Home » Questions » Computers [ Ask a new question ]

When using GPG key generation does signing the key compromise anonymity?

When using GPG key generation does signing the key compromise anonymity?

After running gpg --gen-key to make a key for file encryption. Eventually I get to this part:

Asked by: Guest | Views: 720
Total answers/comments: 2
Guest [Entry]

"The UID (your name/email pair) is not related to encryption or signing, it is merely a label for others to know who owns this key. When signing or encrypting, only 64-bit key IDs are stored in the message. You also can have multiple UIDs on a single key (most people use a single key for all their mailboxes).

If you only encrypt a file but do not sign it, then your key ID won't be stored anywhere in the encrypted data. Only the recipient key IDs will be present.

But if you sign a file, then you'll be shown as its signer."
Guest [Entry]

"Short answer:
Yes, this has the potential to compromise anonymity.

Of course there is no need to enter your real name or email adress in the key.

The userID will be in the public part of your key. This part has a good chance to get public (therefor the name ""public key"").

To understand and mitigate the risks you should do some reading on how GPG works, before using it in a setting that needs really anonymity."