Author: Joe Barr
Signing data allows others to verify two important things — first, that it was you who signed the data, and second, that it has not been altered in any way since you did.
Think about all of the email problems with viral epidemics, worms, and spam, which are rampant on the Internet. All of that could be prevented if only a certain monopoly had been willing to play nice with existing open standards for signing data. If it had, the Internet would be a different place today. Instead Microsoft insisted on doing things its own way — its proprietary and totally inadequate way — and the rest, as they say, is history. It’s clear why signing data — especially email — is important.
GnuPG provides several options and methods for creating signatures. When you sign a file, you’re creating a digital signature which is unique to the data being signed and your private key. Anyone who knows your public key can verify that your private key was used to create the signature — unless the data has been altered, that is.
Let’s say we have a family recipe stored in a plain text file named recipe. Here’s a simple command which creates a signed file containing both the signed data and the signature itself.
gpg -s recipe
GnuPG will respond with:
You need a passphrase to unlock the secret key for
user: "Your Name <your@name.com>"
1024-bit DSA key, ID FFFFFFFF, created 2002-07-11
Enter passphrase:
Once you’ve entered the passphrase, gpg creates the digital signature in a file called recipe.gpg. The original file — recipe — is unchanged. The new file you created contains both the recipe and the signature.
Reversing the process
Your secret key was needed to create a signature, but it’s not needed to verify it. Let’s say you email the signed file (recipe.gpg) to your Aunt Nadine. It contains your secret recipe for an avocado and jalepeno dip you call “Texas Heatwave.” Because you’ve signed the recipe, Aunt Nadine will know that it’s authentic, and not that bland and mild guacamole dip they make in Cleveland.
All Aunt Nadine needs in order to verify that you signed the data is your public key. Oh, and GnuPG of course. You might have sent her your public key at some time, or perhaps she grabbed it off a public key server like the one at subkeys.pgp.net. The point is, without your public key, she can’t do anything.
To verify the signed data, Aunt Nadine would enter the following command:
gpg recipe.gpg
Assuming all was well, GnuPG would reply:
gpg: Signature made Sat 10 Jul 2004 03:53:16 PM CDT using DSA key ID FFFFFFFF
gpg: Good signature from "Your Name <your@name.com7gt;"
In addition, gpg would decode (not decipher) the recipe file for Aunt Nadine, so it looks exactly as it did when you created it.
Why all the coding of the recipe in the first place? Not for secrecy. The -s option converts the data to a robust, highly transportable 7-bit format suitable for handling by almost every type of computer.
I can sign clearly now
There’s another way to sign the data that leaves the data being signed in its original format. Let’s try --clearsign instead of simply -s.
Enter this:
gpg --clearsign recipe
After you tell gpg your passphrase, it creates a new file called recipe.asc. It looks like this:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a simple text file. Unaltered since its creation.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFA8GbNbrn8Hc1vF2ARArLgAJ9ZKCiehZEQtoHkEmRwMVISMTZ5pQCghIEV
vgT77oWcZpg7uxuZHolIA4A=
=k3IT
-----END PGP SIGNATURE-----
Another way to do it
Let’s look at one more option for signing data by creating a detached signature. You can do it like this:
gpg -b recipe
or like this:
gpg --detach-sign recipe
The command above — after it gets the passphrase, naturally — creates a new file called recipe.sig. I decided to test how well it really checks for changes in the data, so I changed an “a” to “an” and tried to verify it using this command:
gpg recipe.sig
GnuPG responded with:
Detached signature.
Please enter name of data file: recipe
gpg: Signature made Sat 10 Jul 2004 06:11:31 PM CDT using DSA key ID FFFFFFFF
gpg: BAD signature from "Your name 7lt;your@name.com>"
Alright, that’s it for this week. Be sure to use man gpg when you have questions. It’s very long and detailed, so you might even want to print it for ease of reference. And thanks to weasel for his help with gpg this week.
