What is the point of a public key fingerprint?

Original Article ↗ Hacker News Discussion ↗

Public key fingerprints are explored as a practical way to verify you have the right encryption key without reading or comparing the entire, often very long, key itself. Commenters explain that a fingerprint is a short cryptographic hash of a public key that can be checked over alternate channels (like phone calls, business cards, or chat “safety numbers”) to defend against man‑in‑the‑middle attacks, and compare this model to approaches using TLS, DNS, or messaging apps such as Signal and Telegram. The conversation also highlights usability and security trade‑offs, such as how many characters are safe to compare, whether emojis or randomart help humans spot tampering, and how modern threats like deepfake voice make “out‑of‑band” verification harder.

PGP and Email Encryption in Practice

  • Several comments describe real-world PGP use in email (Apple Mail + GPG plugins, ProtonMail).
  • Usability is described as “almost seamless” once keys are exchanged, but ecosystem fragility (OS updates, plugin support) remains a pain point.

What Fingerprints Are For

  • Consensus: a fingerprint is a cryptographic hash of a public key, short enough to compare by hand yet strong enough to resist feasible collision attacks.
  • Common workflow: exchange keys over one channel (email, web) and verify the fingerprint over another (phone call, business card, etc.).
  • Used in business key exchanges and internal security practices (employees verifying each other’s fingerprints).

Key Distribution and Trust Models

  • Alternatives suggested: host keys over HTTPS, DNSSEC/DANE, TXT records, GitHub .keys, ENS, DNSCurve.
  • Critique: HTTPS is only as trustworthy as the weakest CA and adds third-party trust; some partners still require it.
  • Package managers rely on built-in distro keys; TLS is seen as defense-in-depth and for privacy.

Why a Hash Fingerprint vs Key Substring

  • Multiple comments explain that the key space is structured/sparse; raw key bytes don’t have as much usable entropy as a hash.
  • For RSA it’s “easy” to generate vanity keys with controlled byte patterns; hashes make that impractical.
  • ECC keys are harder to manipulate this way, but using a hash is still considered safer and more uniform.

Fingerprint Length, Collisions, and Human Checking

  • Example shows two SHA-256 values with matching prefixes and suffixes, illustrating danger of checking “just a few digits.”
  • Debate on how many digits matter; short checks (e.g., 4 hex chars) are deemed far too weak.
  • Humans are bad at manual comparison; suggestions include structured formatting, dynamic visual comparison, or software assistance.
  • Randomart is discussed and mostly dismissed as hard to share and not clearly better in practice.

Messaging Apps, Emoji Codes, and MITM

  • Telegram/Matrix-style emoji or numeric “safety numbers” are just alternative encodings of a shared secret or fingerprint.
  • Some confusion about Signal’s safety numbers and how to extract a personal fingerprint; behavior is described as under-documented.
  • Discussion of in-band vs out-of-band verification, and whether voice calls are robust against MITM given deepfake and voice-spoofing advances.

Critiques and Skepticism

  • Some argue that if you have a secure channel for the fingerprint you could just send the key, and see the article as restating basics.
  • Counterpoint: fingerprints are mainly about practicality and convenience, not secrecy, and are widely used (including in X.509 certificate checks and software-signature workflows).