At the moment, I'm trying to check the fingerprint of the oracle_vbox.asc key that I downloaded from http://www.virtualbox.org/wiki/Linux_Downloads: they provide the key and the fingerprint but no instructions for reviewing this information myself.

How do I show the fingerprint of the key I just downloaded?

apt-key finger oracle_vbox.asc shows the fingerprints of all trusted keys, which isn't what I want.


Get the key:

$ wget http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc

Print the key fingerprint with GPG version 1:

$ gpg --with-fingerprint oracle_vbox.asc 
pub  1024D/98AB5139 2010-05-18 Oracle Corporation
                      (VirtualBox archive signing key) <info@virtualbox.org>
      Key fingerprint = 7B0F AB3A 13B9 0743 5925  D9C9 5442 2A4B 98AB 5139
sub  2048g/281DDC4B 2010-05-18
      Key fingerprint = 27B0 97CF 8257 4209 C434  8D42 B674 8A65 281D DC4B

Note that the 2nd fingeprint is just the fingerprint of the sub-key.

Print the fingerprint with GPG version 2:

$ gpg2 -n -q --import --import-options import-show  oracle_vbox.asc   
pub   dsa1024 2010-05-18 [SC]
uid   Oracle Corporation (VirtualBox archive signing key) <info@virtualbox.org>
sub   elg2048 2010-05-18 [E]

Note that -n is an alias for --dry-run, i.e. the key isn't actually imported.

Alternatively, to just display the fingerprints:

$ gpg2 -nq --import --import-options import-show --with-colons oracle_vbox.asc \
     | awk -F: '$1 == "fpr" { print $10 }'
  • Is there an analogous command without using gpg? I mean, in SSH, I can do cat ./id_rsa.pub | awk '{print $2}' | base64 -d | md5sum and it will return me an MD5 hash which is equal to the fingerprint hash of ssh -lf ./id_rsa.pub. Is there a similar way to do it with GPG public keys? Sep 13 '15 at 9:16
  • 2
    @user3019105, no, there is not. The format of a PGP public key is a little bit more complicated. See RFC 4880 and the GPG source code for details. Sep 13 '15 at 9:58
  • The RFC says (about MD5 deprecated fingerprints): The fingerprint of a V3 key is formed by hashing the body (but not the two-octet length) of the MPIs that form the key material (public modulus n, followed by exponent e) with MD5., can't I get this MPIs' body given an ASCII Armor (Radix-64) public key file? Sep 13 '15 at 10:06
  • @user3019105, you can. You can duplicate what is already implemented in GPG. But such a command line would be quite more elaborate than the one you've posted for an ssh public key. Thus, it wouldn't be analogous. Sep 13 '15 at 10:13
  • 1
    This syntax does not work with GnuPG 2 anymore. It outputs: WARNING: no command supplied. Trying to guess what you mean .... Then, it lists the key without fingerprint. See my answer.
    – ominug
    Apr 22 '19 at 12:24

Step 1

$ deb http://download.virtualbox.org/virtualbox/debian artful contrib

Step 2

$ wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -

Step 3

$ apt-key list

or, equivalently,

$ apt-key finger

which should return

pub   rsa4096 2016-04-22 [SC]
      B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
uid           [ unknown] Oracle Corporation (VirtualBox archive signing key) <info@virtualbox.org>
sub   rsa4096 2016-04-22 [E]

which in turn should be equivalent to

The key fingerprint for oracle_vbox_2016.asc is

B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
Oracle Corporation (VirtualBox archive signing key) <info@virtualbox.org>

on https://www.virtualbox.org/wiki/Linux_Downloads, either by visual inspection or further command line fu.

Related links:

  • this question is missing some explanation... Aug 1 '18 at 7:24

This works with GPG 2 (at least I could check it with versions 2.1.18 and 2.2.12):

wget http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc
gpg_home=$(mktemp -d)
gpg --homedir "$gpg_home" --import oracle_vbox.asc
# gpg: keybox '/tmp/tmp.CHoWuJBy7N/pubring.kbx' created
# gpg: /tmp/tmp.CHoWuJBy7N/trustdb.gpg: trustdb created
# gpg: key 54422A4B98AB5139: public key "Oracle Corporation (VirtualBox archive signing key) <info@virtualbox.org>" imported
# gpg: Total number processed: 1
# gpg:               imported: 1
gpg --homedir "$gpg_home" --list-keys
# /tmp/tmp.CHoWuJBy7N/pubring.kbx
# -------------------------------
# pub   dsa1024 2010-05-18 [SC]
#       7B0FAB3A13B907435925D9C954422A4B98AB5139
# uid           [ unknown] Oracle Corporation (VirtualBox archive signing key) <info@virtualbox.org>
# sub   elg2048 2010-05-18 [E]

Source: https://unix.stackexchange.com/a/468889


You have both the key and the fingerprint? Run:

ssh-keygen -lf key.pub

against the key to get the fingerprint.

ssh-keygen reference: http://www.manpagez.com/man/1/ssh-keygen/

  • 3
    ssh-keygen doesn't recognize "oracle_vbox.asc" as a public key file.
    – Amanda
    Jun 13 '11 at 22:09
  • my mistake, the command should be "ssh-keygen -lf" Do you still get a nerror?
    – mvario
    Jun 13 '11 at 22:30
  • 4
    This does not work. Jun 14 '12 at 22:39
  • ssh-keygen -lf oracle_vbox_2016.asc oracle_vbox_2016.asc is not a public key file. Jun 30 '16 at 0:20
  • 2
    ssh-keygen is not for PGP keys.
    – Geoffrey
    Oct 28 '18 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.