Security
This page documents the cryptographic keys and methods I use. For encrypted communication, see the contact page.
Key files and tools are also available on GitHub: mrpg/security.
GnuPG key
My primary cryptographic key is managed with GnuPG. It is used for email encryption and for signing other keys and files.
| Key ID | 0x1636BA9B |
|---|---|
| Fingerprint | A09A92FC5015EE861A7098511999861C1636BA9B |
| Algorithm | Ed25519 (signing), Cv25519 (encryption), Kyber (encryption) |
This key may be used with all my email addresses. Recent versions of Thunderbird support email encryption out of the box. This server also has Web Key Directory (WKD) enabled, so compliant email clients can discover the key automatically.
-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEXiQ2gxYJKwYBBAHaRw8BAQdAe486pBdti/gJHMqGnKAgX+5K2CiYJGZ6ONHA G8Q31ni0Hk1heCBSLiBQLiBHcm9zc21hbm4gPG1AbWF4LnBtPoiRBBMWCAA5AhsD AheAFiEEoJqS/FAV7oYacJhRGZmGHBY2upsFAmnSArMECwkNBwIiAgQVCgkIBRYC AwEAAh4HAAoJEBmZhhwWNrqbg2cA/1U1KQ/t/wUqwx7X655rJcfw7YO34e15bzcm qzIZ28KIAPwIN8GykyIIJynnGr+9rSGEo55Ysq1sjWob64htw9bEDIkCMwQQAQgA HRYhBOI7Ce4GBUInw84KjgAE4VxOEr95BQJeJDlIAAoJEAAE4VxOEr95RpMP/0Mp Ngiklmcqs0rvYyh1Yv/EyCqmSA4vJ06hhv+kfDXc4Ayc2uvtLTn4CNwIpjTI3mbe +R8FDnnldhRXuNHc6e9J6G4R/zcbaLLYRApX8YB4RiDKI0vp2E9WNr8THzKLCkAd 2SAaAdv5c1NfdEZu3W9N4Ki2QJIgq95F16eHvg12SRkP1LcBuyVd4KIr8xm/6K/u AOq8YJwzgspGsQGNBC7ttGNqYGLXD1S4tJ3jALxVnvAvk32OcZXYa6xgI3V4rBYL fePunDV0pF5VyIbV/+mfhrTS3aFGh1ywuP1q50Fiuc/B20sevlpyYsE7pvO/XIeD 941CfmwE4Pdl6rhTADRFTasXuE5BhgJk8NmMrnq7fN7mk4ssw3qQXdwxqFoxcCBE a2hRBWV3RpxmXkMXAY7QXHMr5sEV0P0GugrGlr9sutXXYYlAgm/L8N/8X+4JI796 m/E1nc94mxZx87RERmuKmeM6Nt/Lz/WSvWA6vzkOSgyyC6YnH9Mi4s2ZlVN5O2pt mKuP//DvISd+PNx934XfENgH+I5rWt+ftlHpZPSdCIyDe+oC4qxccieX3SE2gX0D EpZlDuUqh826Pi+UIj9JUhQHIr4vaaK8ZOAR9MIyX0E1PA5yPigzTRbMPr5whRI+ NUxDPjzWKyGqXRDcDRx82DQUeePkwDjslmEJQ1xruDgEXiQ2gxIKKwYBBAGXVQEF AQEHQMRFCdiwQ/SkphEslSmg2TNp8vDM9QkYYrLB0LJ2zEpZAwEIB4h4BBgWCAAg FiEEoJqS/FAV7oYacJhRGZmGHBY2upsFAl4kNoMCGwwACgkQGZmGHBY2upuBtwEA 9Sx9td+orI+VHu9QfrV0qw8unIS1MWQi+94PeKYGYH0BAO9Kr/xs0GTjB/1zaeQw C5zo7NvMJjeMlAFlSuGdJgkBuQZsBWnM2bgIAAAGYgMrZW8Bv2jRarHoAOR4zXiW /HLl+0PUgMkfzh3ANx3Nn9awppsusiGq/eeayR7VWA9yzt8v3op6baZfOa9CAAAG IDL7qCm7ctJcg9fVud0zOQc7N/Cwm0pqgxxJklOmgBXBUsjSNBaisJNnLIVLASq1 fa8ivzQ8KT3wKX2ioSZMaH3IVBVUOs/Xu66Coj3pS1/4P7yMBkKFl6AsxKZoMkAM bicEGKFDfF12CHqByFKCw5EYJeeMFWp1W4arVf4Lcv4EJhPgVf1AhPUTn/DBjjNy yDmbw8cZEL8oszYKSNXjdnJ4AKGhg3omsSILmvilP77GMTyCmLSoFAtpgrWAWGuT VS8lOtsUnq7yZnSGV9gsCg1rjWpypuw6ecYxGmwqTtfUvf+lV0/gkvIWXSRWNfdA VETBpu4lVKDhmTl2dZpGVLj5FDHDt7/wXXH0CLIUtx6xjWzWhegbvrcUANs2JWvb zseDvcVqD/uIUrULlmhiDKmACQYWn3LZZ9CVZQPKTuQWHC54Tr24tu6IFYIceQkr a7ZzFKK7Gi/3YUmkMttmzYIKRIixAx+btQLZyvakuyuIEwPbeRkDyzyUuH0oXGRl VLbjJPyIHBNHSSXYiW13Zy/hATZyesI4zXhqxp81sJVXek00USdDzKJXGq+UvnKh Yiv0IjzpaHjCnSyXdncsDC2ppU/BYmkhJZYAWdkynfg4bFmBZthsbHvLLGkqSeQa FWESvhopdfRsG6c4AvIgDOuGU4RyHD1XYkGFLPpFYh3jMjgcfwLopjBgnp3bPhzA RzX5Yackk1YkaXr1MWjbdvyDDFmDQq4gZeW7GibQRCNcOi2FvF5rzNO4CRQKHr3a ik+br+HTzQFmFPi7lLDaFTCLvDyBluqwofXDbFPiRWZwINZTi+oMmj+GoLzQT6Kp BS5zAsBGFy7lrX+XeUKTOYDaJWosGjuBhXiqvt6coZxznWJGlsdXZfqiKdZ0Lgyc