1
$\begingroup$

There is a requirement for me to both encrypt a file with the clients public key provided to us and sign the same file with our (my own) private key which they have the corresponding public key for.

Should this be a 2 step process (i.e. first encrypt then sign) Or can this be done in one shot using a single PGP command with multiple parameter? If so, can you please provide a sample of what the command would look like?

Improve this question
$\endgroup$
2
  • $\begingroup$ You need to encrypt if you want to provide confidentiality, however you can only prove it's from you authentically by signing it - those two are different operations. And forget about command line, use one of these $\endgroup$
    – DannyNiu
    Commented Apr 4, 2018 at 16:59
  • $\begingroup$ Provided you have your keys all configured correctly, you can do this in one command - $ gpg -se -r <recipients email> <file>. $\endgroup$
    – puzzlepalace
    Commented Apr 4, 2018 at 21:50

1 Answer 1

Reset to default
1
$\begingroup$

Should this be a 2 step process ...

Yes, you need to do it in 2 steps with common algorithms such as RSA, ECDSA, ECIES, etc. (because they're not signcrypt algorithms).

You should first encrypt, then sign, as this ensures with (slightly) better confidence that signature don't reveal information about the file/message.

If so, can you please provide a sample of what the command would look like?

Programming questions are off-topic. But if you really don't know how to use the command line, there is a high chance you can hurt yourself doing it, so a GUI app is recommended.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks Danny, this is helpful. Just one follow question, Doesn't encrypting then signing change the form of the content in the file twice? Therefore, when the client first decrpyts the file and then verifies the signature the encryption isn't right because the signing changed the form of the file incorrectly? Let me know if any part of my understanding is incorrect. $\endgroup$
    – Evan Ginsberg
    Commented Apr 4, 2018 at 17:42
  • $\begingroup$ If you encrypt the sign, then your client must verify then decrypt. They do it in the reverse direction than you do. $\endgroup$
    – DannyNiu
    Commented Apr 5, 2018 at 5:15
  • $\begingroup$ It's a 2-step process as DannyNiu pointed out, but can be done within one pgp command (sign -u "your private key" -r "recipient's public key" data) $\endgroup$
    – TrinityTonic
    Commented Apr 5, 2018 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.