this post was submitted on 26 Jul 2023
0 points (NaN% liked)

Ask Science

8596 readers
2 users here now

Ask a science question, get a science answer.

Community Rules

Rule 1: Be respectful and inclusive.Treat others with respect, and maintain a positive atmosphere.

Rule 2: No harassment, hate speech, bigotry, or trolling.Avoid any form of harassment, hate speech, bigotry, or offensive behavior.

Rule 3: Engage in constructive discussions.Contribute to meaningful and constructive discussions that enhance scientific understanding.

Rule 4: No AI-generated answers.Strictly prohibit the use of AI-generated answers. Providing answers generated by AI systems is not allowed and may result in a ban.

Rule 5: Follow guidelines and moderators' instructions.Adhere to community guidelines and comply with instructions given by moderators.

Rule 6: Use appropriate language and tone.Communicate using suitable language and maintain a professional and respectful tone.

Rule 7: Report violations.Report any violations of the community rules to the moderators for appropriate action.

Rule 8: Foster a continuous learning environment.Encourage a continuous learning environment where members can share knowledge and engage in scientific discussions.

Rule 9: Source required for answers.Provide credible sources for answers. Failure to include a source may result in the removal of the answer to ensure information reliability.

By adhering to these rules, we create a welcoming and informative environment where science-related questions receive accurate and credible answers. Thank you for your cooperation in making the Ask Science community a valuable resource for scientific knowledge.

We retain the discretion to modify the rules as we deem necessary.

founded 1 year ago
MODERATORS
sabbah@lemmy.world
AradFort@lemmy.world
ken_cleanairsystems@lemmy.sdf.org
count_of_monte_carlo@lemmy.world
0
How does a signing a post with a pgp key prove that you are actually the person behind the post? (lemmy.nz)
submitted 1 year ago by Fizz@lemmy.nz to c/askscience@lemmy.world
9 comments fedilink hide all child comments
 

I saw that people on the dark web would sign their posts with a PGP key to prove that their account has not been compromised. I think I understand the concept of how private and public keys work but I must be missing something because I don't see how it proves anything.

I created a key and ran gpg --export --armor fizz@... and I ran that twice and both blocks were identical. If I posted my public key block couldn't someone copy and paste that under their message and claim to be me?

you are viewing a single comment's thread
view the rest of the comments
[–] Crul@lemmy.world 0 points 1 year ago (1 children)

Isn't that for when you want to send a message to someone so only the recipient can read it?

If I understand correctly, OP is asking about signatures to prove the posted content comes from a specific source.

Anyway, thanks for the review!

[–] dohpaz42@lemmy.world 0 points 1 year ago (1 children)

In a digital signature system, a sender can use a private key together with a message to create a signature. Anyone with the corresponding public key can verify whether the signature matches the message, but a forger who does not know the private key cannot find any message/signature pair that will pass verification with the public key

https://en.m.wikipedia.org/wiki/Public-key_cryptography

[–] Crul@lemmy.world 0 points 1 year ago* (last edited 1 year ago) (1 children)

Sorry, but I still think I'm saying the same thing as in that paragraph:

[from your link] a sender can use a private key together with a message to create a signature

  • [from my post] the same content published in clear text encrypted with the[ir] private key

[from your link] Anyone with the corresponding public key can verify

  • [from my post] anyone can decrypt it with the author's public key
[–] dohpaz42@lemmy.world 0 points 1 year ago (1 children)

You’re not though. You said encryption occurs with the public key and decryption occurs with the private. That’s the opposite of what happens and what the quoted text says.

From the same source:

In a public-key encryption system, anyone with a public key can encrypt a message, yielding a ciphertext, but only those who know the corresponding private key can decrypt

[–] Crul@lemmy.world 0 points 1 year ago (1 children)

You said encryption occurs with the public key and decryption occurs with the private

I'm sad that I edited some typos on my original message because now you will probably think I changed it. But I said the opposite.

Anyway, there is probably some missunderstanding here and I don't think this conversation is useful.

Thanks for the feedback.

[–] dohpaz42@lemmy.world 0 points 1 year ago (1 children)

Funny story: you didn’t change the wrong info. The sad part is that you’re spreading misinformation and unwilling to hear otherwise. This is more dangerous than helpful.

[–] uberrice@feddit.de 0 points 1 year ago

How is Crul wrong in anything other than the terminology? You sign a document with your private key - generating basically a hash of the document entangled with your key information. Anyone holding the public key can then verify that hash with the public key - that the document contents are intact and unchanged (from the hash), and generated by the person holding the private key (entangled key information)