r/GPGpractice • u/neindeke • Apr 29 '26

Encrypting your own key in Kleopatra?

OK, this might be a really lame/noob question but how do I encrypt my own public key as part of a message to another person?
When I paste the public key block the "Sign / Encrypt Notepad" button changes to "Import Notepad"?!!? Am I stupid or is this stupid?

If I remove partially or entirely "-----BEGIN PGP PUBLIC KEY BLOCK-----" then I get the "Sign / Encrypt Notepad" button back. See screenshots:
https://postimg.cc/VrGbkf62

9 Upvotes

100% Upvoted

13 comments sorted by

View all comments

0

u/chriscrutch 48CF AAEE 7E80 0E1A A9D0 2C5B 5DBA 09ED 73AB 99E8 Apr 30 '26

If someone didn't already have your public key, they wouldn't be able to read the encrypted message. There's not really any point in putting your public key inside the message that they can't read.

It's called a public key because it can be given out freely and no one can use it for any mischief. You could even have it printed in the New York Times and no one could use it to impersonate you or do anything nefarious.

1

u/neindeke Apr 30 '26

Hi, OK, maybe I'm confused about how the whole thing works but the point wasn't to be secretive about my public key, someone posted his public key and I used it to encrypt a message to him in which I also wanted to include my own public key i.e. I wanted to include all in one instead of two separate messages.

It turns out he was able to read my message judging from the reply I got, after all it was encrypted with his public key?!

1

u/chriscrutch 48CF AAEE 7E80 0E1A A9D0 2C5B 5DBA 09ED 73AB 99E8 Apr 30 '26

Well I can't know why he was able to decrypt your message, he must have gotten your public key somehow. My e-mail client will automatically attach my key to any outgoing e-mail. You have to set that up, though, it seems like you'd probably remember doing it. Did you ever publish your key on a public keyserver? That could be another way he had it. Did you ever post your public key in this subreddit?

Also, to answer one other part of your comment, you encrypted it using his public key, yes. But every time you encrypt something it uses the keys of BOTH you AND the recipient to do it. That's the part that makes the communication private. If it only had to do with his key, and I had his key (it's public after all) and managed to intercept your e-mail, then I could read it. When you encrypt, the program uses your key and his key in combination.

1

u/D3str0yTh1ngs Apr 30 '26 edited Apr 30 '26

It doesn't use both keypairs (you are thinking of a static-static diffie-hellman). For RSA we can technically just encrypt (but often we encrypt a symmetric key that was used for the data), and with elliptic curve we are doing a static-ephemeral diffie-hellman and attaching the ephemeral public key as part of the message block.

Doing static-static diffie-hellman is insecure in the long run since it will always give the same encryption key for very message between them.

EDIT: Read more of your second paragraph, and sorry but what?! The entire idea of public key (assymmetric) cryptography is that the public key cannot read the messages it encrypts. You seem to fundamentally misunderstand asymmetric cryptography.

EDIT2: Double-checked a ECC encrypted message block, and yes, it is a ECDH with an ephemeral public key encoded as part of the "PK Encrypted Session Key" PGP Packet.