• caglararli@hotmail.com
  • 05386281520

Exact meaning of RSA key in `gpg –verify` output

Çağlar Arlı      -    11 Views

Exact meaning of RSA key in `gpg –verify` output

When verifying a pgp signed message using GnuPG, one gets an output similar to the following:

gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg:                using RSA key 610B4AFF906E6890EEDC797201E99CB6C034BC3B
gpg:                issuer "name@domain.com"
gpg: Good signature from "Some Person <name@domain.com>" [full]

Apart from GnuPG already showing the identity of the signee (public key is present in my keyring) and also the trust level, I would like to understand what exactly the line 'using RSA key ...' means, in particular considering the situation where I might not have the public key of the signee in my keyring, yielding the output

gpg: Signature made Fr 07 Jan 2022 13:42:21 CET
gpg:                using RSA key 610B4AFF906E6890EEDC797201E99CB6C034BC3B
gpg:                issuer "name@domain.com"
gpg: Can't check signature: No public key

I assume that this is the hash of the public RSA key that has been used to produce the signature (typically some signing subkey). So the question is:

How can I display these RSA keys, given that I have some public key in my GnuPG keyring?

The use case would be to look up those keys on a device where the public is available, and compare them by hand to associate the signature with some known key.


Maybe getting to a little bit more detail: In case a main key has different signing subkeys, I assume that the used RSA key shown will be different for these subkeys. So how can I find out which subkey has been used, i.e. display all available subkeys with their RSA hashes of some given public key (along with the subkeys)?