16

What GUI (no command line) software or websites can I use to verify a PGP signature?

If I have a message like this

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Because anyone can claim to be me. There's no validation of the user
name or email address when someone posts a comment. While I do try to
remove imposters, some may slip through. By signing my comments using
this technique, anyone can independently verify that I was the author of
the message by validating the signature.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)

iD8DBQFFxqRFCMEe9B/8oqERAqA2AJ91Tx4RziVzY4eR4Ms4MFsKAMqOoQCgg7y6
e5AJIRuLUIUikjNWQIW63QE=
=aAhr
-----END PGP SIGNATURE-----

How can I verify the message against the public key to get the same signature back?

This online encryption/decryption PGP site does not allow me to do that.

  • 14
    I'm reminded of a certain XKCD comic. :P – DanteTheEgregore Nov 18 '13 at 22:09
  • 2
    Have you tried GPG4Win ? From what I remember it does certify OpenPGP certificates – Darius Nov 18 '13 at 23:09
  • 1
    GPG4Win Kleopatra doesn't open on my computer. – desbest Nov 18 '13 at 23:56
  • 2
    I'd been looking for a program for this as well. When using GPGshell along with GPG4Win, I found GPGtray. Open it, right click the tray icon, and select "View/Edit Clipboard". Here you'll find a full GUI for applying any PGP operation to plain text, including signing and verifying. – H. C. Barton Mar 18 '16 at 1:32
5

Here's a short list GUIs that let you verify PGP clear-signed messages [which I've personally used and can vouch for].

3

If you use the old version of PGP version 6, not the new version 8, you'll find a GUI interface that lets you store PGP keys and encrypt text, decrypt text and verify signatures with timestamps.

Here's the download link I've uploaded for version 6.

  • 2
    Think twice before following the link. At best it does what it says. But what if instead it is a malware that takes your PGP keys or that corrupts your PGP binaries? – dolmen Jan 8 at 14:23
  • I got the download from the official PGP company before Symantec brought it. It's a safe link. – desbest Jan 9 at 16:35
  • 1
    No matter if you vouch for the safety of your download link, @desbest, it's still very poor security practice to download any program (especially a cryptography program) from an unverified source such as those you have provided. – kjones Apr 12 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.