A short key id and a long key id

Keys and signatures

Two abbreviations of a fingerprint, one eight characters long and one sixteen, both taken from its end.

The shape

These are not separate identifiers with rules of their own. Each is a slice of the fingerprint, cut from the right hand end, and everything about their appearance follows from that.

The optional 0x at the front is a convention borrowed from the way hex numbers are written generally. It announces the base rather than adding to the value, so a string with the prefix and the same string without it refer to the same thing. When counting, ignore it; when comparing two ids where only one carries it, ignore it there too.

Short form

eight hex characters

Long form

sixteen hex characters

Source

the final characters of the fingerprint, in the same order

Optional prefix

0x is sometimes written in front and is not part of the value

Case

either; upper case is more usual in print

Spacing

normally none, though the long form is occasionally split into fours

Fixed part

nothing; every character is inherited from the fingerprint

Where the digits come from

Set the three side by side and the relationship is visible without explanation.

0123456789ABCDEF0123456789ABCDEF01234567  fingerprint, 40
                        89ABCDEF01234567  long id, 16
                                01234567  short id, 8

Read downward and each line throws away the left hand part of the line before it. That is the entire mechanism. There is no computation, no separate value and no additional information at any step; there is only less of what was already there.

The consequence is worth stating as a fact about the format rather than as counsel. The short form commits to eight of the forty characters that describe a key. Thirty two characters are absent from it, and the format contains no rule reserving a short id to one key. An identifier that leaves most of itself out is an identifier that distinguishes less.

What each form keeps

The three lengths can be set out as a plain arithmetic of what is carried and what is left behind.

Nothing in that table is a measurement of security and it is not offered as one. It is a description of what each string contains, taken from the format itself, and it is enough to explain why the three are not interchangeable when somebody quotes one at you.

It also explains a habit you will notice. Listings and message footers print the short form because it fits on a line beside other text, and printed conveniently is the reason it exists. Convenience of display and strength of identification are unrelated properties, and here they pull in opposite directions.

How to check it by eye

What a wrong shape means

Seven characters or nine is the usual fault and it comes from a selection that started or stopped in the wrong place, which is easy on a string with no internal landmarks. A count of twelve or twenty means somebody cut a fingerprint at a point the format does not use.

A string of the right length containing a letter beyond F is not a key id that went wrong; it is something else that happens to be eight or sixteen characters long, and short runs of alphanumeric text are common enough that coincidence is the first explanation to reach for. Tokens of that size are covered at a captcha token.

A key id that fails to line up with the end of a fingerprint you hold means the two describe different keys, or that one of them was copied from somewhere you have forgotten. Both happen.

There is one error of direction that is easy to make and hard to notice. The id comes from the right hand end of the fingerprint, and somebody producing one by hand can take the leading characters instead of the trailing ones. The result is the correct length, drawn from the correct alphabet, and belonging to no key id at all. The only way to catch it is to line the string up against the fingerprint and see which end it agrees with, which is why the eye check above puts the two under one another rather than reading them separately.

What a correct shape does not prove

This is the shape where the distance between passing and meaning is at its greatest, and it is worth being blunt about it.

• A short id that agrees with one you were given establishes that eight characters agree. The remaining thirty two of the fingerprint took no part in the comparison.
• The format sets no rule preventing two different keys from carrying the same short id, so agreement is not a unique match by construction.
• The id is an index, not a name. It states nothing about who made or holds the key.
• A key id printed under a message is text typed into a page, exactly like the message.
• A long id is longer, and longer is not the same as sufficient. It is still a fragment of a fingerprint that this site does not hold, publish or compare.

Everything a key id does, the full fingerprint does with more of itself present, and the full fingerprint is limited too.

What this card is not

The value these are cut from is described at a key fingerprint. Where an id sits at the foot of a signed document, the layout around it is at a clear signed message. The general thesis about short identifiers standing in for long ones is at what a shape proves.