Where the forty comes from
A version 4 OpenPGP key has a fingerprint defined as a hash computed over the public key packet. That hash produces 160 bits of output. Hexadecimal writes four bits per character. One hundred and sixty divided by four is forty, and the number falls out with nothing left to decide.
The hash covers the key material and the creation time. It does not cover the name attached to the key, so two keys carrying identical names have different fingerprints, and the same key exported from three different machines has one fingerprint. Nothing about the value depends on where you obtained it.
Both short forms on this site are cut from here. Sixteen characters is the last 64 bits of it and eight characters is the last 32. Neither is a separate identifier. Each is this identifier with most of it thrown away.
ten groups of four, printed as two halves of five. A placeholder pattern, not a real fingerprint
What forty characters can settle, and how
One question, answered completely: is this the same key as the one I decided to trust earlier. That sounds narrow. It sits underneath nearly everything people worry about here. It is the check that decides whether a mars market address you were handed came from the people you think it came from.
An address arrives as a string, through a forum, a message, a search result or a directory, and every one of those routes can be edited by somebody who is not the source. If the address arrives inside a message signed by a key, and you already hold that key fingerprint from elsewhere, substitution is closed off. The message either verifies or it does not, and there is no middle result to interpret.
The procedure is short, and one step in it does all the work. Obtain the fingerprint from a source that is not the page you are about to check. Comparing a fingerprint against a copy printed on the same page you are verifying proves only that the author of the page was internally consistent, which a forger manages without effort.
- Get the fingerprint from a route independent of the one that delivered the address, and store it somewhere you will still have next month.
- Import the key and have your tool print its fingerprint. Compare all forty characters against your stored copy, in groups of four.
- Verify the signature on the message carrying the address. A verified signature ties that exact text to that exact key.
- Keep the stored fingerprint. Its value comes from being the same next time, not from having been checked once.
Notice what those four steps leave out. They contain no claim that the key belongs to anybody honest, and they contain no role for this site. A fingerprint obtained here would fail the first step, which is the reason no fingerprint is printed anywhere on these pages.
What people get wrong about the forty
The first error is verifying against the same source. Somebody lands on a page, reads an address, reads a fingerprint below it, sees that the two agree and feels finished. Nothing was checked. A page lying about the address prints a matching fingerprint underneath, because the same author wrote both fields.
The second is treating successful decryption as verification. A message that decrypts was encrypted to a key you hold. That is a fact about whoever encrypted it and it names nobody, since encrypting to a public key is what public keys are for and anybody can do it.
The third is expecting a fingerprint to certify character. It certifies continuity instead. A verified signature says this is the same key that signed the earlier thing, and if the earlier thing was a fraud then you have carefully confirmed that you are dealing with the same fraud. Continuity is worth a great deal and it is not trust.
What moves the forty
Key format versions, and only those. Version 4 keys produce this 160 bit value. Newer OpenPGP key versions define the fingerprint over a stronger hash with a 256 bit output, which prints as sixty four hex characters. A sixty four character fingerprint is not a typo and not a corrupted copy. It is a newer key.
Nothing a market does affects any of this. The length follows the key format, and the key format follows a published specification that moves on the scale of years rather than weeks.
The other thing that shifts is where you keep the value. A fingerprint stored on the same machine and in the same account as everything else shares whatever happens to that machine. Written down offline it survives more of the things that go wrong, which matters because the whole procedure depends on the stored copy staying honest.
Questions people ask
Where does the first fingerprint come from?
From a route separate from the one that delivered the address. The honest answer is that the first fingerprint anybody accepts is a leap. Everything after it is a comparison rather than a leap, which is the point of storing it.
Is a 64 character fingerprint wrong?
No. Newer key versions define a longer fingerprint over a stronger hash. Count the characters before assuming the copy is damaged.
Does a fingerprint tell me an address is working?
No, and nothing here does. Authenticity and availability are separate questions, and the second one is not answered on this site for the reasons on the zero page.