#695855 please provide a --verify command that outputs the signed data

Package:
gnupg
Source:
gnupg2
Submitter:
Ansgar Burchardt
Date:
2012-12-14 18:48:06 UTC
Severity:
wishlist
#695855#5
Date:
2012-12-13 15:35:25 UTC
From:
To:
Hi,

it would be very nice if gpg had a --verify command that would also output the
signed data. (Maybe "gpg --output - --verify"?) Otherwise you know the data is
signed, but still have to extract it somehow.

I have seen software using just

  gpg < $file

to try to do this.  However this doesn't make sure that the input is actually
signed; it would also accept data created with `gpg --store'.

I have also seen software (trying to) extract the data using the markers in a
clearsigned message (`gpg --clearsign') that could be tricked into processing
the wrong data (it did not look for the correct markers).

This would be prevented if there was an option to make gpg --verify also output
the data that was actually signed. Currently the only way to get something
similar seems to be `gpg --status-{fd,file}=... --decrypt < $file' and parsing
the status output, but that is significantly more work (esp. when processing
files in shell).

Ansgar
#695855#10
Date:
2012-12-14 18:03:36 UTC
From:
To:
On Thu, 13 Dec 2012 16:35, ansgar@debian.org said:

Verification of a signature is quite complicated.  The math is easy but
how to properly setup a scheme for automated signature checking is hard.
You need to figure out what has been signed, who signed, whether the key
is valid, and what to do if the key meanwhile expired.  Return just a
simple status code would need to hardwire a certain policy which needs
to be strictly followed.  I doubt that this is easier than to use
detached signatures, which instantly solve many of the problems.

That is actually pretty easy with a few lines of awk.  Remember, it is a
Unix tool; the Unix philosophy is that of a toolbox and not of highly
specialized tools.



Shalom-Salam,

   Werner
#695855#15
Date:
2012-12-14 18:03:36 UTC
From:
To:
On Thu, 13 Dec 2012 16:35, ansgar@debian.org said:

Verification of a signature is quite complicated.  The math is easy but
how to properly setup a scheme for automated signature checking is hard.
You need to figure out what has been signed, who signed, whether the key
is valid, and what to do if the key meanwhile expired.  Return just a
simple status code would need to hardwire a certain policy which needs
to be strictly followed.  I doubt that this is easier than to use
detached signatures, which instantly solve many of the problems.

That is actually pretty easy with a few lines of awk.  Remember, it is a
Unix tool; the Unix philosophy is that of a toolbox and not of highly
specialized tools.



Shalom-Salam,

   Werner
#695855#20
Date:
2012-12-14 18:44:26 UTC
From:
To:
Werner Koch <wk@gnupg.org> writes:

I agree that detached signatures are easier, but that should only change
the "what has been signed" part.  Having gpg output the signed data
would answer that.

For the rest, I'm mostly thinking of places where gpgv is used and one
has a keyring where all keys are trusted. I don't think more complicated
policies should be implemented using just the return code.

Ansgar