I realize (using --clearsign) that GnuPG is using SHA256 as the hashing algorithm for signing, but I would like to be able to see the actual SHA256 hash in the signature somewhere. Is there a way with -vv or --list-packets or perhaps with xxd or something like that to show the actual SHA256 hash that is signed?

Also, if I wanted to verify that hash by hand, how would I do it?

  1. GZip cleartext message
  2. Hash the gzip stream with SHA256


  • (1) GPG doesn't necessarily use SHA256 to sign; it depends on the options you specify or configure or the version you use (2) GPG doesn't gzip or otherwise compress when signing; for encryption by default it compresses (but not with gzip) because compression after encryption doesn't work, but after signature does. – dave_thompson_085 Feb 11 at 16:35
  • @dave_thompson_085, True, I mention SHA256 since I know for a fact that in my config it is what is used. I've thumbed through the spec and I'm beginning to think that the whole hash is not in the sig, just the first 16 bits of the hash. The whole hash is signed of course. – Dan Feb 11 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.