Get GPG signature without decryption

Question

I use GPG on awsLinux, currently version 2.0.22. Before exchanging a file with someone we exchange public keys, so signatures can be confirmed for the files transmitted. Their public key is imported into my keychain for this purposes.

When decrypting the files I get a line like this one:

gpg: Good signature from "John Doe <[email protected]>" 

However when using --list-packets and entering the passphrase, I get something like:

:signature packet: algo 1, keyid 123abc456def
         version 4, created 123456789, md5len 0, sigclass 0x00

Is there a way to get & check the signature without needing the passphrase or decrypting?

Answer 1

This depends whether the message was first encrypted and then signed, or first signed and then encrypted.

Encrypt-then-Sign

In this case, you can check the validity of the signature with gpg --verify. It will look something like this:

gpg: Signature made Mon 01 Aug 2022 11:30:33 PM UTC
gpg:                using RSA key 2D59082CF356C49D8BEEB9A2D9530CC557DBD878
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   2  signed:   1  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: depth: 1  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 1f, 0u
gpg: next trustdb check due at 2022-08-11
gpg: Good signature from "Shuten-Douji" [ultimate]

As you can see, the validity of the signature is checked before any decryption is performed.

Sign-then-Encrypt

In this case, it is impossible to check the signature of the file before decrypting it. This is because the signature itself is also encrypted by gpg, meaning that you don't have access to it without prior decryption.

Unfortunately for you, Sign-then-Encrypt is the default mode of operation for gpg, if you create a message with gpg --encrypt --recipient Shuten-Douji --sign.