OpenPGP: Sign-Verify workflow without Encrypt-Decrypt?

Question

Is it a good and/or frequent practice to sign a file (with your own private key) without encrypting it (with the intended recipient's public key?) I haven't really been able to find a direct answer to this question anywhere.

Answer 1

Such a signature is good for two things:

• It protects the email against alteration (i.e. any modification will be, at least, reported as such by the recipient's software).

• It gives to the recipient a proof that you the message is really from you; that proof can be shown to a third party (that's a signature, not a mere integrity check).

In email context, we usually encrypt when we sign, because if there is an attacker who is willing to modify the email contents, he is probably interested in reading the email as well, and you probably want to prevent that, too. A signed-but-not-encrypted email is still a rather common occurrence, for the side effect of making the recipient aware that you are using OpenPGP; some people systematically sign all the emails they send, even those that they cannot encrypt because the recipient owns no key whatsoever.

In other situations, signing without encryption can be common and good practice. The typical example is software distribution. In some Linux distributions such as Debian and Ubuntu, software packages are signed (indeed using the OpenPGP format), so that you can be sure that you are installing genuine packages without backdoors inserted by malicious third parties; but the packages are not encrypted because they are, ultimately, public data.

Note that a signature from you can, be essence, be used as proof against you. Therefore, from your point of view, signatures are good as long as they are signatures from other people when they send messages to you, and not the other way round.

Answer 2

EDIT: The answer below was based on the (mis)understanding that the question was about signing a message with a a recipient's public key.

---

Typically, you'd sign a message with your own private key, and the recipient can verify that it was you who signed the message, by using your public key.

The reverse doesn't quite make sense to me... Anybody can use the recipient's public key to sign any message they want. So what would you achieve by doing this?

Same goes to encrypted messages of course. Anybody can create one (which usually confuses people who are used to symmetric key crypto). But at least with encrypted messages, nobody can read their content but the recipient.