0

I'm encrypting and signing data with the PHP function gnupg_encryptsign() (docs) which has the strange behaviour of signing first and encrypting afterwards.

I'm aware of this thread saying this is indeed a strange behaviour but does not provide a solution.

Decrypting the data with the gpg binary works, even if I can't verify the signature (I want it to error when the signature can't be verified).

Consider the following pseudo code for better imagination:

<?php

$gpg_ressource = gnupg_init();

gnupg_addencryptkey($gpg_ressource, $pub_key_receiver);
gnupg_addsignkey($gpg_ressource, $priv_key_sender);

$content = gnupg_encryptsign($gpg_ressource, 'This is a secret message');
file_put_contents('./my_encrypted_file', $content);

?>

If just the needed decryption key but not the needed verifcation key is part of my gpg keyring, the message gets decrypted anyways.

$ gpg --decrypt my_encrypted_file > decrypted_file
gpg: encrypted with 2048-bit RSA key, ID [id_of_key_receiver], created 2019-08-08
    "KeyInfo <key@info.de>"
gpg: Signature made Fri Aug 16 12:16:50 2019 CEST
gpg:                using RSA key [id_of_key_sender]
gpg: Can't check signature: No public key
$ cat decrypted_file 
This is a secret message

I'm aware of this method but it isn't very elegant

$ echo $?
2

Is there a way/command line argument so that gpg decrypt fails when the signature can't be verified?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.