See more on Chunks in general.

External Keys come in two forms. A Definition exists somewhere else, not part of the archive. The archive contains a Reference to indicate that the key needs to be found.

External Key Material Reference

A key definition of this KEYD subtype is used to point to a External Key Definitionthat is to be found in a keyring file. A External Key Reference Chunk does not itself contain any key material or means to derive key material from other information. Rather, the implementation must find the reference External Key in order to proceed.

Ref Payload

The payload contains an lpstring holding the name of the external key. The name ought to be distinguishing, but it is not critical that it be unique.

Ref Implementation Notes

The implementation will try all external keys (that it knows about) with the matching name. The look-up process might involve prompting the user with the name, so the name is intended to be a human-readable string. For example, it may display “Please enter a filename for key %s\n” where %s is replaced by the name.

External Key Material Definition

A key definition of this KEYD subtype is used to name a key in a keyring file, so that it can be matched with an External Key Reference.

Def Payload

The payload is exactly the same as for the Reference. In fact, matching this string is the purpose of having it.

Ref Implementation Notes

The Instance Number of this chunk is used to look up another KEYD chunk in the same keyring file that contains this one. A chunk with the same Instance Number and a subtype in the range 64—127 (that is, a normal key definition record) is the key to use.



The archive file (or files, if it has multiple parts) forms a unit with repsect to the authentication rules. So, the External Key Ref is considered the origin key.

The keyring file is authenticated separately.

Add hrefs!

Valid HTML 4.01!

Page content copyright 2003 by John M. Dlugosz. Home:,