E.1 Public keys

We maintain multiple keys, stored with different levels of security due to being used in different ways. See section E.2 below for details.

The keys we provide are:

Snapshot Key

Used to sign routine development builds of PuTTY: nightly snapshots, pre-releases, and sometimes also custom diagnostic builds we send to particular users.

Release Key

Used to sign manually released versions of PuTTY.

Secure Contact Key

An encryption-capable key suitable for people to send confidential messages to the PuTTY team, e.g. reports of vulnerabilities.

Master Key

Used to tie all the above keys into the GPG web of trust. The Master Key signs all the other keys, and other GPG users have signed it in turn.

The current issue of those keys are available for download from the PuTTY website, and are also available on PGP keyservers using the key IDs listed below.

Master Key

RSA, 4096-bit. Key ID: 4096R/04676F7C (long version: 4096R/AB585DC604676F7C). Fingerprint: 440D E3B5 B7A1 CA85 B3CC  1718 AB58 5DC6 0467 6F7C

Release Key

RSA, 2048-bit. Key ID: 2048R/B43434E4 (long version: 2048R/9DFE2648B43434E4). Fingerprint: 0054 DDAA 8ADA 15D2 768A  6DE7 9DFE 2648 B434 34E4

Secure Contact Key

RSA, 2048-bit. Main key ID: 2048R/8A0AF00B (long version: 2048R/C4FCAAD08A0AF00B). Encryption subkey ID: 2048R/50C2CF5C (long version: 2048R/9EB39CC150C2CF5C). Fingerprint: 8A26 250E 763F E359 75F3  118F C4FC AAD0 8A0A F00B

Snapshot Key

RSA, 2048-bit. Key ID: 2048R/D15F7E8A (long version: 2048R/EEF20295D15F7E8A). Fingerprint: 0A3B 0048 FE49 9B67 A234  FEB6 EEF2 0295 D15F 7E8A