0

I created an RSA signing key using GnuPG.

I have few files and I want to sign these files and store online.

I signed these using GnuPG. If the original file is a.txt, GnuPG created a 1 KB file with the extension .pgp, which holds the signature.

I want to know how to verify the original a.txt using GnuPG.

I tried this:

  1. Right-clicked GnuPG option and selected: "Verify"
  2. On click of Verify, GnuPG throws error: "Not an OpenPGP or S/MIME signature".

I assumed GnuPG will ask about 1 kb .pgp file and will verify.

How to verify the original file correctly?

migrated from security.stackexchange.com Oct 15 '16 at 14:48

This question came from our site for information security professionals.

0

You can verify files using

  1. gpg --verify file assuming the public key is in the keychain and the signature (.sig usually) file is in the same directory

  2. gpg --decrypt file assuming the public key is in the keychain and the file is signed using gpg --sign

You're probably looking for the second option.

  • But there is no public key. I generated a signing key and it generated only one private key. – RPK Oct 13 '16 at 13:55
  • Signing is the opposite of encrypting in PGP context. You sign it with your private key, so the public key is needed to decrypt [verify in this context] the data. – Samuel Shifterovich Oct 13 '16 at 13:57
  • Ok. But when using GPG4Win, I right-click file and select verify. It throws error and that is obvious. The file is not encrypted and the signature is in a separate file. – RPK Oct 13 '16 at 13:59
  • @RPK I don't really understand what you've done. Can you share the 2 files? – Samuel Shifterovich Oct 13 '16 at 14:12
  • Found solution. Posted below as answer. – RPK Oct 13 '16 at 15:14
0

@Samuel,

I figured out the problem. When signing using GPG4win, it is generating signature file with extension .pgp. I renamed this to .sig.

Now when I right-click on context menu and select "Decrypt and Verify", it is verifying the original file against this signature.

What I am not following is why GPG4win is creating signature file with extension .pgp.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.