I often hear that I should authenticate the signatures of important files I download, like Linux .iso 's and import applications like browser’s
But it seems very confusing so I have a few questions:
Are .PGP files bound to a specific file they can authenticate or could the same .pgp file authentificate different files if they are signed with the same key?
What is the difference between:
.pgp
.gpg
.asc
.sig
.sigstore
(Any other relevant signature file types?)
PGP/GPG is bound to person/organization.
With it you can check if file/message is from that person/organization and it integrity.
.asc - it is message encrypted with private pgp key - having public pgp key of that person/organization you can certify it is from that person/organization and see it’s content
.sig - it is signature file with files/packages hash encrypted with private pgp key that you can verify with public key of that person/organization
.sigstore - it is signature file for verifying file/package integrity and point of origin without using persons/organizations pgp key but with ephemeral key from Open Source Security Foundation (OpenSSF) with OpenSSF certyficate for that person/organization and a public ledger of made signing event
One small correction: an .asc file is usually an ASCII-armored OpenPGP message or signature, not necessarily encrypted. The filename alone doesn’t tell you whether it contains a signature or encrypted data.
To preface I am not 1000% sure on this stuff so please anyone who knows more correct me.
AFAIK there’s no such thing as a .pgp file.
PGP is a program developed in the 90’s, which was proprietary and made use of ciphers like RSA so every day people could actually use it. Before that, two normal people could not have a conversation over text the government could not crack, so it’s quite amazing really.
It was then made open source with OpenPGP - which is the modern implementation.
GPG (GNU Privacy Guard) is a free, open-source implementation of the OpenPGP standard. A .gpg file, as I understand it, is just an encrypted file.
Moving on to how to verify your software:
I recommend doing it, especially for Linux iso’s to make sure they are genuine and not corrupt, and absolutely 100000% for any crypto wallet.
Firstly, you need the developers public key. Sometimes it can be on the website’s page in the verification section, other times you need to dig a bit. It will either be a wall of text on the website, or a .asc file to download which is just a text file of that public key, that will be opened by your PGP software.
The public key is seen as a wall of text with -----BEGIN PGP PUBLIC KEY BLOCK----- at the beginning, and -----END PGP PUBLIC KEY BLOCK----- at the end.
You need to import that public key into your PGP program.
After that it’s simple, you just need the .sig or .asc file alongside the file you’re trying to verify. An .asc file can also be encrypted text, but it’s not the case for this example.
You then run:
gpg --verify “path to file”.sig “path to file”.iso or whatever the file extension is.
It’s basically saying, is this the signature of the corresponding public key and does it match this software. Sometimes you also need to verify a piece of software via the checksum, whereby the developer signs a file of the checksum with their public key, so you know it’s genuine, and you compare that checksum to the checksum of the file you downloaded.
Once you get the hang of it it’s okay. It’s just conceptually kinda confusing. I highly recommend this PGP tutorial by anti moonboy (and it’s a great channel overall anyway) to wrap your head around it. He goes over example of using PGP for both encrypted communications and also software verification.
There is also a whole subreddit called r/GPGpractice which is good to to ask questions in and also to find actual people to chat with using PGP as they want to learn it too.
It’s very simple on Android. "Verified Apps" app for Android pre-release
If you download an PGP signature from the page of an F-Droid app with your phone, it will give you a .pgp file, if you download with your desktop, it gives you an .asc file
Is a .PGP file bound to a specific file that it authenticates?
Is it always an encrypted message? Or can it also be a file that authenticates another file?
I don’t understand
What is an ephemeral key and where can I find the public ledger?
What is ASCII Armored?
This simply means human readable. ASCII Armor is binary to text conversion. So when you see a PGP encrypted message as it’s encrypted, it’s not ones and zeros or any crazy characters, it’s just recognisable, human readable text.
Yeah, signature files are really useful for verifying that a download hasn’t been altered. I’d make sure to verify the signature against the project’s official signing key, not just rely on a checksum posted on the same download page.