Can I use GnuPG to verify that a file is unmodified and comes from the correct sender?

Question

Can I use GnuPG to verify that a file is unmodified and comes from the correct sender?

Let's take a simple use case:

1. I have this file with some important content, let's say it is in a .tar.gz file.
2. I sign this file with something like GnuPG
3. I send this file to another guy.
4. The other guy likes to know that the file is not modified by a man in the middle, and that I was the sender. So he uses the same tool to verify that the file is ok.

Can a tool like GnuPG help out here?

Note: The two computers are Linux based, and command line is nice :)

/Thanks

---

This is what I did.

Install:

sudo aptitude install gnupg

Generate a key and export it:

gpg --gen-key 
gpg --export -a "Johan Simonsson" > public.key

Gave the other guy the public.key on a usb-stick

Created a test file to play with and signed it:

tar -cvzf test.tar.gz ~/.vim
gpg --output test.sig --detach-sig test.tar.gz
tar -cvzf file.tar.gz test.sig test.tar.gz

The other guy imports the key that I gave him on a usb-stick.

gpg --import public.key

Then I email file.tar.gz to the other guy, and he can verify the files I send to him with something like this:

tar -xvzf file.tar.gz
gpg --verify test.sig test.tar.gz

And this seems like a ok solution (since the keys are not all over the place)

---

Note: Or we can use the PGP servers to store the keys, but that is another topic.

Answer 1

Yes, Use GPG's detached signature feature. It will create a separate file containing the signature and the file can be verified using that signature.

To sign:

gpg --output yourfile.sig --detach-sig yourfile.tgz

To Verify:

gpg --verify yourfile.sig yourfile.tgz