PGP Public keys

You may find below a list of public PGP keys you may use to communicate with INCIBE-CERT. These keys are also available by Web Key Directory (WKD), so if your client supports it they can be automatically imported.

By using asymmetric cryptography, the public keys may be known by the public at large, which is then able to use it to encrypt emails directed to INCIBE-CERT and verify the authenticity of emails sent by INCIBE-CERT, whereas the content protected by such public key can only be decrypted by INCIBE-CERT.

CERT Contact (NON-incidents)

You can verify the contents of this file by loading the key into your keyring, and issuing the command:

$ gpg -k cert@incibe-cert
pub   ed25519 2026-10-15 [SC] [expires: 2027-06-16]
      EA67BC1DB2188CCA031E5340A6B3EEDAE4EE38CE
uid           [ultimate] INCIBE-CERT Team (2026-2028) <cert@...>
sub   cv25519 2026-10-15 [E] [expires: 2028-10-14]
sub   ed25519 2026-10-15 [S] [expires: 2028-10-14]

Download the public key (cert.pub or cert.asc) for email

General Incidents (Enterprises and Individuals)

You can verify the contents of this file by loading the key into your keyring, and issuing the command:

$ gpg -k incidencias
pub   ed25519 2026-10-15 [SC] [expires: 2028-06-15]
      6C320267EE405E26360EFB7064B84182ADBCF2B7
uid           [  full  ] INCIBE-CERT incidents (2026-2028) <incidencias@...>
sub   cv25519 2026-10-15 [E] [expires: 2028-06-15]
sub   ed25519 2026-10-15 [S] [expires: 2028-06-15]

If you require further information or you have any question, you could contact us by

Download the public key (incidencias.pub or incidencias.asc) for email

Critical Infrastructures Incidents

You can verify the contents of this file by loading the key into your keyring, and issuing the command:

$ gpg -k pic
pub   ed25519 2026-10-15 [SC] [expires: 2028-06-15]
      EE920102391C09E1FB4245F10B91460EE61E7906
uid           [  full  ] INCIBE-CERT for critical infrastructures (2026-2028) <pic@...>
sub   cv25519 2026-10-15 [E] [expires: 2028-06-15]
sub   ed25519 2026-10-15 [S] [expires: 2028-06-15]

If you require further information or you have any question, you could contact us by

Download the public key (pic.pub or pic.asc) for email

CERT contact for Digital Service Providers (NON-incidents)

You can verify the contents of this file by loading the key into your keyring, and issuing the command:

$ gpg -k servicios
pub   ed25519 2026-10-15 [SC] [expires: 2028-06-15]
      AC56ACB8B8ADF4C85BF94EFE079050829385E00F
uid           [  full  ] INCIBE-CERT services (2026-2028) <servicios@...>
sub   cv25519 2026-10-15 [E] [expires: 2028-06-15]
sub   ed25519 2026-10-15 [S] [expires: 2028-06-15]

If you require further information or you have any question, you could contact us by

Download the public key (servicios.pub or servicios.asc) for email

INCIBE-CERT CNA contact

You can verify the contents of this file by loading the key into your keyring, and issuing the command:

$ gpg -k cve-coordination
pub   rsa4096 2025-05-09 [SC] [expires: 2027-05-19]
      2F76A1196716D957D6885F7CD1DCFF0DA141BDFD
uid           [ultimate] Spanish National CNA (2025-2027) <cve-coordination@...>
sub   rsa4096 2025-05-09 [E] [expires: 2027-05-19]

Download the public key (cve-coordination.pub or cve-coordination.asc) for email