Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

I played with openssl to make a pub/prv key and create a signature of a file and validated it. I toyed with Cryptophane (windows gnupg frontend) and heard about keyservers+played with signing text.

I however not ever signed a file archive. If i want to publish an archive (7z, rar or zip, it doesnt matter) and i'd like my users or software to be able to check if THAT archive has been signed how would i do that? The public key obviously would need to be available publically. But adding the signature to the archive is what bothers me. Does any software+archive allow me to sign and verify a compressed archive file?

share|improve this question
Why do you want to sign it? You could just create a SHA1 hash and make the hash available for your clients/users to check. This is sufficient to confirm that the file has not been tampered with. Although your users do need to have the ability to verify the hash but no harder than verifying a signature. – BJ292 May 19 '12 at 10:10
@BJ292: And how do you verify that the hash hasn't been tampered with? – grawity May 19 '12 at 13:30
@grawity - Not sure I follow - what's the point of tampering with the hash? I send you a file and the hash - you recreate the hash from the file and confirm it matches - this confirms the file has not been changed. In most circumstances this is all most people want - confirmation the file got from A to B unchanged. Certainly sounds like this is what the OP is after. – BJ292 May 19 '12 at 15:28
2  
@BJ292: You're assuming the OP is only concerned with accidental data corruption. This hasn't been stated (or denied) in the question, but the OP is asking about digital signatures, so I'm going to assume there's a need to protect against intentional (possibly malicious) data modifications. – grawity May 19 '12 at 17:14
@grawity - ok, that's a fair point. – BJ292 May 19 '12 at 18:02
show 3 more comments

2 Answers

up vote 4 down vote

A common method is to create a detached signature in a .sig file (usually a PGP signature by using gpg -b – X.509 is very uncommon), and provide both files in the same location. For example:

ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.0.19.tar.bz2
ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.0.19.tar.bz2.sig

This can be used with any kind of file, but the user will have to verify the signature manually using gpg --verify.

Unfortunately, out of those currently in use, no archive format (that I know of) has support for built-in signatures using PGP or X.509. (This is excluding CAB, which is used by Windows internally but practically nowhere else, and is rather complicated to sign). WinRAR is able to add an "authenticity verification" record using a proprietary format, but it uses your WinRAR license as the signing key, which has been cracked repeatedly.

On Windows (and soon Mac OS X), it is possible to create a "self-extracting archive" – a digitally-signed executable that extracts an archive from within itself – this is how software installers on Windows work, for example. However, SFXs are limited to a single operating system, so they only suitable for distributing programs, not documents or pictures. (Java programs can be signed and are cross-platform, but few systems still have a Java runtime.)

share|improve this answer
up vote 0 down vote

Jar-archives, build with Javas jar-tool, are effectively zip-Archives, and there is a tool, the jarsigner, to sign them.

Here are some useful links:

It looks a bit complicated first ("What, I need keeytool to? What else?") but it is easy to follow the steps for solving it in a simple fashion. It works. Then you can dip deeper into the matter.

share|improve this answer
This is true (XPI archives also are ZIPs signed in a very similar fashion), but AFAIK, only the Java Runtime actually verifies JAR signatures, and needing to do manual verification makes it even less practical than GnuPG. – grawity Jun 15 '12 at 12:14
What do you mean with manual verification? What is the alternative? An autopopup, which verifies itself every 10 minutes? Shall the OS automatically verify the archive on boot up? When an archive is received - be it from CD, email-attachment, download, ...? Should it be a plugin in your virus scanner? – user unknown Jun 15 '12 at 13:42
I meant verification performed by the archive extraction tool before/during extraction, or by the OS/runtime during program execution. For example, .deb package signatures are verified by dpkg before the package is installed, without the user taking any additional action. – grawity Jun 16 '12 at 19:03
@grawity: Signed applets, zipped in a jar, ARE verified before execution. To generate a minimal shell script, which combines verification (jarsigner) with extraction (jar) will be trivial. – user unknown Jun 18 '12 at 0:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.