I run:

gpg --list-keys

I get:

pub   rsa1024 2014-01-26 [C]
uid           [ unknown] Totally Legit Signing Key <[email protected]>

Can this be dangerous? What is this? The address [email protected] is confusing.


1 Answer 1


The mallory keys were keys added to demonstrate that short key identifiers are easily spoofable. See this GnuPG discussion and this oss-sec post for details.

Unless you’re actively maintaining your OpenPGP web of trust, or validating OpenPGP signatures without checking the keys separately, you can ignore this.

  • By "checking the keys separately" you mean I should validate that I have the correct .asc files by downloading them from multiple sources? Maybe I don't understand your post.
    – Ohumeronen
    Feb 16 at 12:22
  • 1
    Essentially, if you care about the identity associated with a key, then you need to be able to validate that somehow. That used to be done using the web of trust (with caveats), nowadays it’s more about continuity — i.e. you obtain a key at some point, and that key continues to be used to sign artefacts for a long time. If you just download a file, its signature, and the key from the same place at the same time, then it doesn’t tell you anything more than a checksum from the same origin. Feb 16 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .