4

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig.

What is this file? How can I generate one and send it with my .asc file?

Thanks.

1 Answer 1

2

The .sig file is a detached signature. You use your key to sign a file to certify its authenticity. If the file is changed in any way, the verification process will fail and the party that received the file will know that it has been tampered with after you sent it out.

I believe the .asc.sig you received is a certificate of that guy's public key certifying its authenticity.

You can append the signature to the file itself or have it in a separate file. In this case, instead of appending the signature to the file, the signature is in a standalone file.

To sign it: gpg -a --output doc.asc.sig --detach-sig doc

-a is to create an ascii armored output
doc.asc.sig is the filename you want for the signature
doc is the filename you wish to sign

4
  • 2
    Why would someone sign his own PGP key? What is the benefits? Thanks.
    – user61429
    Nov 26, 2014 at 2:34
  • Its controversial, as highlighted on this site iusmentis.com/technology/remailers/selfsign.html Nov 26, 2014 at 2:37
  • 2
    Somehow, it is a self-signature, but... self-signing usually refers to certification signatures issued by your primary key on your own user IDs, and shouldn't be a detached signature.
    – Jens Erat
    Nov 26, 2014 at 9:59
  • 1
    @user3686362: A self-signature provides proof against tampering, but not additional trust.
    – Bob Brown
    Nov 26, 2014 at 14:28

You must log in to answer this question.