Search code examples
c#bouncycastlepgpopenpgp

Can an OpenPGP public and private key pair can have different key ID (short key ID)?


Can an OpenPGP public and a private key pair, which can be used for encryption and decryption successfully, have different key IDs (short key IDs)?

What I have tried:

  1. I have used Bouncy Castle (C#) to get the short key id for a test OpenPGP public and private key pair provided to me, the key ID for the OpenPGP key pair always comes as the same.
  2. I have Checked on GPG4Win Kleopatra with the same observation.
  3. I have Gone through the PGP FAQ but could not get the answer.

It seems logical to have the same key ID for an OpenPGP key pair but is there any possibility/way to have different key IDs for a single key pair?

I need this information, as I need to save the OpenPGP key ID in the database table for the OpenPGP key pair.If it's the same, I can have only one column for storing the Key ID.


Solution

  • Public and Private Keys of a Key Pair Share Their Fingerprint

    RFC 4880, OpenPGP, 12.2. Key IDs and Fingerprints defines:

    A V4 fingerprint is the 160-bit SHA-1 hash of the octet 0x99, followed by the two-octet packet length, followed by the entire Public-Key packet starting with the version field.

    With other words, all fingerprints are calculated from the public key material only. Key IDs (both long and short) are derived from the fingerprint by cutting off the lower bytes.

    fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279
    long id:                                    4E1F 799A A4FF 2279
    short id:                                             A4FF 2279
    

    OpenPGP Short Key ID Collision Attacks

    Important note: short key IDs are vulnerable to collision attacks. When handling key IDs, especially for programmatic access and storing references to keys, never use short key IDs but the full fingerprint.