Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I use GnuPG to verify that a file is unmodified and comes from the correct sender?

Let's take a simple use case:

  1. I have this file with some important content, let's say it is in a .tar.gz file.
  2. I sign this file with something like GnuPG
  3. I send this file to another guy.
  4. The other guy likes to know that the file is not modified by a man in the middle, and that I was the sender. So he uses the same tool to verify that the file is ok.

Can a tool like GnuPG help out here?

Note: The two computers are Linux based, and command line is nice :)

/Thanks


This is what I did.

Install:

sudo aptitude install gnupg

Generate a key and export it:

gpg --gen-key 
gpg --export -a "Johan Simonsson" > public.key

Gave the other guy the public.key on a usb-stick

Created a test file to play with and signed it:

tar -cvzf test.tar.gz ~/.vim
gpg --output test.sig --detach-sig test.tar.gz
tar -cvzf file.tar.gz test.sig test.tar.gz

The other guy imports the key that I gave him on a usb-stick.

gpg --import public.key

Then I email file.tar.gz to the other guy, and he can verify the files I send to him with something like this:

tar -xvzf file.tar.gz
gpg --verify test.sig test.tar.gz

And this seems like a ok solution (since the keys are not all over the place)


Note: Or we can use the PGP servers to store the keys, but that is another topic.

share|improve this question
up vote 2 down vote accepted

Yes, Use GPG's detached signature feature. It will create a separate file containing the signature and the file can be verified using that signature.

To sign:

gpg --output yourfile.sig --detach-sig yourfile.tgz

To Verify:

gpg --verify yourfile.sig yourfile.tgz
share|improve this answer
    
Looks like a good start, but when I send the .sig and the .tgz to the other PC. I get a "gpg: Can't check signature: public key not found" so I guess that I need to send him a public key to start with? – Johan May 23 '11 at 12:54
1  
Yes, that is how GPG works. You share your public key with others (you can put it on a keyserver if you like) and other people share their public key with you. – Bandit May 23 '11 at 13:10
    
There seems to be a possibility to export and import keys as well, and if you send that key via another medium like in a usb-key in paper mail that would probably be ok as well. (If you don't have any ok keys in a server) – Johan May 23 '11 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .