any online solution to check digital signatures?

Post by sobriquet
Hello.
I was wondering if there are any websites where you can verify digital
signatures, similar to how
there are websites like virustotal.com where you can perform an online
scan of a suspicious file.
Does anyone know of something along those lines?
Kind regards and thanks in advance, Niek

You can easily verify that the signed file or message has not been
altered using any OpenPGP application (e.g., PGP, GPG). This is called
verifying itegrity.

The only way you can verify that the person who claims to have signed
the file or message is really who he or she claims is through the Web of
Trust. This is called verifying authenticity.

For authenticity, either (1) you have met that person face-to-face, have
seen proof of that person's identity (e.g., a passport with photo), and
that person has confirmed the fingerprint, size, and type (i.e., RSA
v.3, RSA v4., or DH/DSS) of the public key you are using to check the
signature, or else (2) you trust someone else who has done that, you
have done that with the someone else, and the someone else has digitally
signed the original signer's public key. Generally, if you rely on
someone else, you really should rely on two someones else to have done
the same thing for the same original signer.

--
David E. Ross
<http://www.rossde.com/>.

Don't ask "Why is there road rage?" Instead, ask
"Why NOT Road Rage?" or "Why Is There No Such
Thing as Fast Enough?"
<http://www.rossde.com/roadrage.html>

sobriquet

2009-09-05 00:03:59 UTC

You can easily verify that the signed file or message has not been
altered using any OpenPGP application (e.g., PGP, GPG). This is called
verifying itegrity.

The message is in Dutch, but it can be found here via
groups.google.com:
http://groups.google.nl/group/nl.foto/msg/2b4972ba8159276e?hl=nl&dmode=source

I've viewed the original message via the groups.google usenet
interface (ensuring the email address is visible), selected, copied
and pasted the complete text in wordpad, saved it as a .txt file and
attempted to authenticate the message. I've succeeded to look up the
public key from the poster from the key server, but somehow
authentication fails for an unknown reason.

Post by David E. Ross
The only way you can verify that the person who claims to have signed
the file or message is really who he or she claims is through the Web of
Trust. This is called verifying authenticity.
For authenticity, either (1) you have met that person face-to-face, have
seen proof of that person's identity (e.g., a passport with photo), and
that person has confirmed the fingerprint, size, and type (i.e., RSA
v.3, RSA v4., or DH/DSS) of the public key you are using to check the
signature, or else (2) you trust someone else who has done that, you
have done that with the someone else, and the someone else has digitally
signed the original signer's public key. Generally, if you rely on
someone else, you really should rely on two someones else to have done
the same thing for the same original signer.

I've (partially) read and think I grasped the basic concepts from the
guide to using gpg4win:
http://gpg4win.de/handbuecher/novices.html

At first sight the program looked very promissing, but it crashes
extremely frequently (compared
to most other programs I'm using).

sobriquet

2009-09-05 00:06:26 UTC

Post by sobriquet
[..]
I thought it was easy and I tried it with gpg4win... but that software
(gpa/kleopatra) tends
to crash a lot on my vista system (maybe because it .

.. (maybe because it's a 64 bit system).

David E. Ross

2009-09-05 02:57:03 UTC

Post by sobriquet

You can easily verify that the signed file or message has not been
altered using any OpenPGP application (e.g., PGP, GPG). This is called
verifying itegrity.

I thought it was easy and I tried it with gpg4win... but that software
(gpa/kleopatra) tends
to crash a lot on my vista system (maybe because it .
So I tried to authenticate the digital signature from a simple usenet
message via the dosprompt (as
http://www.ibbu.nl/~nsprakel/gpg-check1.jpg
The message is in Dutch, but it can be found here via
http://groups.google.nl/group/nl.foto/msg/2b4972ba8159276e?hl=nl&dmode=source
I've viewed the original message via the groups.google usenet
interface (ensuring the email address is visible), selected, copied
and pasted the complete text in wordpad, saved it as a .txt file and
attempted to authenticate the message. I've succeeded to look up the
public key from the poster from the key server, but somehow
authentication fails for an unknown reason.

I've (partially) read and think I grasped the basic concepts from the
http://gpg4win.de/handbuecher/novices.html
At first sight the program looked very promissing, but it crashes
extremely frequently (compared
to most other programs I'm using).

