Search code examples
digital-signatureverificationgnupg

How does one know when a GPG pubkey signature was created


I need to know when someone signed a key. I mean those key signatures displayed with --list-sig.

It seems they do not show the date of the signing. No information on if it's possible to verify them too.


Solution

  • This signature date is already listed:

    pub   8192R/0x4E1F799AA4FF2279 2012-12-25
    uid                            Jens Erat (born 1988-01-19 in Stuttgart, Germany)
    sig 3        0x4E1F799AA4FF2279 2012-12-26  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
    sig 3        0x4E1F799AA4FF2279 2012-12-25  Jens Erat (born 1988-01-19 in Stuttgart, Germany)
    sig 3        0xCBC2613CD745722B 2012-12-26  Jens Erat <email@jenserat.de>
    sig     P X  0xD2BB0D0165D0FD58 2012-12-26  CA Cert Signing Authority (Root CA) <gpg@cacert.org>
    [snip]
                                    ^^^^^^^^^^
                                    signature creation time
    

    You cannot take it for sure or even verify it, this is juts the date the signer claims to have signed the key on. The signature date can be arbitrarily set, for example by setting the system time or using the handy tool faketime.