How a fingerprint gets cut down to eight
A version 4 fingerprint is 160 bits, which writes out as forty hex characters. The short id keeps the last 32 of those bits and discards the other 128. Hex carries four bits per character, so 32 divided by 4 gives eight characters. That is the entire derivation.
There is no cleverness in the cut. It is not a summary of the fingerprint and not a hash of it. It is the tail, taken because a tail is trivial to take and because a short string fitted into printed key listings at a time when both the paper and the terminal were narrow.
So the eight is counted. Anybody who checks arrives at the same eight characters for the same key, and the working is one division. Whether those characters mean anything is a separate question, and the answer has been no for a long time.
What eight characters are still good for
One honest use survives. If you hold a keyring with a few dozen keys on it and you want to point at one of them in a command, the short id will do, in the way a file name will do inside a folder you control. It is a handle for something you already have.
That use comes with a condition attached: nothing arrived from outside. The moment a short id crosses a gap between two people it stops being a handle and starts being an assertion, and it cannot carry an assertion of any weight.
Everything else people ask of it belongs to the full fingerprint instead. Identifying a key you were sent, finding a key you have not met, deciding that two mentions of a key refer to the same key. None of those survive a value this small.
The year eight characters were cloned in bulk
In 2014 a project settled the question in the least arguable way available. It generated fresh keys until their short ids matched those of an enormous set of well known public keys, including the tightly connected core of the public web of trust, and then it published the clones together. The copies carried the same names and the same eight characters. Only the full fingerprints differed.
The work was not exotic and it was not expensive. Thirty two bits is around four billion possibilities, and hardware built to repeat one operation billions of times gets through that quickly. The point of publishing was to turn a circular argument about theory into a directory of duplicates that anybody could download and look at.
Two habits were the target and both are still common. The first is pasting a short id into a message as proof of identity. It proves nothing, and the counter example is now a public set. The second is searching a keyserver for a short id and taking the first result. A keyserver has no opinion about which key is right. It returns whatever matches, in whatever order it likes, including keys uploaded by strangers, because uploading has never required permission.
A third habit follows from those two. People read a match as confirmation. Two keys sharing a short id are not nearly the same key and not related keys. They are unrelated keys that happen to share a tail.
Why nothing is going to move the eight
The size is fixed by the definition, and no definition is going to be revised to enlarge a field that has been deprecated by convention. What moved instead was everything around it. Current OpenPGP implementations print full fingerprints by default, discourage or refuse lookups by short form, and treat the eight characters as a display convenience rather than as something to act on.
That is the real answer this page has to give. The number did not change. The practice around it did, and anybody still quoting eight characters is carrying a habit from a period when the arithmetic was harder than it is now.
If you want the same argument with a bigger number and the same conclusion, the sixteen page makes it. If you want the length that actually settles the question, it is forty, printed in ten groups of four when a person has to read it.
Questions people ask
Is the short id just the end of the fingerprint?
Yes, exactly that. It is the tail and nothing else, which is why it inherits none of the strength of the full forty.
My software still shows an eight character id. Is that a problem?
Not by itself, as long as you never act on it. Switch the display to full fingerprints where the option exists, so the thing in front of you is the thing worth comparing.
Why did the short id ever exist?
Terminal width and printed listings, at a time when key management happened in text output and every column was contested. The reason was practical and it expired.