1

enter image description here

Hello everyone,

I just newly get to know the existence of GPG keychain. After error and try I now understand most of the functions of this software . However the two checkbox in this picture remains unclear.

What known is that, when 'Your Key' Filled, I can decrypt with the secrete key in 'Your Key' line. But what does the 'Sign' and 'Add to Recipients' Does ?

(This screenshot comes from file-encryption page

1

I will reply only to the Sign part. Not sure about the 2nd part.

Signature and encryption are not related. You can have the content uncencrypted+signed, or encrypted+signed.

A digital signature is an additional piece of information which confirms that the initial content is generated by the person who has the key, and thus that it has not been tampered with during its transfer to the recipient. -- Much like a normal human signature on a document.

The "signer" generates a signature by hashing the initial content using the key he/she posseses. Then the content is sent accompanied with the signature. Each signature is unique, as it depends both on content and key. If the content is altered, the signature is not valid any more and has to be regenerated (using the key).

The receiver gets the content and the signature separately. Using his/her key, he/she rehashes the content and creates a signature. If the signature the receiver created is identical to the one the signer has sent, then the receiver is certain that the content has not been changed in the way. This is called signature validation.

If somebody intercepts the transmission and modifies the content (encrypted or not), then the signature validation will fail, because the interceptor cannot create a good signature, as he/she does not have any of the keys.

1

When using GPG to create a message (email, file, whatever), you can do two things (broadly) to it: encrypt it, and sign it.

To encrypt it, you specify a list of recipients, given as public keys that are owned by people who you want to be capable of decrypting the message. In most cases (certainly when encrypting your own files), you want to add yourself as a recipient; otherwise, you can't decrypt your own message! That's what the second checkbox does.

To sign a message, you use you own private key to create a blob of data such that anybody with your public key, the original message, and the signature blob will be able to verify that the message was signed by you and hasn't been tampered with. If the message (or signature blob) is modified, the validation will fail.

The program is asking you to specify your own public/private key pair to use for operating on this file. If you only want to encrypt the file to other people, and don't mind never being able to decrypt it yourself, then you don't even need your own key pair. However, if you want to encrypt the file while still being able to decrypt it, you need to add your public key to the list of recipients, and if you want it to be possible to verify the authenticity of the file (whether or not you encrypt it to yourself, or even encrypt it at all), you need to use your private key. That's why both of those checkboxes are next to a drop-down asking you to select your key pair.

  • When you say "your public key, the original message, and the signature blob" are you referring the the original message before encryption or after? I'm curious if decryption is necessary to verify the signature. – user8675309 Nov 1 '18 at 19:14
  • 1
    @user8675309 It is possible to sign a message before or after encrypting, but GPG (when told to both sign and encrypt) does the signing first, and then encrypts the combined plain-text message and its signature into a single encrypted blob (see superuser.com/questions/979070/…). This means you need to use your private key to decrypt the message before you can use the sender's public key to verify the signature. However, it is possible to encrypt without signing, or sign without encrypting. – CBHacking Nov 2 '18 at 3:46
  • That means it has benefit of keeping the sender secret to everyone except the intended recipient then, right? Thanks's for explaining. – user8675309 Nov 9 '18 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.