[newbie] GnuGP without keyring???

Jason Gunthorpe jgg@wakko.deltatee.com
Thu, 27 May 1999 23:27:14 -0600 (MDT)


On Thu, 27 May 1999, Ron Brogden wrote:


> I realize that the whole concept of a "keyring" makes sense for a single
> user but in a multi-user scenario it seems bass-ackwards. What I would
> like to be able to do is have a user upload their public key and then,
> without having to add their key to a keyring do something like:
You should realize that this scheme is vunerable to a man in the middle attack - it is entirely possible for an active attacker to substitute the PGP key before it hits the server then intercept the encrypted reply. This is why gpg has a trust mechanism. If you don't have a specially prepared and trusted keyring then you have to establish trust for each key seperately. However, if you still what to do that then I'm guessing it is fairly simple to do just by manipulating the keyring options, perhaps: cat KeyMaterial | gpg --no-default-keyring --keyring /tmp/trash --import --with-colons Extract the key fingerprint of the imported key then do an encrypt operation using similar options Jason