Mailing List Archive

[newbie] GnuGP without keyring???
Howdy. I am hoping there is a solution to my problem via GnuPG so here
goes. . .

I realize that the whole concept of a "keyring" makes sense for a single
user but in a multi-user scenario it seems bass-ackwards. What I would
like to be able to do is have a user upload their public key and then,
without having to add their key to a keyring do something like:

data | ggp -e -usingkey /home/someuser/some_public_key | mail someuser

The idea is that the user uploads their own public key and we use it to
send them form output from a webserver. The whole goal here is to make
sure that the data is not accessible while in transit and since the user is
only encrypting data to be sent back to themselves, having it on a central
keyring is pointless and cumbersome. With multiple web servers you would
have to have multiple keyrings and there is not really anything gained by
adding their key to some arbitrary keyring first. All the user cares about
is that if some miscreant gets hold of their data along the way that it is
unreadable.

Is this possible with current gpg implementations?

Thanks for any feedback or suggestions.
-----------------------------------------------------------------------------
Island Net AMT Solutions Group Inc. Telephone: 250 383-0096
1412 Quadra Toll Free: 1 800 331-3055
Victoria, B.C. Fax: 250 383-6698
V8W 2L1 E-Mail: support@islandnet.com
Canada WWW: http://www.islandnet.com/
-----------------------------------------------------------------------------
Re: [newbie] GnuGP without keyring??? [ In reply to ]
On Thu, 27 May 1999, Ron Brogden wrote:

> I realize that the whole concept of a "keyring" makes sense for a single
> user but in a multi-user scenario it seems bass-ackwards. What I would
> like to be able to do is have a user upload their public key and then,
> without having to add their key to a keyring do something like:

You should realize that this scheme is vunerable to a man in the middle
attack - it is entirely possible for an active attacker to substitute the
PGP key before it hits the server then intercept the encrypted reply. This
is why gpg has a trust mechanism. If you don't have a specially prepared
and trusted keyring then you have to establish trust for each key
seperately.

However, if you still what to do that then I'm guessing it is fairly
simple to do just by manipulating the keyring options, perhaps:

cat KeyMaterial | gpg --no-default-keyring --keyring /tmp/trash --import --with-colons

Extract the key fingerprint of the imported key then do an encrypt
operation using similar options

Jason
Re: [newbie] GnuGP without keyring??? [ In reply to ]
Jason Gunthorpe <jgg@wakko.deltatee.com> writes:

> cat KeyMaterial | gpg --no-default-keyring --keyring /tmp/trash --import --with-colons

you don't need the --import operation at all in your case:

$ gpg --dearmor <KeyMaterial >keyring.tmp
$ gpg --no-default-keyring --keyring ./keyring.tmp --always-trust \
-r 0x`gpg --with-colons ./keyring.tmp | cut -d : -f 5 |head -1` \
-ea -o - file-to-encrypt | mail address

I think this should work if (the first key from Keymaterial is used).

--
Werner Koch at guug.de www.gnupg.org keyid 621CC013