OpenPGP Signatures
The program outputs a small picture.sig file to the destination folder. What does this file contain?
[...]
But the .sig file should also contain entire certificate, or maybe a fingerprint of it. What does it contain? How does Kleopatra automatically choose the right certificate?
OpenPGP signatures can contain the original document, or not. It seems, Kleopatra created a so-called detached signature without the original document (on the command line, this is created running gpg --detach --sign).
OpenPGP signatures are calculated on a hash of the document to be signed. Technically, a signature is the hash of the document encrypted using the private key, so it can be decrypted with the public key. Given decryption yields the correct hashsum, the file must have been signed by somebody with access to the private key (hopefully, the key's owner). Remember, regular encryption works the other way round: the message (or to be more specific, a session key for symmetric encryption) gets encrypted using the public key, and can only be decrypted using the private key.
Furthermore, OpenPGP signatures include several meta data, amongst them the signing key's long key ID (not fingerprint). The full certificate/public key is not included, and needs to be fetched (for example, from the key server network) based on this ID when not available locally.
You can view the signature file's contents using the commands gpg --list-packets and pgpdump, offering similar outputs. pgpdump shows some more details when used together with the -l option (prints literal data, the original message if available) and -i (prints the actual numbers being results of crypto operations). An example for a file signed using my own key:
Old: Signature Packet(tag 2)(540 bytes)
Ver 4 - new
Sig type - Signature of a binary document(0x00).
Pub alg - RSA Encrypt or Sign(pub 1)
Hash alg - SHA1(hash 2)
Hashed Sub: signature creation time(sub 2)(4 bytes)
Time - Wed Jan 27 16:36:30 CET 2016
Sub: issuer key ID(sub 16)(8 bytes)
Key ID - 0x8E78E44DFB1B55E9
Hash left 2 bytes - 7d 3c
RSA m^d mod n(4093 bits) - 18 1d d5 3f 6d f1 3e bb 93 08 8d 83 1a 3b a7 7a 70 56 f4 2c cb 92 cf a9 d1 f0 21 cd 7a f0 f8 5d 3e 75 46 d1 6a 14 56 27 a3 05 4a 6c 31 ee d4 8d 22 c6 d1 8a 41 6c 22 30 e4 90 19 1a 3f 18 ca 76 a3 1d d3 c1 f5 4a b7 54 9e 5f 83 dd 43 25 6b 80 66 65 34 36 80 4d 69 c7 fd 2a 3b 5b e8 a5 d8 c5 5a 26 a5 a8 19 b6 74 bc 47 69 e0 b7 a8 14 4b e7 51 5e e6 65 18 67 69 3e c8 5f 1b 78 8e f2 60 fa 15 a0 a0 be 7e 71 2f 68 19 07 af f7 d2 21 dc fb 3f f6 67 fd de eb ed c0 29 93 b7 59 5e 0a 35 1f 28 f4 89 51 43 a9 33 a9 f1 75 d6 6b 37 6b 3e a1 04 76 c5 43 b7 a8 05 3f 1a 08 b0 83 76 73 1e 61 78 e6 3b be 69 ca 60 93 5b e2 28 6c 53 65 63 ef 4b 06 df ce d4 81 47 ce 29 ea e3 06 a0 2a 13 30 98 00 8b 81 4d af 3d 5f 91 a0 26 e5 be 35 49 95 b3 7f 01 76 47 29 5e 8c 78 2b 22 c7 49 3a a1 b8 c5 48 ec 86 41 9b 34 65 a3 f1 3b f2 a4 8f 2c 2f 56 cd 72 86 42 7c 0d 08 51 8c 26 ee 91 1b 5a fc 6f 60 70 88 f8 d5 83 ea 89 c6 5c 13 0c 32 03 7b e2 82 50 77 f7 0d 2d 10 8c c9 95 05 b2 c7 99 ed 74 e4 46 75 95 00 6d d4 1b fc 4d 77 cf 7d f0 3f 1c 48 fa ab 8e 83 26 9c 09 e2 da e0 92 42 c6 8a df f6 3f 68 54 3a 02 49 d8 0a 1b 32 49 73 13 db 46 28 3a a1 aa 02 9a 9c cf 90 61 a5 ed 3f 7b 16 d3 64 1a cc 76 19 7e 84 62 ce 70 5a a7 cd be 40 28 72 f1 f0 16 7d fb 5a 84 69 d5 dc f9 f8 03 f7 5a ab a5 24 08 da a2 f3 14 1e e4 72 f9 62 72 d7 e0 52 07 b3 7c 1d 72 e5 6b 6f 43 9f 47 24 61 ab a3 c5 9a 6b c0 38 fb 8f 21 38 79 b5 2c 7f e8 1b 25 34 fd ce d5 2c e7 cd f8 57 43 b6 68 47 76 9e 03 70 f5 1e 30 21 83 12 bf fc d4 44 b9 dd 05 fc a0 2b f1 c0 56 3b 92 af 97 08 16 95 01 0d 12 c2
-> PKCS-1
Trust
Moreover, if I export this certificate, remove it from system and then import it; it will be impossible to check integrity of file until I won't sign this imported certificate by one of my own certificates.
This is another issue considering trust, and you have to discriminate between two operations: verifying a signature (in terms the signature was issued by a giving key, and the document was not tampered with) versus validating it (whether the key is trusted, based on certifications). As soon as the public key is available, you can very well test whether the signature was issued by this key (with other words, decrypt the hash with the public key and compare it), but you do not necessarily have the required information on whether to trust the key or not. One way to do so is comparing the key's fingerprint with the other party, and issuing a certification.
