The current issue of those keys are available for download from the PuTTY website, and are also available on PGP keyservers using the key IDs listed below. RSA, 4096-bit. Key ID: 4096R/04676F7C (long version: 4096R/AB585DC604676F7C). Fingerprint: 440D E3B5 B7A1 CA85 B3CC 1718 AB58 5DC6 0467 6F7C
RSA, 2048-bit. Key ID: 2048R/B43434E4 (long version: 2048R/9DFE2648B43434E4). Fingerprint: 0054 DDAA 8ADA 15D2 768A 6DE7 9DFE 2648 B434 34E4
RSA, 2048-bit. Main key ID: 2048R/8A0AF00B (long version: 2048R/C4FCAAD08A0AF00B). Encryption subkey ID: 2048R/50C2CF5C (long version: 2048R/9EB39CC150C2CF5C. Fingerprint: 8A26 250E 763F E359 75F3 118F C4FC AAD0 8A0A F00B
RSA, 2048-bit. Key ID: 2048R/D15F7E8A (long version: 2048R/EEF20295D15F7E8A). Fingerprint: 0A3B 0048 FE49 9B67 A234 FEB6 EEF2 0295 D15F 7E8A
The various keys have various different security levels. This section explains what those security levels are, and how far you can expect to trust each key.
E.2.1 The Development Snapshots key The Development Snapshots private key is stored without a passphrase. This is necessary, because the snapshots are generated every night without human intervention, so nobody would be able to type a passphrase.
The snapshots are built and signed on a team member's home computers, before being uploaded to the web server from which you download them.
Therefore, a signature from the Development Snapshots key DOES protect you against:
•People tampering with the PuTTY binaries between the PuTTY web site and you.
•The maintainers of our web server attempting to abuse their root privilege to tamper with the binaries.
But it DOES NOT protect you against:
•People tampering with the binaries before they are uploaded to our download servers.
•People tampering with the build machines so that the next set of binaries they build will be malicious in some way.
•People stealing the unencrypted private key from the build machine it lives on.
Of course, we take all reasonable precautions to guard the build machines. But when you see a signature, you should always be certain of precisely what it guarantees and precisely what it does not.
The Releases key is more secure: because it is only used at release time, to sign each release by hand, we can store it encrypted.
The Releases private key is kept encrypted on the developers' own local machines. So an attacker wanting to steal it would have to also steal the passphrase.
E.2.3 The Secure Contact Key The Secure Contact Key is stored with a similar level of security to the Release Key: it is stored with a passphrase, and no automated script has access to it.