Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At the moment, I'm trying to check the fingerprint of the oracle_vbox.asc key that I downloaded from http://www.virtualbox.org/wiki/Linux_Downloads: they provide the key and the fingerprint but no instructions for reviewing this information myself.

How do I show the fingerprint of the key I just downloaded?

apt-key finger oracle_vbox.asc shows the fingerprints of all trusted keys, which isn't what I want.

share|improve this question
    
This question appears to be abandoned and unanswered, could you perhaps add more detail to your question? If this question no longer applies then you can either delete it or answer it yourself if you've solved the problem. Thanks! – Tachyons Apr 5 '12 at 18:16
    
Btw, this question is not that specific to Ubuntu (i.e. checking a fingerprint of an .asc file comes up all the time on all Linux/Unix-like systems), thus I suggest to consider placing such kind of questions on unix.stackexchange.com in the future (-> larger target audience). – maxschlepzig Jun 14 '12 at 22:37
up vote 7 down vote accepted
$ wget http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc
$ gpg --with-fingerprint oracle_vbox.asc 
pub  1024D/98AB5139 2010-05-18 Oracle Corporation
                      (VirtualBox archive signing key) <info@virtualbox.org>
      Key fingerprint = 7B0F AB3A 13B9 0743 5925  D9C9 5442 2A4B 98AB 5139
sub  2048g/281DDC4B 2010-05-18
share|improve this answer
    
Is there an analogous command without using gpg? I mean, in SSH, I can do cat ./id_rsa.pub | awk '{print $2}' | base64 -d | md5sum and it will return me an MD5 hash which is equal to the fingerprint hash of ssh -lf ./id_rsa.pub. Is there a similar way to do it with GPG public keys? – user3019105 Sep 13 '15 at 9:16
1  
@user3019105, no, there is not. The format of a PGP public key is a little bit more complicated. See RFC 4880 and the GPG source code for details. – maxschlepzig Sep 13 '15 at 9:58
    
The RFC says (about MD5 deprecated fingerprints): The fingerprint of a V3 key is formed by hashing the body (but not the two-octet length) of the MPIs that form the key material (public modulus n, followed by exponent e) with MD5., can't I get this MPIs' body given an ASCII Armor (Radix-64) public key file? – user3019105 Sep 13 '15 at 10:06
    
@user3019105, you can. You can duplicate what is already implemented in GPG. But such a command line would be quite more elaborate than the one you've posted for an ssh public key. Thus, it wouldn't be analogous. – maxschlepzig Sep 13 '15 at 10:13
    
Ok thanks, but I still need to find out how to get the body of the MPIs that form the key material the RFC talks about – user3019105 Sep 13 '15 at 10:19

You have both the key and the fingerprint? Run ssh-keygen -l key.pub against the key to get the fingerprint

share|improve this answer
2  
ssh-keygen doesn't recognize "oracle_vbox.asc" as a public key file. – Amanda Jun 13 '11 at 22:09
    
my mistake, the command should be "ssh-keygen -lf" Do you still get a nerror? – mvario Jun 13 '11 at 22:30
2  
This does not work. – maxschlepzig Jun 14 '12 at 22:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.