orta / orta/keytrace

GPG: Sign full public key

Open
#40 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
85
Forks
6
PR merge metrics
No merged PRs in 30d

Description

Currently we just sign the GPG fingerprint. It's relatively human friendly, but it comes at the cost of signatures being over far less entropy/data than signing the full public key would bring.

This could be for absolutely nothing, but it feels like we should present & sign the whole public key, to make extra sure there's not some sneaky impersonation.

current example

Verifying my PGP key on keytrace

did: did:plc:zjbq26wybii5ojoypkso2mso
gpg: f0:00:ba:3d

possible next

Verifying my PGP key on keytrace

did: did:plc:zjbq26wybii5ojoypkso2mso
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEanQJtxYJKwYBBAHaRw8BAQdAfP2sBlRAvVijq6wowWVTAoPtDol1urqeQwSz
EOeKCAm0GWtleXRyYWNlLXRlc3RAZXhhbXBsZS5jb22IkAQTFgoAOBYhBKVwnIRH
Lv4QS9nQ+y6rLN824qqQBQJqdAm3AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
AAoJEC6rLN824qqQ2gkBAKSe1RFKd2rRBzbiC1fzpL/u9ci9WupKkY7WW1j7ArwB
AQClgfDXcw2oWtU46//SgE1e5Sm/D/vf+ivEE3hcVrL3Aw==
=OBA0
-----END PGP PUBLIC KEY BLOCK-----

how?

use gpg --armor --export instead of gpg --fingerprint to get the full public key, update the input box to accept multi-line input.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by finding the current code that runs gpg --fingerprint and the input box used for verification. Replace the fingerprint export with gpg --armor --export, update the input handling for multiline armored keys, and verify that a full public key can be displayed and processed successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.