Verification fails because the message was altered after it was signed.
I can readily thought of two possible alterations.

It was possible that line-wrapping was done after the message was
signed, either by the sending application (Forte Agent) or by Google
Groups (Google discussiegroepen). This is a frequent cause of
verification failure with E-mail and newsgroup messages. It is very
important to set the line-length for wrapping in the OpenPGP application
to fewer characters than might be used by the sending application.

It was also possible that non-visible characters were altered in
rendering the message in a Web page. I spent quite some time several
years ago trying to develop a method for signing the content of Web
pages. It just does not work! In my experimenting, I found that the
major problem was with the end-of-line (EOL) or line-break. In Windows,
this is a carriage-return and line-feed (CR/LF). In UNIX, this is
merely a LF. On top of that, some applications do not follow the EOL
convention used by the operating system.

For your particular message, however, a third situation is the cause.
Visible characters have been altered in a way not visible to the user.
Where we see > and >> for quoting prior messages, this message actually
has > and >>, which can be seen in the Web source. The
original likely had > and >>; but Google altered those to conform with
the requirements of HTML, where > has a special meaning. This
alteration is sufficient to invalidate the OpenPGP signature.

This last situation vividly illustrates why a real newsreader
application should be used instead of Google.

--
David E. Ross
<http://www.rossde.com/>.

Don't ask "Why is there road rage?" Instead, ask
"Why NOT Road Rage?" or "Why Is There No Such
Thing as Fast Enough?"
<http://www.rossde.com/roadrage.html>

Guy

2009-09-05 05:17:30 UTC

Post by David E. Ross
Verification fails because the message
was altered after it was signed.

$ nntpx -s nntp.aioe.org -c "article <***@www.bozweb.net>" | gpg --verify
gpg: invalid armor header: ID 0x51F5C780\r\n

$ nntpx -s nntp.aioe.org -c "article <***@m27.itconsult.net>" | gpg --verify
gpg: Signature made 08/29/09 22:05:10 using RSA key ID 70B61F81
gpg: WARNING: digest algorithm MD5 is deprecated
gpg: please see http://www.gnupg.org/faq/weak-digest-algos.html for more information
gpg: Good signature from "Timestamp Service <***@itconsult.co.uk>" [uncertain]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4B 12 BC D5 78 85 11 06 3B 54 31 90 E0 9D F3 06

$

--
OpenPGP: id=740405FCD57FDDC1; preference=signencrypt;
url=http://guysalias.fateback.com/pgpkeys.txt

dohduhdah

2009-09-05 06:28:41 UTC

Post by David E. Ross
Verification fails because the message
was altered after it was signed.

gpg: invalid armor header: ID 0x51F5C780\r\n
gpg: Signature made 08/29/09 22:05:10 using RSA key ID 70B61F81
gpg: WARNING: digest algorithm MD5 is deprecated
gpg: please seehttp://www.gnupg.org/faq/weak-digest-algos.htmlfor more information
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4B 12 BC D5 78 85 11 06 3B 54 31 90 E0 9D F3 06
$
--
OpenPGP: id=740405FCD57FDDC1; preference=signencrypt;
url=http://guysalias.fateback.com/pgpkeys.txt

http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1

Somehow I can't retrieve the key with ID 0x70B61F81 in GPA
I can find it on the server, but somehow it will not let me import it
(not even at the command prompt with 'gpg --recv-key 0x70B61F81').
Hence I can't test if I can authenticate that message.

Guy

2009-09-05 06:54:16 UTC

Post by dohduhdah

Post by David E. Ross
Verification fails because the message was altered
after it was signed.

gpg: invalid armor header: ID 0x51F5C780\r\n
gpg: Signature made 08/29/09 22:05:10 using RSA key ID 70B61F81
gpg: WARNING: digest algorithm MD5 is deprecated
gpg: please see http://www.gnupg.org/faq/weak-digest-algos.html for more information
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4B 12 BC D5 78 85 11 06 3B 54 31 90 E0 9D F3 06
$

http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1

The message can not be verified from content available via Google.
(see below)

Above "invalid armor header" message shows "BAD signature" after
removal of the "invalid armor header".

