If I sign a file right now a check the .gpg file that's generated it will output a timestamp, is it possible to change the time when signing the file?

➜  Downloads gpg --verify cache.html.gpg 
gpg: Signature made Thu  9 Mar 14:27:07 2017 ACDT using RSA key ID A4DB4615
gpg: Good signature from "Tyler Bridger <xo@wvvw.me>" [ultimate]
gpg:                 aka "keybase.io/omgimalexis <omgimalexis@keybase.io>" [ultimate]

Yes, there's multiple ways you can do it:

  • Change the system time, sign the file, then put the time back
  • Run gpg inside datefudge or faketime
  • Use gpg's --faked-system-time option

Because of these possibilities, you can only trust the timestamp on a signature if you trust the signer to not have faked it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.