OPSV has been integrated in Keyoxide and is no longer updated https://codeberg.org/yarmo/keyoxide

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Go to file

Yarmo Mackenbach 5bb7c3dfc1 continuous-integration/drone/push Build is passing Details Update README to reflect project status		3 years ago
.drone.yml	Migrate to main branch	3 years ago
LICENSE	Initial commit	3 years ago
README.md	Update README to reflect project status	3 years ago
index.html	Replace message label by signature	3 years ago
openpgp.min.js	Add files	3 years ago

README.md

Open PGP Signature Verification (OPSV)

OPSV is a FOSS solution for easy PGP signature verification.

WARNING

OPSV is integrated in the larger keyoxide project and will therefore no longer be updated.

https://codeberg.org/yarmo/keyoxide

About

This project uses openpgp.js loaded in the browser, meaning all processing is done on the device itself and no data is ever sent to the server. It supports loading public keys directly through:

plaintext input
web key directory (WKD)
HTTP Keyserver Protocol (HKP).

OPSV will always use the first input method it detects in the order described above.

It's also possible to not provide a public key. Read more about this in the Using no public key at all section below.

Usage

Visit https://opsv.foss.guru/. On this website, you can enter a signed message (see example below) and any of the three supported public key inputs to verify that the owner of that public key was indeed the person to have signed that message.

Example

Let's say I, Yarmo, would really like the world to know that I like pineapple. Using my private key, I've signed that statement so you can verify I wrote that message.

The signed statement:

Use this as "Signature" on OPSV.

Using plaintext public key

Now, let's check the signature. Go to my personal website and copy-paste the "plaintext" key in the "Public Key (1: plaintext)" field.

You will see a green message confirming that my key was used to sign this message. I really do like pineapple.

Using web key directory (WKD)

Remove the contents from the "Public Key (1: plaintext)" field. Now, in the "Public Key (2: web key directory)", write yarmo@yarmo.eu and verify the signature again. It is still verified. Try using jane@doe.org or any other input, it won't verify.

Using HTTP Keyserver Protocol (HKP)

Remove the contents from the "Public Key (2: web key directory)" field. I uploaded my keys to the https://keys.openpgp.org/ HKP server, which is the default server used by OPSV. All you need to do is once again go to my personal website and copy-paste the "Fingerprint" in the "Public Key (3: HKP)" field (the second field!). Still verified!

Using no public key at all

Wait, what? Then what am I verifying the signature against?

PGP signatures can contain the userId of the signer. If OPSV finds a userId, it will use it to perform a HKP lookup.

Remove the contents from the "Public Key (3: HKP)" field. It again verifies BUT against the information contained within the signature itself. You should carefully check the information OPSV returns. In this case, the authenticity is confirmed because the userId (yarmo@yarmo.eu) matches the one I use.

The signature below does not contain a userId:

Once again, the signature verifies. And again, it only verifies against the information contained within itself so that doesn't prove anything about its authenticity. Anyone can write this and the signature will return verified.

Except now, there is no userId for easy manual verification. So, you need to either take the keyId or the fingerprint and find some other way of verifying it, for example by contacting the person who supposedly wrote the message.

In my case, you can simply visit my personal website and compare the fingerprint.

What can a bad actor do?

One could not sign a statement with my private key: I, and only I, have access to it.

One could however simply take any of my signed messages and change the content. Like so:

Given the wording of the statement, you naturally doubt the origin of it being me. You run it through OPSV and indeed, this is not what I wrote!

You know me, "I despise privacy invasion." (hint hint).