Confusing usage of formatted/compact fingerprints in key listings
Open, Needs TriagePublic

Assigned To
None
Authored By
• ikloecker
Mon, Oct 19, 12:08 PM

Description

Using gpg (GnuPG) 2.5.25-beta27 one gets compact fingerprints by default:

$ gpg -k rfc-9980-gnupg-sample-1
pub   ietf27 2026-09-03 [SC] [expires: 2029-09-02]
      1620EB12B7A8EE2D38CD1834ABD1CF0E094A44D30C73ECA6A198089705116D37
uid           [ unknown] rfc-9980-gnupg-sample-1
sub   mlk1024_np521 2026-08-28 [E]
      3838F412C21DF580C7B8A316BE850C3F26684FC713FEE9801D4D1227294DD094
sub   mlk768_np384 2026-08-28 [E]
      175BCF4EA2AC9C2C35809D071B2549C9DB1898878863D12D374C5A0C794F0AFE
sub   mlk1024_bp512 2026-08-28 [E]
      D56E2B801D217D01601AE80CCB146655004B3EB7F8329DBE59EF8C081E5EB41E
sub   mlk768_bp384 2026-08-28 [E]
      B416466A0828115F0DC503A3FC7BA4A9A29D89ED12B7C16792237428619C5F51

If one adds --with-fingerprint then one gets the formatted (and truncated) fingerprints. I had to look into the source code to find out how to get formatted fingerprints.

$ gpg -k --with-fingerprint rfc-9980-gnupg-sample-1
pub   ietf27 2026-09-03 [SC] [expires: 2029-09-02]
      1620E B12B7 A8EE2 D38CD 1834A BD1CF 0E094 A44D3 0C73E CA6A1
uid           [ unknown] rfc-9980-gnupg-sample-1
sub   mlk1024_np521 2026-08-28 [E]
      3838F 412C2 1DF58 0C7B8 A316B E850C 3F266 84FC7 13FEE 9801D
sub   mlk768_np384 2026-08-28 [E]
      175BC F4EA2 AC9C2 C3580 9D071 B2549 C9DB1 89887 8863D 12D37
sub   mlk1024_bp512 2026-08-28 [E]
      D56E2 B801D 217D0 1601A E80CC B1466 55004 B3EB7 F8329 DBE59
sub   mlk768_bp384 2026-08-28 [E]
      B4164 66A08 28115 F0DC5 03A3F C7BA4 A9A29 D89ED 12B7C 16792

That compact fingerprints are used by default is likely the result of changing the default of --with-subkey-fingerprint to true because gnupg's print_fingerprint has this code:

if (!opt.fingerprint && !opt.with_fingerprint
    && opt.with_subkey_fingerprint)
  compact = 1;

I suggest to get rid of the formatted fingerprints if they are not used anymore by default.

By the way, this ticket is triggered by a bug report for libkleo where Mr. Kousidis complains that "OpenPGP v6 fingerprints [are] truncated to 50 hex characters". I have implemented this to mimic the behavior of gpg and I was very surprised when I noticed that gpg doesn't use formatted (and truncated) fingerprints anymore (by default) in the normal -k output. As response to Mr. Kousidis report I will remove the truncation of v5/v6 fingerprints in Kleopatra.