我有一个PostgreSQL apt仓库gpg密钥的副本,并且想查看gpg密钥的详细信息,因为它包含在文件中。是否可以不将其导入钥匙圈?
我有一个PostgreSQL apt仓库gpg密钥的副本,并且想查看gpg密钥的详细信息,因为它包含在文件中。是否可以不将其导入钥匙圈?
Answers:
查看OpenPGP关键数据时,可以得到几个详细级别:基本摘要,该摘要的机器可读输出或单个OpenPGP数据包的详细(非常技术性)列表。
对于OpenPGP密钥文件的简要介绍,您只需将文件名作为参数或管道数据通过STDIN传递。如果未传递任何命令,则GnuPG会尝试猜测您要执行的操作-对于关键数据,这将在密钥上打印摘要:
$ gpg a4ff2279.asc
gpg: WARNING: no command supplied. Trying to guess what you mean ...
pub rsa8192 2012-12-25 [SC]
0D69E11F12BDBA077B3726AB4E1F799AA4FF2279
uid Jens Erat (born 1988-01-19 in Stuttgart, Germany)
uid Jens Erat <jens.erat@fsfe.org>
uid Jens Erat <jens.erat@uni-konstanz.de>
uid Jens Erat <jabber@jenserat.de>
uid Jens Erat <email@jenserat.de>
uid [jpeg image of size 12899]
sub rsa4096 2012-12-26 [E] [revoked: 2014-03-26]
sub rsa4096 2012-12-26 [S] [revoked: 2014-03-26]
sub rsa2048 2013-01-23 [S] [expires: 2023-01-21]
sub rsa2048 2013-01-23 [E] [expires: 2023-01-21]
sub rsa4096 2014-03-26 [S] [expires: 2020-09-03]
sub rsa4096 2014-03-26 [E] [expires: 2020-09-03]
sub rsa4096 2014-11-22 [A] [revoked: 2016-03-01]
sub rsa4096 2016-02-24 [A] [expires: 2020-02-23]
通过设置--keyid-format 0xlong
,将打印长键ID而不是不安全的短键ID:
$ gpg a4ff2279.asc
gpg: WARNING: no command supplied. Trying to guess what you mean ...
pub rsa8192/0x4E1F799AA4FF2279 2012-12-25 [SC]
0D69E11F12BDBA077B3726AB4E1F799AA4FF2279
uid Jens Erat (born 1988-01-19 in Stuttgart, Germany)
uid Jens Erat <jens.erat@fsfe.org>
uid Jens Erat <jens.erat@uni-konstanz.de>
uid Jens Erat <jabber@jenserat.de>
uid Jens Erat <email@jenserat.de>
uid [jpeg image of size 12899]
sub rsa4096/0x0F3ED8E6759A536E 2012-12-26 [E] [revoked: 2014-03-26]
sub rsa4096/0x2D6761A7CC85941A 2012-12-26 [S] [revoked: 2014-03-26]
sub rsa2048/0x9FF7E53ACB4BD3EE 2013-01-23 [S] [expires: 2023-01-21]
sub rsa2048/0x5C88F5D83E2554DF 2013-01-23 [E] [expires: 2023-01-21]
sub rsa4096/0x8E78E44DFB1B55E9 2014-03-26 [S] [expires: 2020-09-03]
sub rsa4096/0xCC73B287A4388025 2014-03-26 [E] [expires: 2020-09-03]
sub rsa4096/0x382D23D4C9773A5C 2014-11-22 [A] [revoked: 2016-03-01]
sub rsa4096/0xFF37A70EDCBB4926 2016-02-24 [A] [expires: 2020-02-23]
pub rsa1024/0x7F60B22EA4FF2279 2014-06-16 [SCEA] [revoked: 2016-08-16]
提供-v
或-vv
将添加更多信息。不过,在这种情况下,我更喜欢打印包装的详细信息(请参见下文)。
GnuPG还具有以冒号分隔的输出格式,该格式易于解析且格式稳定。该格式在GnuPG的证明doc/DETAILS
文件。接收此格式的选项是--with-colons
。
$ gpg --with-colons a4ff2279.asc
gpg: WARNING: no command supplied. Trying to guess what you mean ...
