PGP Keys

My cryptographic identity. Verify files signed by me, or send me something only I can read.

Fingerprint FD1D92D0BBDECFC68A38DFA5CE80388E059210F4

Identity

My fingerprint: FD1D92D0BBDECFC68A38DFA5CE80388E059210F4

Download my public key

curl -L https://csral.dev/pgp.asc -o pgp.asc
Purpose

This fingerprint belongs to [email protected], Csral.

Use this key to verify files signed by me or send encrypted messages/files.

Verification

Execute the following commands in the same directory as pgp.asc.

Step 1 · Import key

gpg --import pgp.asc

Step 2 · Verify fingerprint

gpg --fingerprint [email protected]
Expected result

The fingerprint returned by GPG should exactly match the fingerprint shown on this page.

If it does not match, do not trust the imported key.

Remove the imported key:

gpg --delete-key [email protected]

Using the displayed fingerprint is preferred.

Verifying signature

It is possible that the files/content I share may be replaced with a malicious one. If I sign a message/file/content, you can verify if the files were tampered by checking my signature against my public key.

If the file contains my signature

gpg --verify file

If a .sig file was provided

gpg --verify file.sig file
Expected result

GPG: Good signature by [email protected].

If gpg reports a bad signature, the file or signature was modified, corrupted, mismatched or tampered. Do not trust the file regardless.

If my public key was not imported, GPG would still say Good signature and provide the fingerprint of sign holder and you can compare the fingerprints.

Encrypting messages

You can use my public key to encrypt messages/files using my public key which only I can read.

To encrypt file:

gpg -e --recipient FD1D92D0BBDECFC68A38DFA5CE80388E059210F4 <file>

Alternatively you can use "[email protected]" instead of my fingerprint but prefer fingerprints.

It is a good practice to sign the encrypted file with your private key. To sign file:

gpg --detach-sign <file>

Now send both the .sig file and the encrypted file.

To sign the file and then encrypt it:

gpg -se --recipient FD1D92D0BBDECFC68A38DFA5CE80388E059210F4 <file>

The only difference between detached signing and this method is that when using this method, the signature exists within encrypted file and the file must first be decrypted and then signatures are to be verified.

Trusting my keys

Owner trust should only be assigned to people whose judgement you trust. By assigning trust, you are saying that you believe they correctly verify the identities of others before signing keys.

Do not assign ultimate trust unless the key belongs to you.

Signing my keys

Validating/Certifying my keys is fundamentally different from trusting them. I strongly recommendnot signing my key unless you personally know me and can vouch for certain that the fingerprint and public key obtained absolutely belongs to [email protected].

You can certify my keys by signing it with your private key. It is equivalent to you saying "This fingerprint belongs to [email protected] and I personally guarantee it". You don't imply "maybe", you imply certainty much similar to a promise.

Only sign the keys of people who you personally know and can vouch that this fingerprint belongs to this person.

Status

Status: Active

Expires: 2028-06-22

Revocation certificate: Generated

Csral