Sorry about the delay. I had a busy family weekend this weekend.
@guy038 said:
I would like to re-create my key-pair, with a size of 4096 bytes ( instead of 2048 ) I suppose that the best way is to delete my present key-pair and generate a new key-pair, afterwards, isn’t it ?
Yes.
In other words, Don must be the ONLY person which could be able to recover the original .7z archive in the Test.7z file , from the npp.7.6.5.bin.7z.sig signature, with the command :
gpg -u Notepad++ -o Test.7z -d npp.7.6.5.bin.7z.sig, because he would use the private key of his certificate ! Peter, am I right about it ?
Not quite. A signature is a one-way hash: you can take a file, and easily create the signature of the file; however, it is impossible to go the reverse direction. For example, if I were to sign my copy of the gpg.exe, I would see:
C:\Program Files (x86)\GnuPG\bin>gpg --detach gpg.exe
C:\Program Files (x86)\GnuPG\bin>ls -latr gpg.exe*
-rwxrwxrwx 1 Peter.Jones 0 1122816 2018-11-12 03:52 gpg.exe
-rw-rw-rw- 1 Peter.Jones 0 566 2019-04-08 06:05 gpg.exe.sig
There aren’t any compression algorithms that I know of that are good enough to encrypt-and-compress a 1.1MB gpg.exe into 566 bytes of gpg.exe.sig.
All you can do with the signature for a file is (1) verify that the file matches the signature, and (2) that the person who claimed to sign it is the one who signed it (based on whether the public key matches what’s in your keyring).
I think one of the confusions is that there are three different kinds of “signing” for files:
Commands:
-s, --sign make a signature
--clear-sign make a clear text signature
-b, --detach-sign make a detached signature
The --sign (-s) creates an output file that includes the original file, plus your signature of that file. For example, in signing the standard-input as the input file:
C:\Program Files (x86)\GnuPG\bin>gpg -a --sign
hello world
^Z
-----BEGIN PGP MESSAGE-----
owEBWgKl/ZANAwAIAa7S8NjBGc6nAcsTYgBcq0qBaGVsbG8gd29ybGQNCokCMwQA
...
-----END PGP MESSAGE-----
The --clear-sign will do the same, but it will include the message in plain text, rather than encoded in the base-64 message, like:
C:\Program Files (x86)\GnuPG\bin>gpg -a --clear-sign
hello world
^Z
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
hello world
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEUi8A41Z69RBzWhJIrtLw2MEZzqcFAlyrSs0ACgkQrtLw2MEZ
...
-----END PGP SIGNATURE-----
Finally, --detach-sign (-b) creates a file that has only the signature, without the original file embedded. This is as my example above, with the signature for gpg.exe being only 566 bytes
(in the examples above, I used the -a to “ascii-armor” the results, so the signatures were printable on the screen)
When a software distributor has available for download the original file blah.zip, alongside another file called blah.zip.sig, the .sig file is usually the detached signature created by --detach-sign, so does not contain the original file as well.
If you want a copy of the file that has the signature embedded in the archive, you would use just the --sign argument: without the -a ascii-armoring, it will go in blah.zip.gpg; with the -a ascii-armoring, it would go in blah.zip.asc.
Maybe this series of examples will make more sense:
----
Directory of C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example
04/08/2019 06:37 AM <DIR> .
04/08/2019 06:37 AM <DIR> ..
04/08/2019 06:36 AM 52,087 Temp.zip
1 File(s) 52,087 bytes
2 Dir(s) 110,105,284,608 bytes free
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>gpg --sign Temp.zip
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>dir
Volume in drive C is Windows
Directory of C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example
04/08/2019 06:37 AM <DIR> .
04/08/2019 06:37 AM <DIR> ..
04/08/2019 06:36 AM 52,087 Temp.zip
04/08/2019 06:37 AM 49,525 Temp.zip.gpg
2 File(s) 101,612 bytes
2 Dir(s) 110,105,165,824 bytes free
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>gpg -o NewTemp.zip --decrypt Temp.zip.gpg
gpg: Signature made 04/08/19 06:37:27 Pacific Daylight Time
gpg: using RSA key ZZZ___WORK_SIG___ZZZ
gpg: Good signature from "Peter C. Jones <peter.jones@__work__>" [ultimate]
gpg: aka "Peter C. Jones <peter.jones@__work__>" [ultimate]
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>dir
Volume in drive C is Windows
Directory of C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example
04/08/2019 06:37 AM <DIR> .
04/08/2019 06:37 AM <DIR> ..
04/08/2019 06:37 AM 52,087 NewTemp.zip
04/08/2019 06:36 AM 52,087 Temp.zip
04/08/2019 06:37 AM 49,525 Temp.zip.gpg
3 File(s) 153,699 bytes
2 Dir(s) 110,105,092,096 bytes free
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>fc Temp.zip NewTemp.zip
Comparing files Temp.zip and NEWTEMP.ZIP
FC: no differences encountered
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>del Temp.zip.gpg NewTemp.zip
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>gpg --detach-sign Temp.zip
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>dir
Volume in drive C is Windows
Directory of C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example
04/08/2019 06:39 AM <DIR> .
04/08/2019 06:39 AM <DIR> ..
04/08/2019 06:36 AM 52,087 Temp.zip
04/08/2019 06:39 AM 566 Temp.zip.sig
2 File(s) 52,653 bytes
2 Dir(s) 110,105,157,632 bytes free
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>gpg --verify Temp.zip.sig
gpg: assuming signed data in 'Temp.zip'
gpg: Signature made 04/08/19 06:39:03 Pacific Daylight Time
gpg: using RSA key ZZZ___WORK_SIG___ZZZ
gpg: Good signature from "Peter C. Jones <peter.jones@__work__>" [ultimate]
gpg: aka "Peter C. Jones <peter.jones@__work__>" [ultimate]
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>dir
Volume in drive C is Windows
Directory of C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example
04/08/2019 06:39 AM <DIR> .
04/08/2019 06:39 AM <DIR> ..
04/08/2019 06:36 AM 52,087 Temp.zip
04/08/2019 06:39 AM 566 Temp.zip.sig
2 File(s) 52,653 bytes
2 Dir(s) 110,105,157,632 bytes free
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>gpg -o OutTemp.zip --decrypt Temp.zip.sig
gpg: assuming signed data in 'Temp.zip'
gpg: Signature made 04/08/19 06:39:03 Pacific Daylight Time
gpg: using RSA key ZZZ___WORK_SIG___ZZZ
gpg: Good signature from "Peter C. Jones <peter.jones@__work__>" [ultimate]
gpg: aka "Peter C. Jones <peter.jones@__work__>" [ultimate]
C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example>dir
Volume in drive C is Windows
Directory of C:\Users\PETER~1.JON\AppData\Local\Temp\gpg-example
04/08/2019 06:39 AM <DIR> .
04/08/2019 06:39 AM <DIR> ..
04/08/2019 06:36 AM 52,087 Temp.zip
04/08/2019 06:39 AM 566 Temp.zip.sig
2 File(s) 52,653 bytes
2 Dir(s) 110,105,100,288 bytes free