Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

AFAIU signing in GnuPG is performed in two steps:

  1. Create a digest of the file.
  2. Encrypt the digest with the secret key.

Is there some way to actually split this into two steps on the command line?

The end-goal is to sign a file (detach-sign) with neither having to transfer it to the computer where the secret key is, nor transferring the secret key to where the file-to-be-signed is.

share|improve this question

1 Answer

up vote -1 down vote

The end-goal is to sign a file (detach-sign) with neither having to transfer it to the computer where the secret key is, nor transferring the secret key to where the file-to-be-signed is.

What?
In order for a gpg process to create a signature, it needs both the input data to be signed and a private (secret) key to do the signing.

Your [logical] choices:

  • Transfer the file to the user@host where the private key is, create detached-sig, delete file

  • Use ssh or similar to pipe the file data from one host directly into gpg process on host where private key resides, avoiding need for input file to hit the disk on said host

  • Use openssl or similar to create a digest hash / signature on the fly

share|improve this answer
No, those may be the options that GnuPG offers me. Internally GnuPG performs the two steps I listed in my question, which means that there is (logically) nothing that prevents a tool to offer the steps to be manually split. The question is whether GnuPG offers a fourth option: 1) create hash of large file, 2) copy hash to other computer, 3) sign hash (i.e. create a detached signature of large file). – Magnus Sep 3 '12 at 11:43
Magnus, you didn't ask about theory or logic; you asked if there was a way to make GnuPG do what you want and I answered you, even providing alternatives. If you think that deserves a down-vote, then I gotta tell you: you're going to run out of karma down-voting all the other right answers on the various stackexchange sites. – ryran Sep 3 '12 at 16:00
I downvoted you because you clearly didn't read the question carefully enough to understand it before answering. – Magnus Oct 1 '12 at 14:19
Wow. ... Just, wow. – ryran Oct 1 '12 at 21:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.