EEoJGGj0kbAFM0brjJCVdD9iBXvLtA8xJJQqc7EIiO92iTHUUk0Via8UTXRVFcCE vd4JV5kwhGIsWwPoHegcfAtryIgsZxP8ZF5MeUvnI2CoM0SYlU5kji12oZaikw+Q nPZmyFNyPC1QtflBROSiMbYgAdb2VroLvTU3Ht3CGXwyu4AgeNLgHxAwtmOLNVVI ngMwvk/DYKfYFAjBrnc1CMcDGdYFWtombUjrPT4rpFrXD7+Yuzu3l9+ZD6YZr4sz ZUeAVuGDCTtbXh4IURGjywJHI/jbtroTXCLmyFlbsfcJeuBlSiIHD+ATiwLMzzYM ryLJmoGBzrxChoqVSR1RlY6KdxfIaQ2iGqxDl3VbI2wETHlZfJK3HSwqgjOyN4eR B/D8CGkjYjMyck1wQy5YAu1LIKxLKvvDfLtwA3lLaGHGqpXJRW4qTVR0Z/MLUIrs J3RBl/W7uWE6y7TitLtTd4ATqMuqjt1svisZZ7/wm4QQR56XyAc1Vh5AsNccdqbM HuHAQ30LVMrSXOY2tRBRRrYDVQxzqC2huxK4QEylKnxSa/FrNjXnfGvRxarIiMGG QpqUJ+mapp2kqdzLmo4ERUsicoWYEfiLJih1iInrJTz3Y5cBNnaMT67KzC+MFzVb Vwe4NqWwICUIpStrvqj4dh9KAV2UY+rZhMY1qivmzAgbBSqgJs5MUEAMwr4anwuI MQLIdQeLrPT3d45WE/D1iMhhappjXKongRPZOVqVdgsTfyuIPjGstkoDlxvmFFCi QEGXL96JX106xwXYjpH5sVpkDp8mZDT3Tq2GqzlYLCR2BkdgU+Oqmy/cYkqzfMoJ cO2RCf1mqNjVqSnDMleSz/dgrwZyqnnEABQVx6YxONBazHiIHN70eKHwk1VpMwDQ yGGUEuqAqMdlJvtQlFm2En9ryQThVwZ1XNdVxL90ac5qe05rxU+Ea0PqUGBQXIX3 X7lCn9AMArikG3bHS7NUV22EG/d8tU8RTCpKwuH6purWtjdFy6U5a3GRp24lVJbJ vHFjw3uTTaQkxKFhEEbxy/xYk65orgkFDKN3P488OmkycPyZMPLagNvKkBZGcxqk Sr1Vl2VmSFnDFpdnR/08wAARb2wyw3Y2zCm2Rom7Es6kZXViQpUxoal0qsGiaEeF bO+ka98wyJGhACKsEj2XoCcw4O24G+vNQOs32CnqoTQwiJQEGBYIADwWIQSgmpL8 UBXuhhpwmFEZmYYcFja6mwUCaczZuBsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMSwy LDICGwwACgkQGZmGHBY2upuStwD/WXx3QLhsd86Y1E0KnO9MSrqlzMP8TzbmbTSG gduJzd8A+QHzqKjUPlrwSNpgoxr+ABcTTFfLfdOIry+mkszvD/8L =Bubh -----END PGP PUBLIC KEY BLOCK-----
Post-quantum signature keys
SLH-DSA is the post-quantum signature scheme I currently prefer. I retain my earlier Dilithium key for compatibility.
Both keys below are used for digital signatures, not for encryption.
| Item | SLH-DSA (preferred) | Dilithium |
|---|---|---|
| Public key | slhdsa-2026.pem | dilithium-2026.pem |
| Algorithm | SLH-DSA-SHAKE-256s FIPS 205; NIST security category 5 | Dilithium-8x7-r3 Round 3; NIST security level 5 |
| Purpose | Detached file signatures | Detached file signatures |
| Tool | botan-slhdsa-signing | botan-dilithium-signing |
| Example file | hello.txt | hello.txt |
| Signature | hello.txt.botansigh | hello.txt.botansig |
Authenticating the public keys
Both public keys have detached signatures made with my GnuPG key. Download the public key and its .sig file, then verify it explicitly:
gpg --verify slhdsa-2026.pem.sig slhdsa-2026.pem
gpg --verify dilithium-2026.pem.sig dilithium-2026.pemThe detached signatures are slhdsa-2026.pem.sig and dilithium-2026.pem.sig. If you trust the GnuPG key identified above, a successful check authenticates the post-quantum public key.
Verifying post-quantum signatures
SLH-DSA (preferred), using botan-slhdsa-signing:
./verify.sh -p slhdsa-2026.pem hello.txt.botansighDilithium, using botan-dilithium-signing:
./verify.sh -p dilithium-2026.pem hello.txt.botansigThe verifier exits with status 0 and prints nothing when the signature is valid.
Browser-based encryption
The contact page offers an in-browser encryption tool powered by a fork of OpenPGP.js. Messages are encrypted locally in your browser using my GnuPG public key before being sent. No plaintext ever leaves your device.