Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can I use GnuPG to verify that a file is unmodified and comes from the correct sender?

Let's take a simple use case:

  1. I have this file with some important content, let's say it is in a .tar.gz file.
  2. I sign this file with something like GnuPG
  3. I send this file to another guy.
  4. The other guy likes to know that the file is not modified by a man in the middle, and that I was the sender. So he uses the same tool to verify that the file is ok.

Can a tool like GnuPG help out here?

Note: The two computers are Linux based, and command line is nice :)

/Thanks


This is what I did.

Install:

sudo aptitude install gnupg

Generate a key and export it:

gpg --gen-key 
gpg --export -a "Johan Simonsson" > public.key

Gave the other guy the public.key on a usb-stick

Created a test file to play with and signed it:

tar -cvzf test.tar.gz ~/.vim
gpg --output test.sig --detach-sig test.tar.gz
tar -cvzf file.tar.gz test.sig test.tar.gz

The other guy imports the key that I gave him on a usb-stick.

gpg --import public.key

Then I email file.tar.gz to the other guy, and he can verify the files I send to him with something like this:

tar -xvzf file.tar.gz
gpg --verify test.sig test.tar.gz

And this seems like a ok solution (since the keys are not all over the place)


Note: Or we can use the PGP servers to store the keys, but that is another topic.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes, Use GPG's detached signature feature. It will create a separate file containing the signature and the file can be verified using that signature.

To sign:

gpg --output yourfile.sig --detach-sig yourfile.tgz

To Verify:

gpg --verify yourfile.sig yourfile.tgz
share|improve this answer
    
Looks like a good start, but when I send the .sig and the .tgz to the other PC. I get a "gpg: Can't check signature: public key not found" so I guess that I need to send him a public key to start with? –  Johan May 23 '11 at 12:54
1  
Yes, that is how GPG works. You share your public key with others (you can put it on a keyserver if you like) and other people share their public key with you. –  Bandit May 23 '11 at 13:10
    
There seems to be a possibility to export and import keys as well, and if you send that key via another medium like in a usb-key in paper mail that would probably be ok as well. (If you don't have any ok keys in a server) –  Johan May 23 '11 at 13:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.