Linux Intro: Signing and verifying data using GPG

In this video we will be using GPG to sign and verify data. Signing is used as a secure way to check whether data has been modified from the time of signing. We sign the data with our private key. Other users can verify the data and signature by using your public key.

We are using Ubuntu Linux with the default install of GPG. Private keys were already generated.

010001000100011001010011011000110110100101100101011011100110001101100101
Get more Digital Forensic Science

010100110111010101100010011100110110001101110010011010010110001001100101

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.

[jacksmith]

This is exactly what I was looking for. Thank you so much. Many of my non tech friends find this boring but I find it fascinating

[foobars]

6:22 "if my website is compromised... they could change the hash"
7:22 "if an attacker changed the file my public key would not verify it correctly"

They still need to have somehow received a valid public key which wasn't compromised and this isn't something you addressed.

[MsDelta]

Hi, James, thank you very much for your tutorial which I found very well explained and useful.

[SirSidi]

this is better and different than using just a hash which a hacker can modify if they change the file, in that even if they change the signature file too, your gpg wont pass the verification because the hacker signed the file with a key different than the legitimate one which you must have imported before and which your system trusts.

[nikiit]

Hello, Very detailed explanation, appreciate the good work .

[claudioa.parragonzalez]

what if the attacker gets the original file&signature, verify it, copy that info, and generates its own signature recreating all that info?

[nipponese]

Just wondering if you setup tac to be an alias for cat?

[bitcanics]

im only 2 min in this but this is a nice video, Im subscribing

[hellothere]

Good, clear content on a specific issue. Cheers

[deltakid]

Could you please point the other video where you explain how to generate keys? Thank you.

[cipherswami]

Cant the attacker make his own set of key pair using the info displayed (Name, mail) and modify the text and now generate the new signature file. And yes, may be the ID and time would have changed, but those give no authenticity.

[drmaybe]

Thanks for the useful video, but TBH I would have preferred without the backing track.

[mrt_]

So the signature is basically a hash for the data, that is salted with the private GPG/PGP key, so there can not be created a hash/signature for that data without the private key only you have.
Am I correct?
If this is how it is, you would probably have to store the public key on a third party place so it can not be replaced.

[christophlinse]

Content is good, but please turn off the background music next time ;)

[jayshah]

.gpg binary file can be either signature or public key right? How do we know which is it?

[Kirmo]

well how are other people supposed to get the public key?

[ajlozadaro]

Hello! Returning to the example: "If your system is compromised", the attacker could put a new test.txt and create a new signature putting your same data that appears in the verification, so what is the point of all this? I wish someone could clarify this doubt for me. Thank you.

[isapir]

I'm running gpg on Windows via MSYS2 and getting the error message "gpg: Can't check signature: public key not found". Any ideas? Thanks

[zaidgharaybeh]

But how can the users verify that your public key hasn't been tampered with? Seems like it's the same problem with using hashes in the first place? Can you make a video on how to safely share your public key without it being tampered?

[armandoargolvini]

Do we need the awful music in the background?

Otherwise, that was a good job. Everything you said was correct.