22 Sep 2021 [guides]

Digitally signing contact information with GPG

Motivation

By signing a file containing your non-confidential contact info (ie. email, social handles, XMR addresses), you are essentially allowing people to verify that the public details haven’t been tampered with and they come from you.

Assumptions

gnupg¹ is installed on your system
you already own a keypair²

Signing

We’re going with a clear text type of signature in this guide.

Fire up a terminal and type in:

nano contact.txt (creates the file and opens it in a text editor)

Enter your contact details that you want to publish on your site. Save and exit the editor.

gpg --clear-sign -o contact-signed.txt contact.txt (signs the file with your main public key)

Enter your key password when prompted.

Note: you can also use a different keypair to sign the file by using the --local-user flag.

You should now have a contact-signed.txt file in the same directory.

cat contact-signed.txt (lists file contents, signed)

This should output something like this, only with your own content:

Now you can publish the file online. Don’t forget to also include your public key that you used to sign this file. That way people can use it to verify your contact details.

Verifying

You can exercise by trying to verify my information. This way you can see how the process works for the other party.

If you don’t already have my public key, download it. Then verify the fingerprint and import it.

Note: on Whonix you can replace wget with scurl for better security.³

wget https://monero.observer/3RA_pubkey.asc (downloads my public key to your machine)
gpg --show-keys 3RA_pubkey.asc (list the key’s fingerprint)

The output should match this fingerprint:

BCE15F74D18112824899608AFD103120DC7BCC36

If it doesn’t, don’t import it. Delete and try again or contact me.

gpg --import 3RA_pubkey.asc (imports the key)

Download the file containing my signed contact info:

wget https://monero.observer/contact-signed.txt (downloads my signed contact info to your machine)
gpg --verify contact-signed.txt (verifies if the file contains the original content)

gpg: Signature made Wed 22 Sep 2021 09:37:07 PM UTC
gpg:                using RSA key BCE15F74D18112824899608AFD103120DC7BCC36
gpg:                issuer "escapethe3ra@ctemplar.com"
gpg: Good signature from "escapethe3RA <escapethe3ra@ctemplar.com>" [unknown]

You can ignore this warning:

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BCE1 5F74 D181 1282 4899  608A FD10 3120 DC7B CC36

The most important part of the output is this:

gpg: Good signature from "escapethe3RA <escapethe3ra@ctemplar.com>"

That’s what you want to see.

If you see BAD signature then the file is probably corrupted, not original, or there was a mistake somewhere in the steps above. You can delete it and try again.

If all went well, you can try and change something inside my contact-signed.txt file, save it and verify it again. It should fail, even if all you’ve modified is 1 single character.

Notes

signing a file does not automatically encrypt its contents
this is not the only way to digitally sign⁴ a file; the manual suggests using detached signatures over cleartext⁵
gpg --verify does not check for any modifications outside of the cleartext signature or the header lines directly following the dash marker line
GPG usage might not fit your threat model

Feedback

After getting lots of PGP-related questions, I decided it might be helpful to start making some guides, and see if people find them useful.

There’s also a second guide² available. Let me know if you want to see more.

Feedback is always welcome!

-3RA

https://www.gnupg.org/download/ ↩
/gpg-generate-full-keypair ↩ ↩²
http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Secure_Downloads ↩
https://www.gnupg.org/gph/en/manual/x135.html ↩
https://www.gnupg.org/documentation/manuals/gnupg/Operational-GPG-Commands.html ↩