2

I have two files bla.txt and bla.txt.sig. The latter is the signature for the first. I do not (yet) know who is the signer. GnuPG just says (correctly): "No public key". With the email address I could try to get the public key via WKD. Any way to know it?

Many thanks in advance!

1 Answer 1

2

I am 99% sure that the signature does not contain email address information. So the only way you are going to find the email address(es) is by finding the key.

When gnupg tries to validate the signature it should tell you the key ID. Using the key ID you can try to retrieve the key from the keyservers with

gpg [--keyserver <server>] --recv-keys <keyid>

You can try various different keyservers. Usually I try whatever the default is in my gpg installation, if that doesn't work I try "the.earth.li" and if that doesn't work I try "pgp.mit.edu". Sometimes one keyserver will have keys that others don't.

You can also try searching for the key ID using google.

Finally note that when you do find the key you should not blindly trust it. You should take appropriate steps to check it legitimately belongs to a person/entity you trust.

1
  • Yes, you are right. I found it myself meanwhile :~) The signature does only contain ids. If the sender is not on any public key server, I'm out of luck. Unfortunately, this means, I cannot use WKD, because WKD needs the email address first, otherwise signature validation is not possible.
    – user734746
    Sep 22, 2017 at 14:55

You must log in to answer this question.