pub:-:8192:1:4E1F799AA4FF2279:1356475387:::-:
uid:::::::::Jens Erat (born 1988-01-19 in Stuttgart, Germany):
uid:::::::::Jens Erat <jens.erat@fsfe.org>:
uid:::::::::Jens Erat <jens.erat@uni-konstanz.de>:
uid:::::::::Jens Erat <jabber@jenserat.de>:
uid:::::::::Jens Erat <email@jenserat.de>:
uat:::::::::1 12921:
sub:-:4096:1:0F3ED8E6759A536E:1356517233:1482747633:::
sub:-:4096:1:2D6761A7CC85941A:1356517456:1482747856:::
sub:-:2048:1:9FF7E53ACB4BD3EE:1358985314:1674345314:::
sub:-:2048:1:5C88F5D83E2554DF:1358985467:1674345467:::
sub:-:4096:1:8E78E44DFB1B55E9:1395870592:1599164118:::
sub:-:4096:1:CC73B287A4388025:1395870720:1599164118:::
sub:-:4096:1:382D23D4C9773A5C:1416680427:1479752427:::
sub:-:4096:1:FF37A70EDCBB4926:1456322829:1582466829:::
从GnuPG 2.1.23开始,gpg: WARNING: no command supplied. Trying to guess what you mean ...
可以通过将该--import-options show-only
选项与--import
命令一起使用来省略警告(--with-colons
当然,也可以在不使用的情况下使用该警告):
$ gpg --with-colons --import-options show-only --import a4ff2279
[snip]
对于较旧的版本:警告消息印在STDERR上,因此您只需阅读STDIN即可将主要信息与警告分开。
无需安装任何其他软件包,您可以使用gpg --list-packets [file]
来查看有关文件中包含的OpenPGP数据包的信息。
$ gpg --list-packets a4ff2279.asc
:public key packet:
version 4, algo 1, created 1356475387, expires 0
pkey[0]: [8192 bits]
pkey[1]: [17 bits]
keyid: 4E1F799AA4FF2279
:user ID packet: "Jens Erat (born 1988-01-19 in Stuttgart, Germany)"
:signature packet: algo 1, keyid 4E1F799AA4FF2279
version 4, created 1356516623, md5len 0, sigclass 0x13
digest algo 2, begin of digest 18 46
hashed subpkt 27 len 1 (key flags: 03)
[snip]
该pgpdump [file]
工具的工作原理类似,gpg --list-packets
并提供类似的输出,但是将所有这些算法标识符解析为可读的表示形式。它可能适用于所有相关发行版(在Debian衍生产品上,该软件包的名称pgpdump
类似于工具本身)。
$ pgpdump a4ff2279.asc
Old: Public Key Packet(tag 6)(1037 bytes)
Ver 4 - new
Public key creation time - Tue Dec 25 23:43:07 CET 2012
Pub alg - RSA Encrypt or Sign(pub 1)
RSA n(8192 bits) - ...
RSA e(17 bits) - ...
Old: User ID Packet(tag 13)(49 bytes)
User ID - Jens Erat (born 1988-01-19 in Stuttgart, Germany)
Old: Signature Packet(tag 2)(1083 bytes)
Ver 4 - new
Sig type - Positive certification of a User ID and Public Key packet(0x13).
Pub alg - RSA Encrypt or Sign(pub 1)
Hash alg - SHA1(hash 2)
Hashed Sub: key flags(sub 27)(1 bytes)
[snip]
--list-packets
?
