PGP — UID Disclose

What it is for

Everything you upload to the platform travels over TLS and is visible only to the parties of the case; reporting or coordinating a disclosure does not need PGP.

PGP is for content that must not exist in the clear anywhere, not even on our servers, or for checking that something was signed by us:

Reporting a vulnerability in the UID Disclose platform itself.
Sending sensitive evidence (a PoC, test credentials, data of an affected party not yet on the platform) without leaving it in plain text.
Verifying the signature on an announcement or a reply from the team.

Our key

Fingerprint

A1B2 C3D4 E5F6 0718 2939 4A5B 6C7D 8E9F A0B1 C2D3

Key ID

0x6C7D8E9FA0B1C2D3

Compare the fingerprint character by character with what your gpg shows. It is the only thing that guarantees you are encrypting to us and not to someone who uploaded a key with our name to a keyserver.

The public key block is published on this page before launch. Until then the fingerprint above is the only reference, and the steps below describe the procedure that will apply.

Encrypting a message, step by step

1

Import the key

With gpg installed (it ships with almost every Linux distribution; Gpg4win brings it on Windows, GPG Suite on macOS), load our key into your keyring straight from this page:

curl -fsSL https://uid-disclose.com/pgp/uid-disclose.asc | gpg --import

Or, if you already downloaded the .asc file:

gpg --import uid-disclose.asc

2

Verify the fingerprint

Print the fingerprint of the key you just imported:

gpg --fingerprint A1B2C3D4E5F6071829394A5B6C7D8E9FA0B1C2D3

It must be exactly A1B2 C3D4 E5F6 0718 2939 4A5B 6C7D 8E9F A0B1 C2D3. If a single character differs, do not use it.

3

Encrypt (and sign, if you like)

Encrypt the file to our fingerprint. --armor produces text you can paste anywhere; --sign adds your signature, so we know the message is yours and was not altered. The result lands in reporte.txt.asc:

gpg --encrypt --sign --armor --recipient A1B2C3D4E5F6071829394A5B6C7D8E9FA0B1C2D3 reporte.txt

To encrypt a short text without a file, run this, type the message and finish with Ctrl+D:

gpg --encrypt --armor --recipient A1B2C3D4E5F6071829394A5B6C7D8E9FA0B1C2D3

4

Send it

Paste the whole block, from -----BEGIN PGP MESSAGE----- to -----END PGP MESSAGE-----, into a Support and suggestions ticket (you need an account; the editor has a code block so the formatting survives). Only the team can read the ticket, and only whoever holds the private key can read the content.

Open a support ticket

If you want an encrypted reply, include your own public key in the message (or its fingerprint and where to fetch it).

Without a command line

Any OpenPGP client does exactly the same: import the key, verify the fingerprint, encrypt. Usual options:

Windows: Gpg4win (includes Kleopatra).
macOS: GPG Suite.
Linux: Kleopatra or Seahorse, on top of the system's gpg.
Android: OpenKeychain.
Thunderbird has OpenPGP built in (Account Settings → End-To-End Encryption).

Verifying a signature of ours

A signed notice from us comes in one of two forms. With a detached signature (an .asc file next to the original):

gpg --verify aviso.txt.asc aviso.txt

Or as clear-signed text (it starts with -----BEGIN PGP SIGNED MESSAGE-----):

gpg --verify aviso.asc

It must say Good signature and the fingerprint must be the one on this page. A WARNING: This key is not certified only means you have not signed our key with yours; it does not invalidate the signature.

Good practice

Encrypt the attachments too, not just the body of the message.
Never send a private key or a passphrase, yours or anyone's.
Delete the plain text once the ciphertext is sent, and keep it out of your shell history.
If the message includes a PoC, say which system it applies to and whether you already reported it through another channel.
Distrust any key bearing our name whose fingerprint does not match the one here, wherever it comes from.