5

I'm trying to verify the PGP Signature of the latest version of KeePass 2.14's setup file against this signature, but this is the output I receive:

C:\Program Files (x86)\GNU\GnuPG>gpg.exe --verify C:\Users\User\Desktop\KeePass-2.14-Setup.exe
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

C:\Program Files (x86)\GNU\GnuPG>

I found this command here, but it made no mention about ".sig" or ".asc" files, so I figured I did something wrong. By reading the man pages, I further tried the following:

C:\Program Files (x86)\GNU\GnuPG>gpg.exe --pgpfile C:\Users\User\Desktop\KeePass-2.14-Setup.exe
gpg: Invalid option "--pgpfile"

C:\Program Files (x86)\GNU\GnuPG>

As you can see, the results are quite obfuscating...

I took a look at this on SuperUser, but none of the links seemed to really address my question, at least not directly enough for me to get any idea on how to move forward on this.

Can anybody here help me with the esoteric technicality of OpenPGP & the associated use of the GnuPG program? I've felt pretty dumb learning VBS, but this is beyond humiliating: it's absolutely debilitating and maiming whatever confidence I had with my IT skills (then again, I have no justification for making any boast either, as I have yet to get my A+ Cert, lol).


UPDATE 04-04-2011

Okay, so I got tired of fooling around with Windows and decided I'd do it right by booting up Ubuntu; this alone made things much more logical!

So here's my list of commands and where I'm at:

  1. proto@type:~$ cd Desktop/
  2. proto@type:~/Desktop$ gpg --import KeePass-2.14-Setup.exe.asc gpg: no valid OpenPGP data found. gpg: Total number processed: 0
  3. proto@type:~/Desktop$ gpg --import Dominik_Reichl.asc gpg: /home/proto/.gnupg/trustdb.gpg: trustdb created gpg: key FEB7C7BC: public key "Dominik Reichl " imported gpg: Total number processed: 1 gpg: imported: 1
  4. proto@type:~/Desktop$ gpg --verify KeePass-2.14-Setup.exe gpg: no valid OpenPGP data found. gpg: the signature could not be verified. Please remember that the signature file (.sig or .asc) should be the first file given on the command line.
  5. proto@type:~/Desktop$ gpg --verify KeePass-2.14-Setup.exe.asc gpg: Signature made Sun 02 Jan 2011 05:25:24 AM MST using DSA key ID FEB7C7BC gpg: Good signature from "Dominik Reichl " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 2171 BEEA D0DD 92A1 8065 5626 DCCA A5B3 FEB7 C7BC
  6. proto@type:~/Desktop$ gpg --verify Dominik_Reichl.asc gpg: verify signatures failed: unexpected data

As Mike instructed, I placed ".exe" & the ".asc" files in the same directory, that being the Desktop. As you can see in the code, I also placed the public key "Dominik_Reichl.asc" in the Desktop directory.

Please be patient with me, as I've been thoroughly spoiled by MD5; I'm assuming that Step 5 from above is the GPG equivalent to this:

C:\Users\user\>CD Desktop

C:\Users\user\Desktop>MD5Sum KeePass-2.14-Setup.exe
bae59065b24f0a6f2ed4bb9e0d6fc65f *KeePass-2.14-Setup.exe

I say this because the behavior changes whenever I move the "KeePass-2.14-Setup.exe" file into a "temp" folder on the Desktop. When I run the command this is the result I get:

proto@type:~/Desktop$ gpg --verify KeePass-2.14-Setup.exe.asc
gpg: no signed data
gpg: can't hash datafile: file open error

These results have lead me to believe that I'm supposed to extract the "DSA key ID" & the "Primary key fingerprint", from Step 5, and compare them to the values at the top of the Signature Page. So, is this where the similarity is at with MD5 verification? Is this all there is to it? Or is there a further step? Is there a command that I use to verify these two strings? Are those strings what I really need to check? What are those strings?



