On Thu, Dec 14, 2000 at 11:25:02AM -0800, Peter Jay Salzman wrote: > if there's a one to one and onto relationship between a public key and its > fingerprint, why do we deal with public keys at all? > > why not just deal with fingerprints and, as far as humans go, do away with > the public key altogether? I can memorize my fingerprint, but certainly not > my public key... > > puzzling! > Well first of all it's not 1-1 it's just mostly 1.1. Just like your VERY unlikely to ever find a file with the same MD5 checksum, but you can't just transmit the MD5 checksum instead of the file since there would be a loss of information. So a GPG is just a checksum of the larger key, it would be hard to spoof, but encrypting using it wouldn't provide the same protection. Keep in mind that non-symetric keys (i.e. public key) need many more bits/digits to provide the same protection as symetric keys. For instance www.distributed.net has had 30-50k machines working on breaking a 64 bit key for over 1000 days. Numbers get big quick...
