Sign in to follow this  

Checking cleanliness of openPGP keys

Recommended Posts

Hello all, I'm reading the documentation at and I'm not sure how to accomplish the following: My code will encrypt messages but not decrypt or sign them. This means I will not need anyone's private key. More to the point, I don't want anyone to give me their private key. When someone sends me a key file, I want to detect the presence of the private information and reject the key in this case, all without ever adding the key to the keychain. I expect that the 'secretimported' field of the returned array of gnupg_import will tell me this, but that requires temporarily adding the key to the chain. This is unacceptable since the key would me momentarilly visible to a seperate, compromised part of the site. Is there a way to scan the key without importing it?

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this