Now there's one other issue that I'm having to contend with. In the "Primary key fingerprint" results, I have 2 spaces between the "8065" and the "5626". When I use a spreadsheet to verify my results with the string on the Signature Page, I get a "FALSE" result because of the extra whitespace in my results. I checked the source of the Signature Page to see if the browser was ignoring the extra white space, but that's not the case.

2171 BEEA D0DD 92A1 8065 5626 DCCA A5B3 FEB7 C7BC    # From Source of Signature Page
2171 BEEA D0DD 92A1 8065  5626 DCCA A5B3 FEB7 C7BC    # From My Results

As long as I remove that extra whitespace, my results match with that from the Signature Page, but shouldn't they match without any intervention on my part? Should a difference in whitespace be cause for alarm?

Unfortunately, the GPG Man Pages are still quite obscure to me, or as some may put it "user-hostile" (search "user hostile gpg"), so I'll need a couple extra carrots tossed my way. I'll admit it: I'm dumb. In fact, when I was still learning how to use MD5 verification, I floundered around with it almost as much as I did with this.

1
  • Honestly what a rigmarole! Why could KeepassX developers not have just published a MD5 so that one could use ExactFile to check the downloaded installer. Apr 5, 2016 at 13:20

5 Answers 5

4

On the first command you provided you should be referencing the .asc signature file - not the .exe file. The .exe file should also be residing in the same directory as the .asc file.

From the gpg man page:

--verify
      Assume that the first argument is a signed file or a detached signature and verify it without generat-
      ing any output. With no arguments, the signature packet is read from STDIN. If only a sigfile is given,
      it may be a complete signature or a detached signature, in which case the signed stuff is expected in a
      file without the ".sig" or ".asc" extension.  With more than 1 argument, the first should be a detached
      signature and the remaining files are the signed stuff. To read the signed stuff from STDIN,  use  '-''
      as the second filename.  For security reasons a detached signature cannot read the signed material from
      STDIN without denoting it in the above way.
24
  • 1
    The .exe.asc file IS the signature for the .exe file. You need both files in the same folder when you try to verify. When you pass the .exe.asc file to gpg --verify it looks for the related file (.exe) in the same folder. This is all before you run/install the .exe file. When I verify it tells me that the signing public key ID is 0xFEB7C7BC which matches the public key published on the signatures page but this doesn't really verify much since the sig and public key both come from the same source. Mar 9, 2011 at 3:36
  • 2
    Here are the links: .exe, .exe.asc and the author's public key. You should import the author's public key into your key chain and have the other two files in the same directory. You should probably also make that directory the current working directory, instead of the gpg directory, just to be sure. The validation process relies on you trusting the validity of the author's public key... Mar 9, 2011 at 22:36
  • 1
    To my understanding, successfully verifying a file with its signature file will help detect any download errors (or man in the middle attacks) but it doesn't help you to verify that the file realy came from that person who owns the public signature. If you alreay had a trusted copy of the author's public key on your gpg key ring then you could verify the .exe file really was signed by them but getting the public key and the signature from the same source doesn't prove anything about the signer's identity. Mar 9, 2011 at 22:43
  • 1
    @Mike: s/owns the public signature/owns the keypair/ Mar 17, 2011 at 5:45
  • 2
    @Stisfa: @grawity correctly means that I should have written "owns the keypair" instead of "owns the public signature". Apr 5, 2011 at 8:37
1

You are overcomplicating things it seems :-) Try to do a search for DSA key ID FEB7C7BC at https://keyserver.pgp.com/vkd/GetWelcomeScreen.event and I think you get it!

1
  • Well, I didn't "get it" at first. After having had a chance to work with GPG, correspond with both Mike Fitzpatrick and grawity, read about the "Web of trust" concept from Wikipedia, and finally use the link you posted, I think I get the idea. If I can get the DSA Key ID from another source (the link you provided) and download KeePass, along with it's corresponding signature, from a separate source (the KeePass homepage), then verify it, I have a proper validation. I think.
    – Stisfa
    Apr 7, 2011 at 22:49
0

This post is mostly for an "A-to-Z" breakdown, this way anybody who's stuck on this can get an answer without having to dig through all the comments. Please don't vote this up; as credit goes to the participants (Mike Fitzpatrick, grawity and Jan Ivar Beddari).

