Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is triggered by an email from Microsoft this morning about a security bulletin. It started with

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

and ended with a PGP signature.

I've seen this before but hadn't given it much thought previously. But upon reflection I have no idea if this email is actually from Microsoft (I'm sure it is, but bear with me).

How does one go about verifying a message like this? To start with, I was able to find Microsoft's Security Center public key here:

https://technet.microsoft.com/en-us/security/bulletin/pgp

I presume this is the public key that I could use to authenticate the message I received (and validate it). This being so, HOW do I do it? There's got to be freely available software out there to enable this task, but which should I use? Or perhaps is there a dynamic link library out there somewhere that I could use to do such authentication and validation programmatically?

share|improve this question

migrated from programmers.stackexchange.com Mar 14 '12 at 0:15

This question came from our site for professional programmers interested in conceptual questions about software development.

up vote 1 down vote accepted
  1. You have to use e-mail client, capable to handle PGP-signed|encrypted messages.
  2. Properly configured, with imported (trusted) public key, MUA will tell you, owner of public key signed mail or not
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .