DBB8 02B2 58AC D84F
uid           [ unknown] Tails developers (offline long-term identity key) <tails@boum.org>
uid           [ unknown] Tails developers <tails@boum.org>
sub   rsa4096 2017-08-28 [S] [expires: 2020-01-11]
      0546 9FB8 5EAD 6589 B43D  41D3 D21D AD38 AF28 1C0B
sub   rsa4096 2017-08-28 [S] [expires: 2020-01-11]
      2FAF 9BA0 D65B B371 F0BC  2D46 3020 A7A9 C2B7 2733
sub   ed25519 2017-08-28 [S] [expires: 2020-01-11]
      CD4D 4351 AFA6 933F 574A  9AFB 90B2 B4BD 7AED 235F
sub   rsa4096 2018-08-30 [S] [expires: 2020-01-11]
      FE02 9CB4 AAD4 788E 1D78  28E8 A8B0 F4E4 5B1B 50E2
  • Thank you so much for your help! The fingerprints I see are exactly the same. Is it posiible for another (malicious) OpenPGP key to have the same primary and subkey fingerprints? – Patrick Feb 28 at 16:12
  • This is practically impossible. – Jens Kubieziel Feb 28 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.