Posts from 2005

Verifying digital signatures

I recently downloaded the samhain file integrity verification suite, and wanted to verify the authenticity of the package. The samhain developers distribute samhain as tar archive, which includes the source code and a detached ASCII signature file: To verify the source code that is contained in the file samhain-2.0.10a.tar.gz using the detached ASCII signature stored in the file samhain-2.0.10a.tar.gz.asc, I downloaded the samhain developers public key, and imported it into my keychain with the gpg "--import" option: Once the public key was imported, I used gpg's "--fingerprint" option to extract a digital fingerprint from each public key: Once I had the fingerprint and the keyid, I verified both pieces of information with a trusted source. After I verified the authenticity of the key I imported, I used gpg's "--verify" option along with the signature file (an encrypted hash) to verify the files contents with the key I just imported: Verifying signatures can help ensure that the source code you download hasn't been replaced with a malicious variant. The gpg(1) manual contains lots of information on signatures, and provides a detailed breakdown of the available gpg options.