Forty hex characters, the reference page

This is the number the rest of the site points at. A version 4 OpenPGP key fingerprint is 160 bits, written as forty hexadecimal characters, and it is the only value published here that can answer a question about a person rather than about a format.

40 characters in a fingerprint Counted
Value
40 hex characters, which is 160 bits
Kind
Counted
Derived from
A hash over the public key packet, for version 4 keys
Changes with
Key format version. Newer keys use a longer fingerprint

Mars market addresses

Published, not monitored
mars24pas2vgwtr4drrsy7tlngevbvxyguejynnkeywibjzenet7knqd.onion
marsautbk3di5cj75eh4dakjjrngddnjwqfdltbq2sy6cf7unzkd2bad.onion
marsautkudspgk6j23cxdtrk36ae4fpis2eoe7izu5y2rsksvmfji2ad.onion

These three addresses are printed as given. This site does not test them, does not know whether any of them answers right now, and publishes no availability figure. An address that opens is not the same thing as an address that is genuine, which is what the forty character fingerprint is for.

Where the forty comes from

A version 4 OpenPGP key has a fingerprint defined as a hash computed over the public key packet. That hash produces 160 bits of output. Hexadecimal writes four bits per character. One hundred and sixty divided by four is forty, and the number falls out with nothing left to decide.

The hash covers the key material and the creation time. It does not cover the name attached to the key, so two keys carrying identical names have different fingerprints, and the same key exported from three different machines has one fingerprint. Nothing about the value depends on where you obtained it.

Both short forms on this site are cut from here. Sixteen characters is the last 64 bits of it and eight characters is the last 32. Neither is a separate identifier. Each is this identifier with most of it thrown away.

The printed shapeXXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX
ten groups of four, printed as two halves of five. A placeholder pattern, not a real fingerprint

What forty characters can settle, and how

One question, answered completely: is this the same key as the one I decided to trust earlier. That sounds narrow. It sits underneath nearly everything people worry about here. It is the check that decides whether a mars market address you were handed came from the people you think it came from.

An address arrives as a string, through a forum, a message, a search result or a directory, and every one of those routes can be edited by somebody who is not the source. If the address arrives inside a message signed by a key, and you already hold that key fingerprint from elsewhere, substitution is closed off. The message either verifies or it does not, and there is no middle result to interpret.

The procedure is short, and one step in it does all the work. Obtain the fingerprint from a source that is not the page you are about to check. Comparing a fingerprint against a copy printed on the same page you are verifying proves only that the author of the page was internally consistent, which a forger manages without effort.

  1. Get the fingerprint from a route independent of the one that delivered the address, and store it somewhere you will still have next month.
  2. Import the key and have your tool print its fingerprint. Compare all forty characters against your stored copy, in groups of four.
  3. Verify the signature on the message carrying the address. A verified signature ties that exact text to that exact key.
  4. Keep the stored fingerprint. Its value comes from being the same next time, not from having been checked once.

Notice what those four steps leave out. They contain no claim that the key belongs to anybody honest, and they contain no role for this site. A fingerprint obtained here would fail the first step, which is the reason no fingerprint is printed anywhere on these pages.

What people get wrong about the forty

The first error is verifying against the same source. Somebody lands on a page, reads an address, reads a fingerprint below it, sees that the two agree and feels finished. Nothing was checked. A page lying about the address prints a matching fingerprint underneath, because the same author wrote both fields.

The second is treating successful decryption as verification. A message that decrypts was encrypted to a key you hold. That is a fact about whoever encrypted it and it names nobody, since encrypting to a public key is what public keys are for and anybody can do it.

The third is expecting a fingerprint to certify character. It certifies continuity instead. A verified signature says this is the same key that signed the earlier thing, and if the earlier thing was a fraud then you have carefully confirmed that you are dealing with the same fraud. Continuity is worth a great deal and it is not trust.

What moves the forty

Key format versions, and only those. Version 4 keys produce this 160 bit value. Newer OpenPGP key versions define the fingerprint over a stronger hash with a 256 bit output, which prints as sixty four hex characters. A sixty four character fingerprint is not a typo and not a corrupted copy. It is a newer key.

Nothing a market does affects any of this. The length follows the key format, and the key format follows a published specification that moves on the scale of years rather than weeks.

The other thing that shifts is where you keep the value. A fingerprint stored on the same machine and in the same account as everything else shares whatever happens to that machine. Written down offline it survives more of the things that go wrong, which matters because the whole procedure depends on the stored copy staying honest.

Why no fingerprint is printed hereNothing on this site can serve as the independent source in step one. A site that publishes an address and the fingerprint meant to verify it has closed the loop on your behalf, and a closed loop proves nothing.

Questions people ask

Where does the first fingerprint come from?

From a route separate from the one that delivered the address. The honest answer is that the first fingerprint anybody accepts is a leap. Everything after it is a comparison rather than a leap, which is the point of storing it.

Is a 64 character fingerprint wrong?

No. Newer key versions define a longer fingerprint over a stronger hash. Count the characters before assuming the copy is damaged.

Does a fingerprint tell me an address is working?

No, and nothing here does. Authenticity and availability are separate questions, and the second one is not answered on this site for the reasons on the zero page.