Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is triggered by an email from Microsoft this morning about a security bulletin. It started with

Hash: SHA256

and ended with a PGP signature.

I've seen this before but hadn't given it much thought previously. But upon reflection I have no idea if this email is actually from Microsoft (I'm sure it is, but bear with me).

How does one go about verifying a message like this? To start with, I was able to find Microsoft's Security Center public key here:

I presume this is the public key that I could use to authenticate the message I received (and validate it). This being so, HOW do I do it? There's got to be freely available software out there to enable this task, but which should I use? Or perhaps is there a dynamic link library out there somewhere that I could use to do such authentication and validation programmatically?

share|improve this question

migrated from Mar 14 '12 at 0:15

This question came from our site for professional programmers interested in conceptual questions about software development.

up vote 1 down vote accepted
  1. You have to use e-mail client, capable to handle PGP-signed|encrypted messages.
  2. Properly configured, with imported (trusted) public key, MUA will tell you, owner of public key signed mail or not
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.