Let's talk about distributing the keys! Someone's public key is needed when you want to send that person
an encrypted message
or to check the digital signature of the key owner.
Ideally you distribute your public key by personally giving it to your correspondents.
In practice, however, keys are often distributed by email which is good practice
when you have only a few correspondents.
But if you have many correspondents it's easier to post your public key on a Web site.
This is unacceptable however if people who need your public key do not know where to find it on the
web. To solve this problem
Public Key servers are used to collect and distribute public keys. A public key received by this server
is added to the servers database
and when a key request comes to the server the server consults its database and returns the requested
Public Key if found.
Let’s see how it works. Imagine you've just downloaded the Centos ISO and a digital signature files and
you want to check the signature. To do that
you need the public signing key of Centos
and on the official website you've found out its id. Your next logical step is to import the key with
that id from a key server; and by execute the gpg--key server the name of the key server
pgp.mit.edu--recv from receive and the key id; found the key id
on the Centos Web site; perfect.
The public signing key of Centos was imported in the keyring
It's in the keyring.
Now if you want to publish your public key on a key server, where everyone can find it, you simply execute
gpg--keyserver
hkp:// and the domain of the key server pgp.mit.edu --
send-keys and the key id.
Let's see in another terminal what's the key id
this is my key id; copy and paste here.
Okay sorry,
there is a mistake,
the name of the key server is pgp.mit.edu
not gpg
This is its name; my public key was published on the key server pgp.mit.edu is one of the
most used public key servers in the world.
There are also other public key servers and most of them belong to a pool of key servers that gets synchronized.
That means that when you publish your key on a server, after a while, the key will be automatically copied
on all other servers in the pool and the request to any of the servers will get the key.
Note that there is also a graphical interface that can be used to submit a new public key or to search
for an existing key using its id; pgp.mit.edu and I can paste here
my public key id; the id of the key I've just submitted
and the key is already on the server.
Let's see the key.
This is the public key.
I want to check that's the same key that is stored locally
let's list the key
so gpg --export -- armor and the key id.
Okay.
This is the public key
and we notice it's the same key.
Here in the search box
don't forget to prefix the key id with 0x, which comes from hexadecimal. That's all about the gpg key
management
for the moment.
Thank you.