Post by dohduhdah
Somehow I can't retrieve the key with ID 0x70B61F81 in GPA
I can find it on the server, but somehow it will not let me import
it (not even at the command prompt with 'gpg --recv-key
0x70B61F81'). Hence I can't test if I can authenticate that
message.

Don't use GPA. What does "gpg --recv-key" show?

$ gpg --recv-key 0x70B61F81
gpg: requesting key 70B61F81 from hkp server pgp.mit.edu
gpg: key 70B61F81: accepted non self-signed user ID "Timestamp Service <***@itconsult.co.uk>"
gpg: key 70B61F81: "Timestamp Service <***@itconsult.co.uk>" 2 new signatures
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 2 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2010-01-01
gpg: Total number processed: 1
gpg: new signatures: 2

$ wget -O foo.txt "http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1?dmode=source&output=gplain"
--2009-09-05 01:51:15-- http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1?dmode=source&output=gplain
Resolving groups.google.com... 209.85.225.100, 209.85.225.101, 209.85.225.102, ...
Connecting to groups.google.com|209.85.225.100|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: `foo.txt'

[ <=> ] 6,624 --.-K/s in 0.04s

2009-09-05 01:51:16 (181 KB/s) - `foo.txt' saved [6624]

$ gpg --verify foo.txt
gpg: Signature made 08/29/09 22:05:10 using RSA key ID 70B61F81
gpg: WARNING: digest algorithm MD5 is deprecated
gpg: please see http://www.gnupg.org/faq/weak-digest-algos.html for more information
gpg: BAD signature from "Timestamp Service <***@itconsult.co.uk>" [uncertain]

$ nntpx -s nntp.aioe.org -c "article <***@www.bozweb.net>" | mtr -o+ "ID 0x51F5C780" = \z | gpg --verify
gpg: Signature made 09/03/09 15:14:38 using DSA key ID 51F5C780
gpg: BAD signature from "cmkools <***@bozweb.net>"

$

--
OpenPGP: id=740405FCD57FDDC1; preference=signencrypt;
url=http://guysalias.fateback.com/pgpkeys.txt

dohduhdah

2009-09-05 08:09:42 UTC

Post by dohduhdah

Post by David E. Ross
Verification fails because the message was altered
after it was signed.

http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1

The message can not be verified from content available via Google.
(see below)
Above "invalid armor header" message shows "BAD signature" after
removal of the "invalid armor header".

Don't use GPA. What does "gpg --recv-key" show?
$ gpg --recv-key 0x70B61F81
gpg: requesting key 70B61F81 from hkp server pgp.mit.edu
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 2 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2010-01-01
gpg: Total number processed: 1
gpg: new signatures: 2
$ wget -O foo.txt "http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1?..."
--2009-09-05 01:51:15-- http://groups.google.com/group/alt.security.pgp/msg/f1b2298cb8c773f1?...
Resolving groups.google.com... 209.85.225.100, 209.85.225.101, 209.85.225.102, ...
Connecting to groups.google.com|209.85.225.100|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: `foo.txt'
[ <=> ] 6,624 --.-K/s in 0.04s
2009-09-05 01:51:16 (181 KB/s) - `foo.txt' saved [6624]
$ gpg --verify foo.txt
gpg: Signature made 08/29/09 22:05:10 using RSA key ID 70B61F81
gpg: WARNING: digest algorithm MD5 is deprecated
gpg: please seehttp://www.gnupg.org/faq/weak-digest-algos.htmlfor more information
gpg: Signature made 09/03/09 15:14:38 using DSA key ID 51F5C780
$
--
OpenPGP: id=740405FCD57FDDC1; preference=signencrypt;
url=http://guysalias.fateback.com/pgpkeys.txt- Tekst uit oorspronkelijk bericht niet weergeven -
- Tekst uit oorspronkelijk bericht weergeven -

Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.

C:\Users\dohduhdah>gpg --recv-key 0x70B61F81
gpg: requesting key 70B61F81 from hkp server keys.gnupg.net
gpg: key 70B61F81: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg: w/o user IDs: 1

C:\Users\dohduhdah>gpg --verify test-msg2.txt
gpg: Signature made 08/30/09 05:05:10 W. Europe Daylight Time using
RSA key ID 70B61F81
gpg: Can't check signature: No public key

C:\Users\dohduhdah>type test-msg2.txt
-----BEGIN PGP SIGNED MESSAGE-----

########################################################
#
# The text of this message was stamped by
# stamper.itconsult.co.uk with reference 0581053
# at 03:05 (GMT) on Sunday 30 August 2009
#
# For information about the Stamper service see
# http://www.itconsult.co.uk/stamper.htm
#
########################################################

This is a weekly posting showing daily summary signatures
made by the PGP timestamping service stamper.itconsult.co.uk
for the week whose dates are shown below.

Stamper provides both digital timestamping and email proof
of posting certificates.

The purpose of this posting is to publish these signatures
in order to add weight to the trustworthiness of the service.

For information about the service (and an explanation of
the details within this posting), send an email message to:-

***@stamper.itconsult.co.uk

or see:-

http://www.itconsult.co.uk/stamper.htm

Matthew Richardson

- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0580311 Summary Signature for: 20090823

iQEVAgUASpHLHYGVnbVwth+BAQGzrgf+I6m1+USu7lQQW9JdhXIeHFLH2s6Bbpm4
X88JHsVTShLceiBwrN9glESQ8upLkzRnKPypel3ZwYoE1A5Lh07uhuhl/Ucvot7P
xAbcHOJ8vyVzDVvKacTOh7YpvbvBMz/dxaKLr/JRLGELX9bxoSiaN3yyjTaqHVxa
II8hLmulKfk9yt7hspwBHzuCOsRkNpVm3qzi+qoJ+BKdsd/b+V+on0oIh8A1W5B/
kefsY9hQa4CwHZdmHH4mxyNfNLdvZaC/lc/hi1/HoZ6iz535hYrXO7wiL5GXKtp+
ulN7JZUn6n8+VMX/5brOjcViPYRuGQaBxTqb8GMl+p/8CDzDEDsuiA==
=jAzS
- -----END PGP MESSAGE-----
- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0580427 Summary Signature for: 20090824

iQEVAgUASpMcnYGVnbVwth+BAQG56gf9Hiqnf0H/FccuAYw1+iSytsw0TJ6uI2LD
N4ZN+zD9+DGRnq5p6fI0AmA03NMDajXBMr520Q3RZ9rpGAuff1OU1ZqEzdJWdxos
IDueq9y8tZ1F3fWJTrIH49KcfyFO6lzBhklMuYQ2u/XC4mEcL/ns8DRkMqlQlTkM
r1hgQJtgltEQuxocz3BPFETtlyGTTROM0NKcPeEEObBkKchihv/YyNPNnNvVphCa
oOGNaUqQ5YIQQOi/Vb+ugCT9QnN/HgdCJn3ggve/tEYjq1fod2t6zNAcsXkv3OPK
LINGdSM07MwShiajlyHbNhUMFlGtYkrOJ8zcBXnTd1dIfC6i7Rx9Vw==
=219k
- -----END PGP MESSAGE-----
- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0580545 Summary Signature for: 20090825

iQEVAgUASpRuHYGVnbVwth+BAQFz7wf8DhcwH0HtvfUSC+twOAAhYjPG+qVAAGxm
93XzLsUafMi3CuGCEMWJa6SDjqjp0lGlfx3fWz91QBt9HRnOgSra4ahZnO9z9IiF
Ky+3IdTU/mrt4S3YBdiA3gwICeG4+H/ggQjrifiyZyi2TuGBHeMq0bDBf2glcz46
bNop6rmYFuMa1HVk9MEID5BDQvzhZuX5TaeOKaNTRLXwNKwBAx43BK7W68iR5Q16
0JvKtlBw7DDLOpkmxhfL7bgx2U+qUbwSa99GJUkwZ2kmUmhNh/MoBpp748q3Bj1F
tAHAtUSGixKYQzsFi84KJtoRKIm30RQrJno/aMMvMZiD2GqHEJrBig==
=Qgwr
- -----END PGP MESSAGE-----
- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0580676 Summary Signature for: 20090826

iQEVAgUASpW/nYGVnbVwth+BAQFboQf7Blw4N0AkDwjgqqGrhhNTKAYLeIA+eqM+
GpR20j9YD1MW7uKvPjgKIE2fOOs/dRrj5K061RO8zxK2HxCDKiVazbe2SHiM9dn+
LSLaEjOK/deI0FBbsjhP8CO+baPrw+HoG0h3egbXqwLpAZ0hdIcplvZTuPErZLC7
hqRjuT4ceqWXh7LdCl+4DTkAgOYikH/aEJxqnIBDGLKWuWvK6UOft8XYJX4DeopQ
wb5Gr0SkVlc5P6CVgirE9soPCZYXUwwW+Py53LixcTC9V/zmZYzXFxZ69rpRBLSo
wNHBjDp6ZCUBK15ixS6SdZb7EkgDsM+TRY/I66ko9g/iYnW2pKp74A==
=Ftl/
- -----END PGP MESSAGE-----
- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0580778 Summary Signature for: 20090827

iQEVAgUASpcRHYGVnbVwth+BAQHUWgf9Fgk3O2O/W4pzUUrCXiqYCpfUUjsu5Syi
lccvyhI/KRdXt/iaocbi6WUHyLZX7TyqV0GqxmNAhf7dpgt2BPncqJ8twrbDW9S0
nVCtLQgaZEtyciqdptYRqmxreKANdJZl5eqz87s+yJIclOnY3LE94SLkYWMyIut3
24/ztG3/v+8s5LsuNOBIDKgOWZCCmKe9yeb4XHRKbquG3G3tab8mNQkX2WEb4agU
bV6SdBbtRCaY4YUrwl/ekWrT21lAzGoBrGPiE8BS2AUkk/WYPihtLfoPpUO+KTog
8FcFJeNqFv3CZ4PheKaA+Jp0NxkXBGYUCKEYp92K3dBv0j4Eq2lu7Q==
=MeTZ
- -----END PGP MESSAGE-----
- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0580936 Summary Signature for: 20090828

iQEVAgUASphinYGVnbVwth+BAQFdjwf7BmKjknUKW1l8nlKPzrLpryeNQAUMeO0c
vLTvxMckwUxgHcp734GfNVZPln0iHx+f7kSCzEaMeGKDigGmWXjhCcyHtpJ6O5VU
97W7yo4ZgDaU4ymkj4WN2dqpXYrd87a2ViwZ3G/suyPialUhFUdFDbF8M67MjaX0
VrUBlhxuFtkoRhYE4whgx9V5h+kAWCpRxGkVlzhQjsluoPQwynjsW6uocdo9wRMY
XHL9xBekktgmD4d8HFOqMhGlWM3AAoMcPs5uChIxPKfd4Fq+pDx2rSdrWZ3xQs6b
tS2pDn575gKtDNC3xpGsVtidKIOhr+5g0xEG3cOfWIJ5hCXHGY0TIA==
=zvcn
- -----END PGP MESSAGE-----
- -----BEGIN PGP MESSAGE-----
Version: 2.6.3i
Comment: Stamper Id: 0581040 Summary Signature for: 20090829

iQEVAgUASpm0HYGVnbVwth+BAQE4iQf8C1MW/xVvGt88UHR2I2K5/E7wNRD2B/6z
K1kSoCFCJOdaQgRE4DpFeNdvV5ckksgjDI53NKtNKwDwiUnhaFFh9SIVqu5/wizl
GfXz+u4tWD7sf3eIldvGPiuoRU1JvWrAWLwEYQzLRlXX5qXiPTw0LRyNWaQiL9uR
DCUnFNsR9mnmwcvlxkIY6lufcgGhoGMADSnVc2aZ5o5rM6GRRVs6Fp9YinH/JxCj
gx1UlY2WVsqX6Flrl+bMq4YQ3wO4ZXGuB2wp1HGatUk6zy8CydtghGjfGqN85/k7
rE++m3We5DWLs7FZbEnDwRZ8cfC2wRmHi7cDC22w1yFx4b1QaCYqDw==
=J4kh
- -----END PGP MESSAGE-----

Guy

2009-09-05 09:13:07 UTC

Post by dohduhdah
C:\Users\dohduhdah>gpg --recv-key 0x70B61F81
gpg: requesting key 70B61F81 from hkp server keys.gnupg.net
gpg: key 70B61F81: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg: w/o user IDs: 1

We each employ a different trust-model.

