I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose.
Let me present you with two options:
Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with:
$ gpg --local-user <my_gpg_fingerprint> \ --sign --armor \ --output "${backup_file}.xz.enc.asc" \ --detach-sign "${backup_file}.xz.enc"
which honestly takes a long time even on a higher-end laptop of mine; or
Create
SHA512SUM
of that big encrypted file and sing that one with:$ sha512sum --binary "${backup_file}.xz.enc" > \ "${backup_file}.xz.enc.SHA512SUM" $ gpg --local-user <my_gpg_fingerprint> \ --sign --armor \ --output "${backup_file}.xz.enc.SHA512SUM.asc" \ --detach-sign "${backup_file}.xz.enc.SHA512SUM"
which has actually proven to be
waya little faster.
Please elaborate as to what security implications might the faster version have as a disadvantage to the direct signing the big file.
Benchmark
$ time gpg --personal-digest-preferences sha512 \
--local-user <my_gpg_fingerprint> \
--sign --armor \
--output test_file_23gib_random_data.asc \
--detach-sign test_file_23gib_random_data
result:
real 1m25,444s
user 1m17,059s
sys 0m4,728s
As opposed to signing the SHA-512 file:
$ time sha512sum --binary test_file_23gib_random_data > \
test_file_23gib_random_data.SHA512SUM
result:
real 1m7,568s
user 1m2,810s
sys 0m4,567s
and signing it in ~ 0.4 seconds.
Final thoughts
So, there is a few seconds difference. Not really a big deal, but noticeable.
I am still interested in your view about the security implications, which this question was originally intended to be about.
Hardware:
Dell Inspiron 15 Gaming 7577, model number 7577-92774.
Processor: I have an Intel Kaby Lake CPU: Intel Core i7-7700HQ.
Storage: NVMe PCI-E drive.
System:
I am on Linux Mint 19.1; based on Ubuntu 18.04.
sha512sum
than signing?