Another thing: don't trust this post! Counterintuitive statement, but I'm posting this with a flawed/limited understanding of how GPG works. I'll be updating this as I get a better comprehension of this; right now I have a foggy grasp of how it works.

  1. Download your desired copy of KeePass, the corresponding Signature, and the Public Key to the same directory on your favorite Linux distro (in my case, I've been using Ubuntu and made the Desktop the working directory)
    • This is Important! The Public Key on the KeePass website should not be downloaded! You need to download a Public Key that is trusted by other users, hopefully those users being individuals you trust. How do you do that? Ask a friend who has a trusted Public Key to give you a copy; but you may not necessarily have a friend who has that. Well, thanks to Jan Ivar Beddari's post, one can download a Public Key published by Dominik Reichl from here and use the Import the Public Key from there.
  2. Open a Terminal ("CTRL+ALT+T" in Ubuntu)
  3. Run cd Desktop/
  4. Run gpg --import %KEYNAME%.asc
  5. Run gpg --verify %SIGNATURE%.asc
  6. Compare the Resulting Key Fingerprint with that from the KeePass Website

Here are my results when using the Public Key from keyserver.pgp.com:

proto@type:~$ cd Desktop/

proto@type:~/Desktop$ gpg --import key0xDCCAA5B3FEB7C7BC.asc 
gpg: key FEB7C7BC: public key "Dominik Reichl " imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

proto@type:~/Desktop$ gpg --verify KeePass-2.14-Setup.exe.asc
gpg: Signature made Sun 02 Jan 2011 05:25:24 AM MST using DSA key ID FEB7C7BC
gpg: Good signature from "Dominik Reichl "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2171 BEEA D0DD 92A1 8065  5626 DCCA A5B3 FEB7 C7BC

Then here are my results when using the Public Key from the KeePass website:

proto@type:~$ cd Desktop

proto@type:~/Desktop$ gpg --import Dominik_Reichl.asc
gpg: key FEB7C7BC: public key "Dominik Reichl " imported
gpg: Total number processed: 1
gpg:               imported: 1

proto@type:~/Desktop$ gpg --verify KeePass-2.14-Setup.exe.asc
gpg: Signature made Sun 02 Jan 2011 05:25:24 AM MST using DSA key ID FEB7C7BC
gpg: Good signature from "Dominik Reichl "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2171 BEEA D0DD 92A1 8065  5626 DCCA A5B3 FEB7 C7BC

As you can see, the results are all the same, excluding the "gpg: no ultimately trusted keys found" portion. I'm not sure what to make of it, but the Key Fingerprints match those on the KeePass website, which matters when verifying the File. This is vastly different from verifying that the Public Key is trustworthy, though. The Public Key is something you trust to use or don't, like whether you trust a stranger. One way for them to come across as trustworthy is if they have several individuals to vouch for them, which is the same for the Public Key. Again, this is from my limited scope, so due diligence is required on your part too!

If you can wait though, I'll slowly be editing my posts to favor a succinct, simple, and, hopefully, an accurate representation of the proper use of GPG in verifying one's copy of KeePass.

0

Have you tried running this?

gpg --verify KeePass-2.14-Setup.exe.asc KeePass-2.14-Setup.exe

Try it on Ubuntu of course. Windows tends to be a pain, if you take my meaning...

0

IMPORTANT ! This is just FYI. If you migrating from one platform to another (for example from Win. to Linux) and reinstalling KeepAss, please verify you are installing the correct package. There is KeepAssX first available in repos but if you use the KeepAss2 database with it, it will throw the above mentioned error. Please use KeepAss2 package for .kbdx database.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .