5

One can sign a file using PGP, using clearsign option by performing following command in CMD

gpg --clearsign filename

What kind of algorithm does GnuPG uses for clearsign option such that even after performing signature, the output signature is in readable fromat?

I read a manual that said how clearsign option works but I am not able to understand it. It is available here.

According to manual, armor is applied to signature which makes signature unreadable. But the question was how clearsign make signature readable.

But, how can one control output of a signature, composed of a hash algorithm and an encryption function, as cleartext?

By using hash and encryption function, how can output be guaranteed into range of ASCII characters that are readable?

Varun Raval
  • 460
  • 1
  • 4
  • 15
  • What do you mean by "Control the output of a signature"? Given a message and a hash plus public/private key the signature is determined uniquely (for RSA). – Henno Brandsma May 23 '16 at 19:16
  • I'd say the armour makes it readable (for mail clients), the underlying binary version could be easily garbled in some file formats. – Henno Brandsma May 23 '16 at 19:34

1 Answers1

8

The signature is always binary, really. The clearsign only means that the signature is computed not over the compressed message but over the original message, if it is in text format. This means that the signed message is still readable to the recipient (after the ----BEGIN PGP SIGNED MESSAGE---- header) which means that in a mail the recipient can still read the message without going through a PGP program. The recipient still needs such a program to verify the signature.

As the signature is always binary but needs to be sent in a text format sometimes, this means that the signature is encoded as base64, to ensure it's also in text format. If you don't do clearsign, but sign, the whole message is compressed first and then signed and the total is base64 encoded. The message would still be readable to anyone (after base64 decoding and decompression). So the standard ASCII armour encoding is used to guarantee printable ASCII output. But this final encoding is just for convenience, the underlying binary form is the actual signature that is verified.

Maarten Bodewes
  • 90,524
  • 13
  • 150
  • 263
Henno Brandsma
  • 2,116
  • 11
  • 12