--list-packets
。
WARNING: no command supplied
对stderr 的这种丑陋?(这阻碍了gpg
在脚本中的正确使用。当涉及加密时,唯一安全的方法是将任何输出到stderr的错误视为致命错误。只有这样,当发现新的重要弱点(仅打印到stderr时),您才能做好准备。)
--list-keys
,如gpg --no-default-keyring --keyring=/tmp/<keyfile> --list-keys
。或者简单地丢弃警告消息,在(ba)sh脚本中有很多选项可以过滤stderr。
我似乎能够简单地相处:
$gpg <path_to_file>
像这样的输出:
$ gpg /tmp/keys/something.asc
pub 1024D/560C6C26 2014-11-26 Something <something@none.org>
sub 2048g/0C1ACCA6 2014-11-26
运营商没有特别指定与哪些关键信息相关。此输出是我所关心的。
要验证并列出密钥的指纹(不先将其导入密钥环),请键入
gpg --with-fingerprint <filename>
编辑:在Ubuntu 18.04(gpg 2.2.4)上,上述命令未显示指纹。使用该--with-subkey-fingerprint
选项
gpg --with-subkey-fingerprint <filename>
gpg --with-fingerprint
,我无法打印指纹。Ubuntu 18.04gpg (GnuPG) 2.1.18
--with-subkey-fingerprint
应在Ubuntu 18.04上运行的信息的答案
您也可以使用--keyid-format
switch显示短键ID或长键ID:
$ gpg2 -n --with-fingerprint --keyid-format=short --show-keys <filename>
输出如下(来自PostgreSQL CentOS回购密钥的示例):
pub dsa1024/442DF0F8 2008-01-08 [SCA] │
Key fingerprint = 68C9 E2B9 1A37 D136 FE74 D176 1F16 D2E1 442D F0F8 │ honor-keyserver-url
uid PostgreSQL RPM Building Project <pgsqlrpms-hackers@pgfoundry.org> │ When using --refresh-keys, if the key in question has a preferred keyserver URL, then use that
sub elg2048/D43F1AF8 2008-01-08 [E]
pgpdump
(https://www.lirnberger.com/tools/pgpdump/)是可用于检查pgp块的工具。
它不是用户友好的,但是相当技术性,
pgpdump -p test.asc
New: Secret Key Packet(tag 5)(920 bytes)
Ver 4 - new
Public key creation time - Fri May 24 00:33:48 CEST 2019
Pub alg - RSA Encrypt or Sign(pub 1)
RSA n(2048 bits) - ...
RSA e(17 bits) - ...
RSA d(2048 bits) - ...
RSA p(1024 bits) - ...
RSA q(1024 bits) - ...
RSA u(1020 bits) - ...
Checksum - 49 2f
New: User ID Packet(tag 13)(18 bytes)
User ID - test (test) <tset>
New: Signature Packet(tag 2)(287 bytes)
Ver 4 - new
Sig type - Positive certification of a User ID and Public Key packet(0x13).
Pub alg - RSA Encrypt or Sign(pub 1)
Hash alg - SHA256(hash 8)
Hashed Sub: signature creation time(sub 2)(4 bytes)
Time - Fri May 24 00:33:49 CEST 2019
Hashed Sub: issuer key ID(sub 16)(8 bytes)
Key ID - 0x396D5E4A2E92865F
Hashed Sub: key flags(sub 27)(1 bytes)
Flag - This key may be used to certify other keys
Flag - This key may be used to sign data
Hash left 2 bytes - 74 7a
RSA m^d mod n(2048 bits) - ...
-> PKCS-1
不幸的是它没有读stdin:/
pgpdump
读物stdin
。例如,curl -s https://www.theguardian.com/pgp/PublicKeys/Guardian%20Application-Security.pub.txt | pgpdump
工作正常。
要获取密钥ID(8个字节,16个十六进制数字),这是在GPG 1.4.16、2.1.18和2.2.19中对我有用的命令:
gpg --list-packets <key.asc | awk '$1=="keyid:"{print$2}'
要获取更多信息(除了密钥ID):
gpg --list-packets <key.asc
要获取更多信息:
gpg --list-packets -vvv --debug 0x2 <key.asc
命令
gpg --dry-run --import <key.asc
该版本也可在所有3个版本中使用,但在GPG 1.4.16中,它仅打印短(4字节,8位十六进制数字)密钥ID,因此识别密钥的安全性较低。
在其他的答案有些命令(例如gpg --show-keys
,gpg --with-fingerprint
,gpg --import --import-options show-only
)不工作在一些上面的3个GPG版本,因此他们瞄准GPG的多个版本时,不便于携带。