I'm encrypting and signing data with the PHP function
gnupg_encryptsign() (docs) which has the strange behaviour of signing first and encrypting afterwards.
I'm aware of this thread saying this is indeed a strange behaviour but does not provide a solution.
Decrypting the data with the gpg binary works, even if I can't verify the signature (I want it to error when the signature can't be verified).
Consider the following pseudo code for better imagination:
<?php $gpg_ressource = gnupg_init(); gnupg_addencryptkey($gpg_ressource, $pub_key_receiver); gnupg_addsignkey($gpg_ressource, $priv_key_sender); $content = gnupg_encryptsign($gpg_ressource, 'This is a secret message'); file_put_contents('./my_encrypted_file', $content); ?>
If just the needed decryption key but not the needed verifcation key is part of my gpg keyring, the message gets decrypted anyways.
$ gpg --decrypt my_encrypted_file > decrypted_file gpg: encrypted with 2048-bit RSA key, ID [id_of_key_receiver], created 2019-08-08 "KeyInfo <email@example.com>" gpg: Signature made Fri Aug 16 12:16:50 2019 CEST gpg: using RSA key [id_of_key_sender] gpg: Can't check signature: No public key $ cat decrypted_file This is a secret message
I'm aware of this method but it isn't very elegant
$ echo $? 2
Is there a way/command line argument so that gpg decrypt fails when the signature can't be verified?