[SOLVED] Ensuring data integrity with subkeys

Sefyir · 03-29-2017, 12:54 PM

This may have a XY problem component to it so I'll explain my goal:
I want to be able to give a person a file to keep as a "backup", let them hold onto it, use it for their own purposes if desired and at their whim return this file to me to restore with. However, I should be able to verify automatically that

The file is unchanged
The file was from me

My solution is to use gpg and sign the file using a detached signature with subkeys

When I verify using a subkey, I get this result

Code:

gpg --verify file file.sig
gpg: Signature made Wed 29 Mar 2017 10:50:14 AM PDT using RSA key ID 7B1F325C
gpg: Good signature from "Sefyir"

The problem is 7B1F325C is the subkey id, not the main key id.
Is it possible to extract this from a detached signature without requiring interactivity?

ntubski · 03-29-2017, 01:45 PM

Quote:

Originally Posted by Sefyir

However, I should be able to verify automatically that

The file is unchanged
The file was from me

You could use gpgv, with the --keyring option pointing to a keyring file containing only your own key.

Quote:

Originally Posted by Sefyir

The problem is 7B1F325C is the subkey id, not the main key id.

Why is that a problem?

Sefyir · 03-29-2017, 07:06 PM

Quote:

Why is that a problem?

It's not, but I need to identify if it's valid automatically. I needed to be able to reference what the main key id was so that multiple subkeys could be verified (expired + active)
However, soon after posting this a simple answer came to me (as always)

This should be true if 7B1F325C keyid is relevant to primarykeyid

Code:

$ gpg --list-keys 7B1F325C | grep -q primarykeyid

Quote:

You could use gpgv, with the --keyring option pointing to a keyring file containing only your own key.

I didn't know about this tool, I will have to keep it in mind, thank you! The problem is the same service checking the key will also issue signatures.
But this could be used in a more secure method of it..

ntubski · 03-30-2017, 10:24 AM

Quote:

Originally Posted by Sefyir

Quote:

You could use gpgv, with the --keyring option pointing to a keyring file containing only your own key.

I didn't know about this tool, I will have to keep it in mind, thank you! The problem is the same service checking the key will also issue signatures.
But this could be used in a more secure method of it..

Actually, the full gpg command has a --keyring option, so I guess the same trick should work with that one too.