Getting started

Comparing the profile types

Regarding profile management

FeatureSignature profilesOpenPGP profiles
Identity claimsStored as textStored as OpenPGP notations
Graphical toolsYes → KleopatraNo
Command line toolsYes → GnuPGYes → GnuPG
GranularityMany different profiles per key pairOnly one profile per key pair

Regarding profile distribution

FeatureSignature profilesOpenPGP profiles
Direct methodYes → send textYes → send public key file
Via personal websiteYes → embed textYes → embed public key file
Via personal serverNoYes → upload using WKD
Via centralized serversNoYes → upload to keyservers
Distributed together with public keyNo (not yet)Yes → public key contains profile

Regarding anonymity

FeatureSignature profilesOpenPGP profiles
Real nameNot requiredNot required
Valid email addressNot requiredRequired when using keyservers

Regarding cryptography

FeatureSignature profilesOpenPGP profiles
SecuritySecured by cryptographySecured by cryptography
Choice of standardOnly OpenPGP (for now)Only OpenPGP

The advantages and drawbacks of signature profiles

Storing identity claims inside the public key as notations for OpenPGP profiles is a powerful method. Wherever the public key goes, so go the identity claims. This allows one to use the existing vast network of OpenPGP key sharing tools to also share these identity claims.

There are drawbacks to this: you lose granularity. You cannot pick and choose the identity claims you want to send to certain people or use for certain purposes. There is also the possibility that notations in public keys could be scraped as the keys are publicly available.

Putting (only certain) identity claims in a signature profile solves both drawbacks. You can choose which identity claims are to be associated with each other and you can choose which persons can see this by only sending it to them. You can even encrypt the signature profile! Since the signature profile is not publicly available (unless you make it so), there is no possibility to scrape the contents of it.

Note that there is one catch: the person you send your signature profile to could publish it. Only send identity claims you intend to keep secret to people you trust!

Content licensed under CC BY-NC-SA 4.0.
Last updated: 2022-09-28 15:50 UTC