Can I use GnuPG to verify that a file is unmodified and comes from the correct sender?
Let's take a simple use case:
- I have this file with some important content, let's say it is in a .tar.gz file.
- I sign this file with something like GnuPG
- I send this file to another guy.
- The other guy likes to know that the file is not modified by a man in the middle, and that I was the sender. So he uses the same tool to verify that the file is ok.
Can a tool like GnuPG help out here?
Note: The two computers are Linux based, and command line is nice :)
This is what I did.
sudo aptitude install gnupg
Generate a key and export it:
gpg --gen-key gpg --export -a "Johan Simonsson" > public.key
Gave the other guy the public.key on a usb-stick
Created a test file to play with and signed it:
tar -cvzf test.tar.gz ~/.vim gpg --output test.sig --detach-sig test.tar.gz tar -cvzf file.tar.gz test.sig test.tar.gz
The other guy imports the key that I gave him on a usb-stick.
gpg --import public.key
Then I email file.tar.gz to the other guy, and he can verify the files I send to him with something like this:
tar -xvzf file.tar.gz gpg --verify test.sig test.tar.gz
And this seems like a ok solution (since the keys are not all over the place)
Note: Or we can use the PGP servers to store the keys, but that is another topic.