Unable to add new PGPs

Gpg4win help-en
1

Hello,

Please help me. I am unable to add new Open PGPs because it keeps coming up with the users email as mrswarve1@protonmail.com automatically. I know these people are genuine. Is this normal because I have never had this happen to me on Kleopatra.

I have tried turning the PGPs into .asc files as suggested when researching online but this also does not work.

Can someone please help me? I really need to get this sorted tonight. Is it a block on my PC or something? I am doing everything correctly but the username always comes up as “mrswarve1” and the email as “mrswarve1@protonmail.com” which cannot be right.

Thank you in advance kind people :heart:

2

I am unable to add new Open PGPs

Do you mean, that you can’t import OpenPGP keys of others (public keys)?
Did you download them from a public source (like a keyserver), or from e-mails that you received, or …?

Which version of Kleopatra are you running (Help → About)

3

I can import them but the username and email are clearly incorrect. Every single one I have tried does the same thing.
I got the keys from people I have bought items from in the past but am using Telegram now.

Kleopatra: Gpg4win-5.0.2
Kleopatra: 782c464a9801d6189e3d3be494922f42857bd26c
GnuPG: 2.5.18
Libgcrypt: 1.12.1
KDE Frameworks: 6.20.0
Qt: Using 6.10.1 and built against 6.10.1
Windows 11 Version 25H2
Build ABI: x86_64-little_endian-llp64
Kernel: winnt 10.0.26200

No idea where that Kernel came from as that was not part of what I copied. Is is Kernel related?

4

I would also like to add that this has been happening on other PGP platforms I have tried which means there is something stopping me do anything.

5

Hi,

This is part of the operation system info, it is not shown in the GUI, but copied anyway. Not relevant here. We only needed the info “Gpg4win-5.0.2”.

What do you mean by PGP platforms?

If you import a public key and Kleopatra then shows that mail address associated with it, then this is correct. Did you know that a key can have several user-IDs (names and mail addresses)? Look in the key details (double click on key) to see all of them.

A word of warning: Anybody can create an OpenPGP key with any information. This is the reason why one needs to carefully verify that they belong to the person one believes before using them.

6

Hello,

When I say other programs, it means, I have tried to add them on other programs and the same thing happens.

I don’t think you realise what I am saying. There is something blocking me from adding PGPs and I have tried adding 5 which all come up with the same email address so why is that happening?

7

Because these public keys are “broken” or whatever, not the programs you try to use them with.

Try to import the gpg release signing keys from GnuPG - Signature Key, maybe that will convince you.

8

These worked. I am slightly confused though as I have used these vendors before and have not had an issue.

9

So you reckon these guys have turned into scammers?

10

Did you get the keys of these guys directly via email or Telegram message? Then it’s suspicious at least.
When the keys come from a public keyserver there is a chance that they might be corrupted.

11

Proton runs a Web Key Directory service, and using the command line, I can get a public OpenPGP key for this email address, like this:

gpg --locate-external-keys mrswarve1@protonmail.com
pub   ed25519 2023-02-06 [SC]
      A4E0C823E361D9D79624826C8893F4F5BCE1D150
uid           [ unknown] mrswarve1@protonmail.com <mrswarve1@protonmail.com>
sub   cv25519 2023-02-06 [E]

That seems to be the public OpenPGP key associated with that email address from proton.

But, of course someone cannot know, who is controlling the email address.
There maybe additional user IDs to the same public key somewhere out there (as was pointed out here in the discussion). However they will only get added, if you find a public key file that has those user IDs attached to it. From your description it seems that none of the public key files you have tried importing has the user IDs you were expecting. GnuPG seems to work fine then.

Thus I think you should be careful. You could send an encrypted email to the email address and ask the recipient something that may help you to gain trust that they are who you think they should be.