I saw that people on the dark web would sign their posts with a PGP key to prove that their account has not been compromised. I think I understand the concept of how private and public keys work but I must be missing something because I don’t see how it proves anything.
I created a key and ran gpg --export --armor fizz@… and I ran that twice and both blocks were identical. If I posted my public key block couldn’t someone copy and paste that under their message and claim to be me?
Sorry, but I still think I’m saying the same thing as in that paragraph:
Look at the words you used, encryption is not the same as a signature, with a signature you can prove that a person with access to the private key wrote the message.
What you’re talking about in your message is encryption, and you have it the wrong way around, messages gets encrypted with the public key, and can only be read with the private key.
We may be getting somewhere…
So they are not excrypting it, but do we agree that with signatures the author uses their private key + the clear message to generate “something”?
… so then anyone can use the author’s public key to check that “something” against the clear mesage to confirm the author’s identity?
If that’s the case, then my error is that the operation to generate the signature is not an encryption. So, may I ask… what is it? A special type of hash?
Thanks again. I will edit my original comment with the corrections once I understand it correctly.
Yeah sure, and I think the person you are arguing with is saying as much as well, it’s just that this is not encrypting it, when you encrypt something you obfuscate it in a way that is possible to deobfuscate, think the caesar cipher as a simple encryption, a hash/signature on the other hand is something that is generated from the clear text using your private key, which is not possible to decrypt, think very simplified that the person would just put the amount of each letter of the alphabet used in in the text, then add the length of the thread, and then multiplied by your private key. This way it’s proven that the holder of the private key is the person writing the text, and that the text hasn’t changed since the signature was generated.
They can confirm that the person holding the private key (not identity, just that they have the key) and also that nobody changed it since they signed it (like the person adminning the forum or a moderator or something)
It’s basically a hashing function yeah.
You’re not though. You said encryption occurs with the public key and decryption occurs with the private. That’s the opposite of what happens and what the quoted text says.
From the same source:
I’m sad that I edited some typos on my original message because now you will probably think I changed it. But I said the opposite.
Anyway, there is probably some missunderstanding here and I don’t think this conversation is useful.
Thanks for the feedback.
Funny story: you didn’t change the wrong info. The sad part is that you’re spreading misinformation and unwilling to hear otherwise. This is more dangerous than helpful.
How is Crul wrong in anything other than the terminology? You sign a document with your private key - generating basically a hash of the document entangled with your key information. Anyone holding the public key can then verify that hash with the public key - that the document contents are intact and unchanged (from the hash), and generated by the person holding the private key (entangled key information)
Thanks for mediating!
What I’m getting from this dicussion is that, when signing, the operations are not encryption and decryption, but … hashing and hash-veryfing?
To help you with the terminology, the names for the two operations are “signing” and “verifying”. That’s it.
What can you do with…
“Signing” is not at all the same as “encrypting” with the keys swapped. It is a separate specific sequence of mathematical operations you perform to combine two numbers (the private key and the message) to produce a third - the signature. Signing is not called “hashing”. A hash may be involved as part of the signature process, but it is not strictly necessary. It makes the “message” number smaller, but the algorithm can sign the full message without hashing it first, will just require computation for longer time. “Hash-verifying” isn’t a thing in this context, you made that name up, just use “verify”.
@dohpaz42 is mad because you messed up your terminology originally, and thought you were trying to say that you “encrypt” a message with the private key, which is totally backwards and wrong. He didn’t know that in your mind you thought you were talking about “signing” the message. Because honestly no one could have known that.
Thanks! re-corrected again.
👍