Verificar as chaves de um contato

Confirm that an encryption key belongs to the person you’re writing to by comparing its verification code with them.

End-to-end encryption protects a message from everyone between you and the recipient. Verification confirms that the key you encrypt to is really theirs. Aster calls a key’s fingerprint its Verification code.

Before you begin

• Choose a way to reach the person outside email, such as a phone call where you recognize their voice or a meeting in person. Someone who can swap a key can also change an email.
• Have your own verification code ready, because the other person may want to check yours too.

Find your verification code

1. Go to Settings > Security, and then select the Encryption tab.
2. In Encryption Keys, find your OpenPGP key and its Verification code.
3. Select Copy verification code, or read the code aloud to the other person.

Your verification code is public, so sharing it is safe.

Android

In the Aster Mail app, go to Settings > Encryption. Your Verification code appears under OpenPGP key in Encryption Keys. Tap the copy icon to copy it.

Check a contact’s key

1. Open Contacts and select the person.
2. In the contact’s details, look for PGP key found. Aster shows the key’s fingerprint and where it came from, such as Discovered via Web Key Directory.
3. Ask the person to read you their verification code, and compare the two character by character.
4. To see the full key, select View public key or Copy public key.

If the codes match, you have the right key. If they don’t, don’t send anything sensitive to that address until you find out why.

Aster finds keys through Web Key Directory, public keyservers, and Autocrypt. A key found automatically still deserves a check for anyone you exchange sensitive mail with.

If a key changes when you send

In the Aster Mail app for Android, when a recipient’s key differs from the one Aster found before, a dialog titled Encryption key changed appears before sending. It lists the old and new fingerprint for each affected address.

A new key is normal after someone resets their account or creates a new key, but it’s also what an interception attempt looks like.

1. Contact the person through another channel and ask whether they changed their key.
2. Compare the new fingerprint with the one they give you.
3. Tap Trust new key only after the fingerprints match.

If a sender’s key changes

When a sender’s encryption identity changes since your last exchange, the message shows a notice. Confirm the change with the sender another way before you trust the conversation.

On Android, the message shows an Encryption key changed banner. After you confirm the new key with the sender, tap I verified this to dismiss it.

Troubleshooting

• The contact shows No PGP key on file: Make sure Auto-discover recipient keys is on under Settings > Security > Encryption. If it’s on, the person may not publish a key. You can send them a password-protected message instead.
• The fingerprints don’t match: Don’t tap Trust new key. Ask the person to send you their public key through another channel.
• The key-change notice keeps appearing: The person may use several keys. Ask them which key is current.

Related articles

• How Aster encryption works
• Send an encrypted message to anyone
• Report phishing and spam