Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

At the moment, I'm trying to check the fingerprint of the oracle_vbox.asc key that I downloaded from they provide the key and the fingerprint but no instructions for reviewing this information myself.

How do I show the fingerprint of the key I just downloaded?

apt-key finger oracle_vbox.asc shows the fingerprints of all trusted keys, which isn't what I want.

share|improve this question
This question appears to be abandoned and unanswered, could you perhaps add more detail to your question? If this question no longer applies then you can either delete it or answer it yourself if you've solved the problem. Thanks! –  Tachyons Apr 5 '12 at 18:16
Btw, this question is not that specific to Ubuntu (i.e. checking a fingerprint of an .asc file comes up all the time on all Linux/Unix-like systems), thus I suggest to consider placing such kind of questions on in the future (-> larger target audience). –  maxschlepzig Jun 14 '12 at 22:37

2 Answers 2

up vote 7 down vote accepted
$ wget
$ gpg --with-fingerprint oracle_vbox.asc 
pub  1024D/98AB5139 2010-05-18 Oracle Corporation
                      (VirtualBox archive signing key) <>
      Key fingerprint = 7B0F AB3A 13B9 0743 5925  D9C9 5442 2A4B 98AB 5139
sub  2048g/281DDC4B 2010-05-18
share|improve this answer
Is there an analogous command without using gpg? I mean, in SSH, I can do cat ./ | awk '{print $2}' | base64 -d | md5sum and it will return me an MD5 hash which is equal to the fingerprint hash of ssh -lf ./ Is there a similar way to do it with GPG public keys? –  user3019105 Sep 13 at 9:16
@user3019105, no, there is not. The format of a PGP public key is a little bit more complicated. See RFC 4880 and the GPG source code for details. –  maxschlepzig Sep 13 at 9:58
The RFC says (about MD5 deprecated fingerprints): The fingerprint of a V3 key is formed by hashing the body (but not the two-octet length) of the MPIs that form the key material (public modulus n, followed by exponent e) with MD5., can't I get this MPIs' body given an ASCII Armor (Radix-64) public key file? –  user3019105 Sep 13 at 10:06
@user3019105, you can. You can duplicate what is already implemented in GPG. But such a command line would be quite more elaborate than the one you've posted for an ssh public key. Thus, it wouldn't be analogous. –  maxschlepzig Sep 13 at 10:13
Ok thanks, but I still need to find out how to get the body of the MPIs that form the key material the RFC talks about –  user3019105 Sep 13 at 10:19

You have both the key and the fingerprint? Run ssh-keygen -l against the key to get the fingerprint

share|improve this answer
ssh-keygen doesn't recognize "oracle_vbox.asc" as a public key file. –  Amanda Jun 13 '11 at 22:09
my mistake, the command should be "ssh-keygen -lf" Do you still get a nerror? –  mvario Jun 13 '11 at 22:30
This does not work. –  maxschlepzig Jun 14 '12 at 22:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.