0

It seems that --digest-algo is only used when generating signatures and ignored when used with --verify, but I find the documentation unclear:

--digest-algo name

Use name as the message digest algorithm. Running the program with the command --version yields a list of supported algorithms. In general, you do not want to use this option as it allows you to violate the OpenPGP standard. --personal-digest-preferences is the safe way to accomplish the same thing.

Considering:

  • gpg does not throw an error if --digest-algo and --verify are used together.
  • A message may specify a Hash header, but it is optional...

It suggests that in some obscure situation, the recipient might need to specify --digest-algo when verifying a signature.

Would be nice to have a definitive answer.

1

A signature is created by first computing a digest of the message and then using the private key to sign this digest. A signature is validated by computing the digest of the message and then validating using the public key that this is the same digest as was signed.

This means, that the same digest algorithms has to be used in creating and validating the signature and thus --digest-algo should have no effect on the signature validation.

A message may specify a Hash header, but it is optional...

See The Hash header in GPG ASCII armor for what this header is for. In short: it is optional since it is redundant but is used to know up-front which digest algorithm is used in the message signature instead of only after reading the signature. Thus it is helpful when processing huge messages in a streaming way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.