0

I've asked this question here: https://stackoverflow.com/questions/42170000/read-pgp-signature-using-bouncycastle but I'm hoping to be able to get more information about the format of a GnuPG signature and how to decode it.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBBABCAAGBQJYnkPxAAoJEBFjzYGyXBOsXRoH/3O4bwKK45aUN+m0N4jsZ+n5
W8R/aGti/llvJ62tHBCO5BIp/pp+b1Gdv99xtnJXHu/f0TqPYj+fwq4vfaorNTtA
Vtq8MaMesw1OWZEfu/lyjNOwdg81FUlYkw0Bjo3H/MxWjWYUiHmJo+OGriyf5dv/
433ZqitZMxLHCfZsuoU5teZ0BPUSoNjF6hOFK3ZI7QXsgYUyohzW2goy9bDVCKRq
e73CHpnMKCrnDc+/4+sK349bD/cZp6/c0T8b7cBCeBGGilPD6ovJUQE5vhGTKnJM
lgyxhA87tw9wqFwpZXDr0nzOP+MFfE9WRGecVYZ9G+LP/biefSe5iWRaPIcZIi0=
=qUHb
-----END PGP SIGNATURE-----

When I try to verify using JCA, I got an error that says:

'Signature length not correct: got 287 but was expecting 256'

I'm hoping to get some more light on how the signature is encoded and how to access the actual bytes that are used for verification.

1

Try to use gpg commandline:

$ gpg -vv
gpg: Go ahead and type your message ...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBBABCAAGBQJYnkPxAAoJEBFjzYGyXBOsXRoH/3O4bwKK45aUN+m0N4jsZ+n5
W8R/aGti/llvJ62tHBCO5BIp/pp+b1Gdv99xtnJXHu/f0TqPYj+fwq4vfaorNTtA
Vtq8MaMesw1OWZEfu/lyjNOwdg81FUlYkw0Bjo3H/MxWjWYUiHmJo+OGriyf5dv/
433ZqitZMxLHCfZsuoU5teZ0BPUSoNjF6hOFK3ZI7QXsgYUyohzW2goy9bDVCKRq
e73CHpnMKCrnDc+/4+sK349bD/cZp6/c0T8b7cBCeBGGilPD6ovJUQE5vhGTKnJM
lgyxhA87tw9wqFwpZXDr0nzOP+MFfE9WRGecVYZ9G+LP/biefSe5iWRaPIcZIi0=
=qUHb
-----END PGP SIGNATURE-----gpg: armor: BEGIN PGP SIGNATURE
gpg: armor header: Version: GnuPG v2
:signature packet: algo 1, keyid 1163CD81B25C13AC
    version 4, created 1486767089, md5len 0, sigclass 0x10
    digest algo 8, begin of digest 5d 1a
    hashed subpkt 2 len 4 (sig created 2017-02-10)
    subpkt 16 len 8 (issuer key ID 1163CD81B25C13AC)
    data: [2047 bits]

As you can see, the signature can be decoded. Without the signed data however I can´t give you more information, specifically if the signature is valid. I do not find the issuer/signer on https://pgp.mit.edu/

Try to paste the whole message including signature into gpg -vv and see if it gives you more information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.