Try:
gpg --allow-non-selfsigned-uid --recv-key 0x70B61F81

--
OpenPGP: id=740405FCD57FDDC1; preference=signencrypt;
url=http://guysalias.fateback.com/pgpkeys.txt

dohduhdah

2009-09-05 14:58:37 UTC

We each employ a different trust-model.
gpg --allow-non-selfsigned-uid --recv-key 0x70B61F81
--
OpenPGP: id=740405FCD57FDDC1; preference=signencrypt;
url=http://guysalias.fateback.com/pgpkeys.txt

Ah thanks.. that did the trick.
Well.. the test-msg2.txt also got verified... so it seems it actually
does work
ok if you select the txt from a msg via groups.google (but you have to
ensure
prior to that, that email addresses are unlocked) in 'display
original' mode (where you
see the full headers), select-copy-paste it from groups.google to
wordpad and safe
it as an MS-DOS txt file, then it does seem to work that gpg will
still verify the
original usenet message.

I can also use a newsreader like newsbin or something equivalent and
access newsgroups
via motzarella or an equivalent free newsserver, but I tend to prefer
groups.google, because I frequently search and explore the usenet
archives available via the groups.google interface.

David E. Ross

2009-09-05 15:07:32 UTC

We each employ a different trust-model.
gpg --allow-non-selfsigned-uid --recv-key 0x70B61F81

The message in question -- per the link to
<http://groups.google.nl/group/nl.foto/msg/2b4972ba8159276e?hl=nl&dmode=source>
in the first reply from sobriquet (the original poster in this thread)
-- was signed by a key with the ID 0x51F5C780.

--
David E. Ross
<http://www.rossde.com/>.

Don't ask "Why is there road rage?" Instead, ask
"Why NOT Road Rage?" or "Why Is There No Such
Thing as Fast Enough?"
<http://www.rossde.com/roadrage.html>

dohduhdah

2009-09-05 15:32:03 UTC

We each employ a different trust-model.
gpg --allow-non-selfsigned-uid --recv-key 0x70B61F81

The message in question -- per the link to
<http://groups.google.nl/group/nl.foto/msg/2b4972ba8159276e?hl=nl&dmod...>
in the first reply from sobriquet (the original poster in this thread)
-- was signed by a key with the ID 0x51F5C780.

Yes, but the problem with that message seems to be the error "invalid
armour header".
I've notified the poster of that message (who signed it with the key
with that ID) of this discussion and the fact that it's not just me
(but also Guy for instance) who is unable to authenticate his posting.
I will search for some other examples of signed usenet messages on
groups.google to see if
it works reliably to authenticate them via GPA (or via gpg at the
command prompt if GPA, a graphical userinterface to gpg, doesn't seem
to work), when I use my method to retrieve them from groups.google
(via the original message mode with unlocked email addresses).
GPA does authenticate the test-msg2.txt once the key has been
successfully imported via the command prompt (using the command Guy
mentioned).

Post by David E. Ross
--
David E. Ross
<http://www.rossde.com/>.
Don't ask "Why is there road rage?" Instead, ask
"Why NOT Road Rage?" or "Why Is There No Such
Thing as Fast Enough?"
<http://www.rossde.com/roadrage.html>- Tekst uit oorspronkelijk bericht niet weergeven -
- Tekst uit oorspronkelijk bericht weergeven -

dohduhdah

2009-09-05 15:34:18 UTC

We each employ a different trust-model.
gpg --allow-non-selfsigned-uid --recv-key 0x70B61F81

The message in question -- per the link to
<http://groups.google.nl/group/nl.foto/msg/2b4972ba8159276e?hl=nl&dmod...>
in the first reply from sobriquet (the original poster in this thread)

Sorry for the confusion. dohduhdah=sobriquet
(see IP in the header)
I just have two groups.google accounts (linked to two different name
+email combinations)
to circumvent the daily posting limit groups.google imposes.

Post by David E. Ross
-- was signed by a key with the ID 0x51F5C780.
--
David E. Ross
<http://www.rossde.com/>.
Don't ask "Why is there road rage?" Instead, ask
"Why NOT Road Rage?" or "Why Is There No Such
Thing as Fast Enough?"
<http://www.rossde.com/roadrage.html>- Tekst uit oorspronkelijk bericht niet weergeven -
- Tekst uit oorspronkelijk bericht weergeven -

Bob Henson

2009-09-08 16:37:42 UTC