0

I am currently in a situation where using the --clearsign flag would be impractical.

I have established via the size of a signature that it does contain some form of the input data (so when I typed gpg --armor --sign file.txt, the output of file.txt.asc was, on multiple occasions, minutely larger than the original file), however, when using gpg --verify file.txt.asc, I am only able to tell that the file was signed by me, and not what it's contents are, even when using the verbose flag.

If the original data is irretrievable, then what is the point of having the signature, since all it shows is the date it was signed and who it was signed by? If I were a MITM, couldn't I just copy that signature and pretend that I'm the sender, even if the date was a little off?

0

How can I retrieve original data from a signature with GnuPG?

If the original content is contained (ie. you did not create a detached signature), you can export the signed data using the --output option.

gpg --output file.txt --verify file.txt.asc

GnuPG is guessing you want to do exactly the same when not passing any commands at all:

gpg file.txt.asc

If the original data is irretrievable, then what is the point of having the signature, since all it shows is the date it was signed and who it was signed by? If I were a MITM, couldn't I just copy that signature and pretend that I'm the sender, even if the date was a little off?

The signature is always issued on a hash sum of the original message. When creating a detached signature (which does not contain the whole original message), it still contains the hash sum. This way, the recipient's implementation of OpenPGP can hash the message again, and verify whether this hash is also contained in the signature and whether the signature is fine.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.